From c28e6269f0389e00acfa5d3d0d3f685e1fc1865e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 20 Jun 2025 09:15:07 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...tery-negate-current-when-discharging.patch | 63 +++++ ...-out-if-acpi_kobj-registration-fails.patch | 43 ++++ ...sequence-overread-in-call-to-strncmp.patch | 57 +++++ ...cpi-operand-cache-leak-in-dswstate.c.patch | 110 ++++++++ ...-acpi-parse-and-parseext-cache-leaks.patch | 236 ++++++++++++++++++ ...ties-fix-overflow-check-in-vsnprintf.patch | 46 ++++ ...-l4ls-clk-domain-handling-in-standby.patch | 87 +++++++ ...o-only-show-one-cpu-s-info-in-c_show.patch | 168 +++++++++++++ ...er-cycle-amp-on-isense-vsense-change.patch | 73 ++++++ ...ub-add-check-to-of_device_get_match_.patch | 36 +++ ...-fix-data-lost-during-eagain-retries.patch | 68 +++++ ...ase-mc_cmd_completion_timeout_ms-val.patch | 40 +++ ...kchip-rk3036-mark-ddrphy-as-critical.patch | 37 +++ ...the-cpus-choice-in-the-watchdog-per-.patch | 60 +++++ ...nc-policy-boost-with-global-boost-on.patch | 45 ++++ ...p-scmi-devices-that-aren-t-used-by-t.patch | 89 +++++++ ...add-null-pointer-checks-in-dm_force_.patch | 82 ++++++ .../drm-amdgpu-gfx10-fix-csib-handling.patch | 35 +++ .../drm-amdgpu-gfx6-fix-csib-handling.patch | 35 +++ .../drm-amdgpu-gfx7-fix-csib-handling.patch | 35 +++ .../drm-amdgpu-gfx8-fix-csib-handling.patch | 35 +++ .../drm-amdgpu-gfx9-fix-csib-handling.patch | 35 +++ ...t-sdma_rlcx_ib_cntl-switch_inside_ib.patch | 39 +++ ...gix_dp-add-irq-flag-irqf_no_autoen-i.patch | 54 ++++ ...x7625-change-the-gpiod_set_value-api.patch | 63 +++++ ...m-a6xx-increase-hfi-response-timeout.patch | 39 +++ ...t-select-single-flush-for-active-ctl.patch | 39 +++ ...-runtime-pm-calls-to-ddc-transfer-fu.patch | 70 ++++++ ...rect-command-version-selection-in-be.patch | 39 +++ ...xfat-fix-double-free-in-delayed_free.patch | 40 +++ ...ext4_ex_nocache-nofail-flags-in-ext4.patch | 108 ++++++++ ...le-extent-cache-entries-caused-by-co.patch | 73 ++++++ ...nvoke-runtime-suspend-on-quick-slave.patch | 79 ++++++ .../i2c-npcm-add-clock-toggle-recovery.patch | 49 ++++ ...ite-access-to-an-invalid-page-in-i40.patch | 48 ++++ ...-ga-log-notifier-callbacks-finish-ru.patch | 43 ++++ ...this_cpu_inc-for-stats-on-preempt_rt.patch | 44 ++++ ...dex-out-of-bounds-read-in-add_missin.patch | 85 +++++++ ...s-fix-null-ptr-deref-in-jfs_ioc_trim.patch | 119 +++++++++ ...ical-pointer-detection-to-btf_dedup_.patch | 71 ++++++ ...cs-pll-better-validate-vt-pll-branch.patch | 67 +++++ ...-enable-runtime-pm-before-sub-device.patch | 55 ++++ ...-fix-runtime-pm-handling-in-remove-f.patch | 46 ++++ ...334-update-mode_3840x2160_regs-array.patch | 42 ++++ ...xynos4-is-add-hardware-sync-wait-to-.patch | 39 +++ ...tialize-the-m2m-context-before-the-c.patch | 59 +++++ ...358743-ignore-video-while-hpd-is-low.patch | 43 ++++ ...-ti-cal-fix-wrong-goto-on-error-path.patch | 47 ++++ ...hange-v4l2_type_is_capture-condition.patch | 57 +++++ ...4l-fix-v4l2_type_is_output-condition.patch | 35 +++ ...erate-software-timestamp-just-before.patch | 49 ++++ ...-re-implement-br_multicast_-enable-d.patch | 173 +++++++++++++ ...add-synchronization-for-stats-update.patch | 102 ++++++++ ...eturn-value-of-dma_set_mask_and_cohe.patch | 42 ++++ ..._timestamping_tx_software-flag-when-.patch | 37 +++ ...te_mmu_cache-on-spurious-tlb-permiss.patch | 85 +++++++ ...-error-log-forcn10k_map_unmap_rq_pol.patch | 47 ++++ ...cter-validation-for-the-userspace-ac.patch | 45 ++++ ...7xx-propagate-error-from-armada_37xx.patch | 41 +++ ...opagate-error-from-armada_37xx.patch-10009 | 45 ++++ ...ropagate-error-from-armada_37xx.patch-1690 | 52 ++++ ...opagate-error-from-armada_37xx.patch-28264 | 45 ++++ ...s08-reset-all-pins-to-input-at-probe.patch | 47 ++++ ...platform-x86-dell_rbu-fix-list-usage.patch | 54 ++++ ...ell_rbu-stop-overwriting-data-buffer.patch | 55 ++++ ...enying-of-auto-suspend-in-pm_suspend.patch | 61 +++++ ...standby-handling-of-per-power-domain.patch | 60 +++++ ...ply-bq27xxx-retrieve-again-when-busy.patch | 90 +++++++ ...missing-pe-bridge-reconfiguration-du.patch | 67 +++++ ...sc-probe-for-l4_wkup-and-l4_cfg-inte.patch | 112 +++++++++ ...fc_check_sli_ndlp-handling-for-gen_r.patch | 40 +++ ...csi-lpfc-use-memcpy-for-bios-version.patch | 47 ++++ ...t-wake-readers-in-__sctp_write_space.patch | 42 ++++ queue-5.15/series | 86 +++++++ ...or-checking-condition-for-assign-rel.patch | 49 ++++ ...rrect-a-oob-check-in-software_node_g.patch | 42 ++++ ...in-cache-cleanup-causing-stale-nextc.patch | 81 ++++++ ...xtcheck-time-when-adding-new-cache-e.patch | 52 ++++ ...for-minimal-rtt-in-tcp_rcv_rtt_updat.patch | 71 ++++++ ...tp-rcvq_space.space-value-for-passiv.patch | 52 ++++ ...-calculation-wraparound-on-32-bit-ke.patch | 87 +++++++ ...qcom-tsens-update-conditions-to-stri.patch | 79 ++++++ ...use-kfree_sensitive-for-aead-cleanup.patch | 45 ++++ ...at-dst-cache-initialization-errors-a.patch | 75 ++++++ .../watchdog-da9052_wdt-respect-twdmin.patch | 39 +++ ...-not-offer-a-mesh-path-if-forwarding.patch | 67 +++++ ...-add-support-for-liteon-wn4516r-wn45.patch | 86 +++++++ 87 files changed, 5456 insertions(+) create mode 100644 queue-5.15/acpi-battery-negate-current-when-discharging.patch create mode 100644 queue-5.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch create mode 100644 queue-5.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch create mode 100644 queue-5.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch create mode 100644 queue-5.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch create mode 100644 queue-5.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch create mode 100644 queue-5.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch create mode 100644 queue-5.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch create mode 100644 queue-5.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch create mode 100644 queue-5.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch create mode 100644 queue-5.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch create mode 100644 queue-5.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch create mode 100644 queue-5.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch create mode 100644 queue-5.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch create mode 100644 queue-5.15/cpufreq-force-sync-policy-boost-with-global-boost-on.patch create mode 100644 queue-5.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch create mode 100644 queue-5.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch create mode 100644 queue-5.15/drm-amdgpu-gfx10-fix-csib-handling.patch create mode 100644 queue-5.15/drm-amdgpu-gfx6-fix-csib-handling.patch create mode 100644 queue-5.15/drm-amdgpu-gfx7-fix-csib-handling.patch create mode 100644 queue-5.15/drm-amdgpu-gfx8-fix-csib-handling.patch create mode 100644 queue-5.15/drm-amdgpu-gfx9-fix-csib-handling.patch create mode 100644 queue-5.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch create mode 100644 queue-5.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch create mode 100644 queue-5.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch create mode 100644 queue-5.15/drm-msm-a6xx-increase-hfi-response-timeout.patch create mode 100644 queue-5.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch create mode 100644 queue-5.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch create mode 100644 queue-5.15/emulex-benet-correct-command-version-selection-in-be.patch create mode 100644 queue-5.15/exfat-fix-double-free-in-delayed_free.patch create mode 100644 queue-5.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch create mode 100644 queue-5.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch create mode 100644 queue-5.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch create mode 100644 queue-5.15/i2c-npcm-add-clock-toggle-recovery.patch create mode 100644 queue-5.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch create mode 100644 queue-5.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch create mode 100644 queue-5.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch create mode 100644 queue-5.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch create mode 100644 queue-5.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch create mode 100644 queue-5.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch create mode 100644 queue-5.15/media-ccs-pll-better-validate-vt-pll-branch.patch create mode 100644 queue-5.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch create mode 100644 queue-5.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch create mode 100644 queue-5.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch create mode 100644 queue-5.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch create mode 100644 queue-5.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch create mode 100644 queue-5.15/media-tc358743-ignore-video-while-hpd-is-low.patch create mode 100644 queue-5.15/media-ti-cal-fix-wrong-goto-on-error-path.patch create mode 100644 queue-5.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch create mode 100644 queue-5.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch create mode 100644 queue-5.15/net-atlantic-generate-software-timestamp-just-before.patch create mode 100644 queue-5.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch create mode 100644 queue-5.15/net-dlink-add-synchronization-for-stats-update.patch create mode 100644 queue-5.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch create mode 100644 queue-5.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch create mode 100644 queue-5.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch create mode 100644 queue-5.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch create mode 100644 queue-5.15/openvswitch-stricter-validation-for-the-userspace-ac.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009 create mode 100644 queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690 create mode 100644 queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264 create mode 100644 queue-5.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch create mode 100644 queue-5.15/platform-x86-dell_rbu-fix-list-usage.patch create mode 100644 queue-5.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch create mode 100644 queue-5.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch create mode 100644 queue-5.15/pmdomain-ti-fix-standby-handling-of-per-power-domain.patch create mode 100644 queue-5.15/power-supply-bq27xxx-retrieve-again-when-busy.patch create mode 100644 queue-5.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch create mode 100644 queue-5.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch create mode 100644 queue-5.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch create mode 100644 queue-5.15/scsi-lpfc-use-memcpy-for-bios-version.patch create mode 100644 queue-5.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch create mode 100644 queue-5.15/sock-correct-error-checking-condition-for-assign-rel.patch create mode 100644 queue-5.15/software-node-correct-a-oob-check-in-software_node_g.patch create mode 100644 queue-5.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch create mode 100644 queue-5.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch create mode 100644 queue-5.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch create mode 100644 queue-5.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch create mode 100644 queue-5.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch create mode 100644 queue-5.15/thermal-drivers-qcom-tsens-update-conditions-to-stri.patch create mode 100644 queue-5.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch create mode 100644 queue-5.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch create mode 100644 queue-5.15/watchdog-da9052_wdt-respect-twdmin.patch create mode 100644 queue-5.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch create mode 100644 queue-5.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch diff --git a/queue-5.15/acpi-battery-negate-current-when-discharging.patch b/queue-5.15/acpi-battery-negate-current-when-discharging.patch new file mode 100644 index 0000000000..62cafc7ae9 --- /dev/null +++ b/queue-5.15/acpi-battery-negate-current-when-discharging.patch @@ -0,0 +1,63 @@ +From fd89fa7b37d97e54f9a8ca4f43dfb04c35fb9a1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 12:41:45 +1000 +Subject: ACPI: battery: negate current when discharging + +From: Peter Marheine + +[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ] + +The ACPI specification requires that battery rate is always positive, +but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW +(Documentation/ABI/testing/sysfs-class-power) specifies that it should +be negative when a battery is discharging. When reporting CURRENT_NOW, +massage the value to match the documented ABI. + +This only changes the sign of `current_now` and not `power_now` because +documentation doesn't describe any particular meaning for `power_now` so +leaving `power_now` unchanged is less likely to confuse userspace +unnecessarily, whereas becoming consistent with the documented ABI is +worth potentially confusing clients that read `current_now`. + +Signed-off-by: Peter Marheine +Link: https://patch.msgid.link/20250508024146.1436129-1-pmarheine@chromium.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 8bb0f4d06adc0..b0a5d077db905 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -250,10 +250,23 @@ static int acpi_battery_get_property(struct power_supply *psy, + break; + case POWER_SUPPLY_PROP_CURRENT_NOW: + case POWER_SUPPLY_PROP_POWER_NOW: +- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) ++ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) { + ret = -ENODEV; +- else +- val->intval = battery->rate_now * 1000; ++ break; ++ } ++ ++ val->intval = battery->rate_now * 1000; ++ /* ++ * When discharging, the current should be reported as a ++ * negative number as per the power supply class interface ++ * definition. ++ */ ++ if (psp == POWER_SUPPLY_PROP_CURRENT_NOW && ++ (battery->state & ACPI_BATTERY_STATE_DISCHARGING) && ++ acpi_battery_handle_discharging(battery) ++ == POWER_SUPPLY_STATUS_DISCHARGING) ++ val->intval = -val->intval; ++ + break; + case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN: + case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN: +-- +2.39.5 + diff --git a/queue-5.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch b/queue-5.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch new file mode 100644 index 0000000000..4432136eb2 --- /dev/null +++ b/queue-5.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch @@ -0,0 +1,43 @@ +From 200ebeaf7da9aa3d8718c9b98bd7616dd0f926ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 May 2025 20:51:11 +0200 +Subject: ACPI: bus: Bail out if acpi_kobj registration fails + +From: Armin Wolf + +[ Upstream commit 94a370fc8def6038dbc02199db9584b0b3690f1a ] + +The ACPI sysfs code will fail to initialize if acpi_kobj is NULL, +together with some ACPI drivers. + +Follow the other firmware subsystems and bail out if the kobject +cannot be registered. + +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20250518185111.3560-2-W_Armin@gmx.de +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/bus.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 9bc5bc5bc359b..ea63b8f272892 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1335,8 +1335,10 @@ static int __init acpi_init(void) + } + + acpi_kobj = kobject_create_and_add("acpi", firmware_kobj); +- if (!acpi_kobj) +- pr_debug("%s: kset create error\n", __func__); ++ if (!acpi_kobj) { ++ pr_err("Failed to register kobject\n"); ++ return -ENOMEM; ++ } + + init_prmt(); + result = acpi_bus_init(); +-- +2.39.5 + diff --git a/queue-5.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch b/queue-5.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch new file mode 100644 index 0000000000..6340802142 --- /dev/null +++ b/queue-5.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch @@ -0,0 +1,57 @@ +From 0b36c33eb3bda4c7139a11e19689489c917e1fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 21:30:27 +0200 +Subject: ACPICA: Avoid sequence overread in call to strncmp() + +From: Ahmed Salem + +[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ] + +ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c + +ap_get_table_length() checks if tables are valid by +calling ap_is_valid_header(). The latter then calls +ACPI_VALIDATE_RSDP_SIG(Table->Signature). + +ap_is_valid_header() accepts struct acpi_table_header as an argument, so +the signature size is always fixed to 4 bytes. + +The problem is when the string comparison is between ACPI-defined table +signature and ACPI_SIG_RSDP. Common ACPI table header specifies the +Signature field to be 4 bytes long[1], with the exception of the RSDP +structure whose signature is 8 bytes long "RSD PTR " (including the +trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would +then result in a sequence overread[3] as sig would be smaller (4 bytes) +than the specified bound (8 bytes). + +As a workaround, pass the bound conditionally based on the size of the +signature being passed. + +Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1] +Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2] +Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3] +Link: https://github.com/acpica/acpica/commit/8b83a8d8 +Signed-off-by: Ahmed Salem +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net +Signed-off-by: Sasha Levin +--- + include/acpi/actypes.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index cefbb7ad253e0..ea50b9c469c9d 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -524,7 +524,7 @@ typedef u64 acpi_integer; + + /* Support for the special RSDP signature (8 characters) */ + +-#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) ++#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8)) + #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8)) + + /* Support for OEMx signature (x can be any character) */ +-- +2.39.5 + diff --git a/queue-5.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch b/queue-5.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch new file mode 100644 index 0000000000..398e9557f5 --- /dev/null +++ b/queue-5.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch @@ -0,0 +1,110 @@ +From 212bb5ab67d4dc8432cbee1983e0f79588c4feaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 21:05:24 +0100 +Subject: ACPICA: fix acpi operand cache leak in dswstate.c + +From: Seunghun Han + +[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ] + +ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 + +I found an ACPI cache leak in ACPI early termination and boot continuing case. + +When early termination occurs due to malicious ACPI table, Linux kernel +terminates ACPI function and continues to boot process. While kernel terminates +ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak. + +Boot log of ACPI operand cache leak is as follows: +>[ 0.585957] ACPI: Added _OSI(Module Device) +>[ 0.587218] ACPI: Added _OSI(Processor Device) +>[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) +>[ 0.589790] ACPI: Added _OSI(Processor Aggregator Device) +>[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155) +>[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) +>[ 0.597858] ACPI: Unable to start the ACPI Interpreter +>[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +>[ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects +>[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 +>[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 +>[ 0.609177] Call Trace: +>[ 0.610063] ? dump_stack+0x5c/0x81 +>[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 +>[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 +>[ 0.613906] ? acpi_os_delete_cache+0xa/0x10 +>[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b +>[ 0.619293] ? acpi_terminate+0xa/0x14 +>[ 0.620394] ? acpi_init+0x2af/0x34f +>[ 0.621616] ? __class_create+0x4c/0x80 +>[ 0.623412] ? video_setup+0x7f/0x7f +>[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 +>[ 0.625861] ? do_one_initcall+0x4e/0x1a0 +>[ 0.627513] ? kernel_init_freeable+0x19e/0x21f +>[ 0.628972] ? rest_init+0x80/0x80 +>[ 0.630043] ? kernel_init+0xa/0x100 +>[ 0.631084] ? ret_from_fork+0x25/0x30 +>[ 0.633343] vgaarb: loaded +>[ 0.635036] EDAC MC: Ver: 3.0.0 +>[ 0.638601] PCI: Probing PCI hardware +>[ 0.639833] PCI host bridge to bus 0000:00 +>[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] +> ... Continue to boot and log is omitted ... + +I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ +delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() +function uses walk_state->operand_index for start position of the top, but +acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. +Therefore, this causes acpi operand memory leak. + +This cache leak causes a security threat because an old kernel (<= 4.9) shows +memory locations of kernel functions in stack dump. Some malicious users +could use this information to neutralize kernel ASLR. + +I made a patch to fix ACPI operand cache leak. + +Link: https://github.com/acpica/acpica/commit/987a3b5c +Signed-off-by: Seunghun Han +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/4999480.31r3eYUQgx@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/dsutils.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c +index fb9ed5e1da89d..2bdae8a25e084 100644 +--- a/drivers/acpi/acpica/dsutils.c ++++ b/drivers/acpi/acpica/dsutils.c +@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS]; + u32 arg_count = 0; + u32 index = walk_state->num_operands; ++ u32 prev_num_operands = walk_state->num_operands; ++ u32 new_num_operands; + u32 i; + + ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg); +@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + + /* Create the interpreter arguments, in reverse order */ + ++ new_num_operands = index; + index--; + for (i = 0; i < arg_count; i++) { + arg = arguments[index]; +@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + * pop everything off of the operand stack and delete those + * objects + */ +- acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state); ++ walk_state->num_operands = i; ++ acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state); ++ ++ /* Restore operand count */ ++ walk_state->num_operands = prev_num_operands; + + ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index)); + return_ACPI_STATUS(status); +-- +2.39.5 + diff --git a/queue-5.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch b/queue-5.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch new file mode 100644 index 0000000000..e653b9bd44 --- /dev/null +++ b/queue-5.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch @@ -0,0 +1,236 @@ +From 9f57808fb19bd9829df7194dd8a6aa63a2f332d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 21:06:21 +0100 +Subject: ACPICA: fix acpi parse and parseext cache leaks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Seunghun Han + +[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ] + +ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 + +I'm Seunghun Han, and I work for National Security Research Institute of +South Korea. + +I have been doing a research on ACPI and found an ACPI cache leak in ACPI +early abort cases. + +Boot log of ACPI cache leak is as follows: +[ 0.352414] ACPI: Added _OSI(Module Device) +[ 0.353182] ACPI: Added _OSI(Processor Device) +[ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.356028] ACPI: Unable to start the ACPI Interpreter +[ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +[ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects +[ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #10 +[ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.361873] Call Trace: +[ 0.362243] ? dump_stack+0x5c/0x81 +[ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.363296] ? acpi_os_delete_cache+0xa/0x10 +[ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b +[ 0.364000] ? acpi_terminate+0xa/0x14 +[ 0.364000] ? acpi_init+0x2af/0x34f +[ 0.364000] ? __class_create+0x4c/0x80 +[ 0.364000] ? video_setup+0x7f/0x7f +[ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.364000] ? do_one_initcall+0x4e/0x1a0 +[ 0.364000] ? kernel_init_freeable+0x189/0x20a +[ 0.364000] ? rest_init+0xc0/0xc0 +[ 0.364000] ? kernel_init+0xa/0x100 +[ 0.364000] ? ret_from_fork+0x25/0x30 + +I analyzed this memory leak in detail. I found that “Acpi-State” cache and +“Acpi-Parse” cache were merged because the size of cache objects was same +slab cache size. + +I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked +using SLAB_NEVER_MERGE flag in kmem_cache_create() function. + +Real ACPI cache leak point is as follows: +[ 0.360101] ACPI: Added _OSI(Module Device) +[ 0.360101] ACPI: Added _OSI(Processor Device) +[ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.364016] ACPI: Unable to start the ACPI Interpreter +[ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +[ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects +[ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #8 +[ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.372000] Call Trace: +[ 0.372000] ? dump_stack+0x5c/0x81 +[ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.372000] ? acpi_os_delete_cache+0xa/0x10 +[ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b +[ 0.372000] ? acpi_terminate+0xa/0x14 +[ 0.372000] ? acpi_init+0x2af/0x34f +[ 0.372000] ? __class_create+0x4c/0x80 +[ 0.372000] ? video_setup+0x7f/0x7f +[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.372000] ? do_one_initcall+0x4e/0x1a0 +[ 0.372000] ? kernel_init_freeable+0x189/0x20a +[ 0.372000] ? rest_init+0xc0/0xc0 +[ 0.372000] ? kernel_init+0xa/0x100 +[ 0.372000] ? ret_from_fork+0x25/0x30 +[ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects +[ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #8 +[ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.392000] Call Trace: +[ 0.392000] ? dump_stack+0x5c/0x81 +[ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.392000] ? acpi_os_delete_cache+0xa/0x10 +[ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b +[ 0.392000] ? acpi_terminate+0xa/0x14 +[ 0.392000] ? acpi_init+0x2af/0x34f +[ 0.392000] ? __class_create+0x4c/0x80 +[ 0.392000] ? video_setup+0x7f/0x7f +[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.392000] ? do_one_initcall+0x4e/0x1a0 +[ 0.392000] ? kernel_init_freeable+0x189/0x20a +[ 0.392000] ? rest_init+0xc0/0xc0 +[ 0.392000] ? kernel_init+0xa/0x100 +[ 0.392000] ? ret_from_fork+0x25/0x30 + +When early abort is occurred due to invalid ACPI information, Linux kernel +terminates ACPI by calling acpi_terminate() function. The function calls +acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_ +cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache). + +But the deletion codes in acpi_ut_delete_caches() function only delete +slab caches using kmem_cache_destroy() function, therefore the cache +objects should be flushed before acpi_ut_delete_caches() function. + +"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse +function, acpi_ps_parse_loop(). The function should complete all ops +using acpi_ps_complete_final_op() when an error occurs due to invalid +AML codes. +However, the current implementation of acpi_ps_complete_final_op() does not +complete all ops when it meets some errors and this cause cache leak. + +This cache leak has a security threat because an old kernel (<= 4.9) shows +memory locations of kernel functions in stack dump. Some malicious users +could use this information to neutralize kernel ASLR. + +To fix ACPI cache leak for enhancing security, I made a patch to complete all +ops unconditionally for acpi_ps_complete_final_op() function. + +I hope that this patch improves the security of Linux kernel. + +Thank you. + +Link: https://github.com/acpica/acpica/commit/8829e70e +Signed-off-by: Seunghun Han +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/2363774.ElGaqSPkdT@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------ + 1 file changed, 15 insertions(+), 37 deletions(-) + +diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c +index e4420cd6d2814..8fd191b363066 100644 +--- a/drivers/acpi/acpica/psobject.c ++++ b/drivers/acpi/acpica/psobject.c +@@ -636,7 +636,8 @@ acpi_status + acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + union acpi_parse_object *op, acpi_status status) + { +- acpi_status status2; ++ acpi_status return_status = status; ++ u8 ascending = TRUE; + + ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state); + +@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + op)); + do { + if (op) { +- if (walk_state->ascending_callback != NULL) { ++ if (ascending && walk_state->ascending_callback != NULL) { + walk_state->op = op; + walk_state->op_info = + acpi_ps_get_opcode_info(op->common. +@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + } + + if (status == AE_CTRL_TERMINATE) { +- status = AE_OK; +- +- /* Clean up */ +- do { +- if (op) { +- status2 = +- acpi_ps_complete_this_op +- (walk_state, op); +- if (ACPI_FAILURE +- (status2)) { +- return_ACPI_STATUS +- (status2); +- } +- } +- +- acpi_ps_pop_scope(& +- (walk_state-> +- parser_state), +- &op, +- &walk_state-> +- arg_types, +- &walk_state-> +- arg_count); +- +- } while (op); +- +- return_ACPI_STATUS(status); ++ ascending = FALSE; ++ return_status = AE_CTRL_TERMINATE; + } + + else if (ACPI_FAILURE(status)) { + + /* First error is most important */ + +- (void) +- acpi_ps_complete_this_op(walk_state, +- op); +- return_ACPI_STATUS(status); ++ ascending = FALSE; ++ return_status = status; + } + } + +- status2 = acpi_ps_complete_this_op(walk_state, op); +- if (ACPI_FAILURE(status2)) { +- return_ACPI_STATUS(status2); ++ status = acpi_ps_complete_this_op(walk_state, op); ++ if (ACPI_FAILURE(status)) { ++ ascending = FALSE; ++ if (ACPI_SUCCESS(return_status) || ++ return_status == AE_CTRL_TERMINATE) { ++ return_status = status; ++ } + } + } + +@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + + } while (op); + +- return_ACPI_STATUS(status); ++ return_ACPI_STATUS(return_status); + } +-- +2.39.5 + diff --git a/queue-5.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch b/queue-5.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch new file mode 100644 index 0000000000..445809b5fa --- /dev/null +++ b/queue-5.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch @@ -0,0 +1,46 @@ +From fbf0ccd0db9214c941264db55a21b03579f2b875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 21:21:52 +0200 +Subject: ACPICA: utilities: Fix overflow check in vsnprintf() + +From: gldrk + +[ Upstream commit 12b660251007e00a3e4d47ec62dbe3a7ace7023e ] + +ACPICA commit d9d59b7918514ae55063b93f3ec041b1a569bf49 + +The old version breaks sprintf on 64-bit systems for buffers +outside [0..UINT32_MAX]. + +Link: https://github.com/acpica/acpica/commit/d9d59b79 +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/4994935.GXAFRqVoOG@rjwysocki.net +Signed-off-by: gldrk +[ rjw: Added the tag from gldrk ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/utprint.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/acpica/utprint.c b/drivers/acpi/acpica/utprint.c +index 05426596d1f4a..f910714b51f34 100644 +--- a/drivers/acpi/acpica/utprint.c ++++ b/drivers/acpi/acpica/utprint.c +@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args) + + pos = string; + +- if (size != ACPI_UINT32_MAX) { +- end = string + size; +- } else { +- end = ACPI_CAST_PTR(char, ACPI_UINT32_MAX); +- } ++ size = ACPI_MIN(size, ACPI_PTR_DIFF(ACPI_MAX_PTR, string)); ++ end = string + size; + + for (; *format; ++format) { + if (*format != '%') { +-- +2.39.5 + diff --git a/queue-5.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch b/queue-5.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch new file mode 100644 index 0000000000..bf717d4f57 --- /dev/null +++ b/queue-5.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch @@ -0,0 +1,87 @@ +From 6d1e76918d1dca67921b25b053fbee77e9199b98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 16:00:39 -0700 +Subject: ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY + +From: Sukrut Bellary + +[ Upstream commit 47fe74098f3dadba2f9cc1e507d813a4aa93f5f3 ] + +Don't put the l4ls clk domain to sleep in case of standby. +Since CM3 PM FW[1](ti-v4.1.y) doesn't wake-up/enable the l4ls clk domain +upon wake-up, CM3 PM FW fails to wake-up the MPU. + +[1] https://git.ti.com/cgit/processor-firmware/ti-amx3-cm3-pm-firmware/ + +Signed-off-by: Sukrut Bellary +Tested-by: Judith Mendez +Link: https://lore.kernel.org/r/20250318230042.3138542-2-sbellary@baylibre.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/clockdomain.h | 1 + + arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +- + arch/arm/mach-omap2/cm33xx.c | 14 +++++++++++++- + 3 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h +index 68550b23c938d..eb6ca2ea80679 100644 +--- a/arch/arm/mach-omap2/clockdomain.h ++++ b/arch/arm/mach-omap2/clockdomain.h +@@ -48,6 +48,7 @@ + #define CLKDM_NO_AUTODEPS (1 << 4) + #define CLKDM_ACTIVE_WITH_MPU (1 << 5) + #define CLKDM_MISSING_IDLE_REPORTING (1 << 6) ++#define CLKDM_STANDBY_FORCE_WAKEUP BIT(7) + + #define CLKDM_CAN_HWSUP (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO) + #define CLKDM_CAN_SWSUP (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP) +diff --git a/arch/arm/mach-omap2/clockdomains33xx_data.c b/arch/arm/mach-omap2/clockdomains33xx_data.c +index b4d5144df4454..c53df9d42ecf8 100644 +--- a/arch/arm/mach-omap2/clockdomains33xx_data.c ++++ b/arch/arm/mach-omap2/clockdomains33xx_data.c +@@ -27,7 +27,7 @@ static struct clockdomain l4ls_am33xx_clkdm = { + .pwrdm = { .name = "per_pwrdm" }, + .cm_inst = AM33XX_CM_PER_MOD, + .clkdm_offs = AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET, +- .flags = CLKDM_CAN_SWSUP, ++ .flags = CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP, + }; + + static struct clockdomain l3s_am33xx_clkdm = { +diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c +index ac4882ebdca33..be84c6750026e 100644 +--- a/arch/arm/mach-omap2/cm33xx.c ++++ b/arch/arm/mach-omap2/cm33xx.c +@@ -28,6 +28,9 @@ + #include "cm-regbits-34xx.h" + #include "cm-regbits-33xx.h" + #include "prm33xx.h" ++#if IS_ENABLED(CONFIG_SUSPEND) ++#include ++#endif + + /* + * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield: +@@ -336,8 +339,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm) + { + bool hwsup = false; + ++#if IS_ENABLED(CONFIG_SUSPEND) ++ /* ++ * In case of standby, Don't put the l4ls clk domain to sleep. ++ * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain ++ * upon wake-up, CM3 PM FW fails to wake-up th MPU. ++ */ ++ if (pm_suspend_target_state == PM_SUSPEND_STANDBY && ++ (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP)) ++ return 0; ++#endif + hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs); +- + if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)) + am33xx_clkdm_sleep(clkdm); + +-- +2.39.5 + diff --git a/queue-5.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch b/queue-5.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch new file mode 100644 index 0000000000..d4713f5e79 --- /dev/null +++ b/queue-5.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch @@ -0,0 +1,168 @@ +From e9b2851f4a4a64e7d5903f968fdd4aea124615c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 14:29:47 +0800 +Subject: arm64/cpuinfo: only show one cpu's info in c_show() + +From: Ye Bin + +[ Upstream commit 7bb797757bf5720543f1c5115b40a8d646d5c1cc ] + +Currently, when ARM64 displays CPU information, every call to c_show() +assembles all CPU information. However, as the number of CPUs increases, +this can lead to insufficient buffer space due to excessive assembly in +a single call, causing repeated expansion and multiple calls to c_show(). + +To prevent this invalid c_show() call, only one CPU's information is +assembled each time c_show() is called. + +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20250421062947.4072855-1-yebin@huaweicloud.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpuinfo.c | 111 ++++++++++++++++++------------------ + 1 file changed, 55 insertions(+), 56 deletions(-) + +diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c +index 591c18a889a56..bed260961d606 100644 +--- a/arch/arm64/kernel/cpuinfo.c ++++ b/arch/arm64/kernel/cpuinfo.c +@@ -138,80 +138,79 @@ static const char *const compat_hwcap2_str[] = { + + static int c_show(struct seq_file *m, void *v) + { +- int i, j; ++ int j; ++ int cpu = m->index; + bool compat = personality(current->personality) == PER_LINUX32; ++ struct cpuinfo_arm64 *cpuinfo = v; ++ u32 midr = cpuinfo->reg_midr; + +- for_each_online_cpu(i) { +- struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i); +- u32 midr = cpuinfo->reg_midr; +- +- /* +- * glibc reads /proc/cpuinfo to determine the number of +- * online processors, looking for lines beginning with +- * "processor". Give glibc what it expects. +- */ +- seq_printf(m, "processor\t: %d\n", i); +- if (compat) +- seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n", +- MIDR_REVISION(midr), COMPAT_ELF_PLATFORM); +- +- seq_printf(m, "BogoMIPS\t: %lu.%02lu\n", +- loops_per_jiffy / (500000UL/HZ), +- loops_per_jiffy / (5000UL/HZ) % 100); +- +- /* +- * Dump out the common processor features in a single line. +- * Userspace should read the hwcaps with getauxval(AT_HWCAP) +- * rather than attempting to parse this, but there's a body of +- * software which does already (at least for 32-bit). +- */ +- seq_puts(m, "Features\t:"); +- if (compat) { ++ /* ++ * glibc reads /proc/cpuinfo to determine the number of ++ * online processors, looking for lines beginning with ++ * "processor". Give glibc what it expects. ++ */ ++ seq_printf(m, "processor\t: %d\n", cpu); ++ if (compat) ++ seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n", ++ MIDR_REVISION(midr), COMPAT_ELF_PLATFORM); ++ ++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n", ++ loops_per_jiffy / (500000UL/HZ), ++ loops_per_jiffy / (5000UL/HZ) % 100); ++ ++ /* ++ * Dump out the common processor features in a single line. ++ * Userspace should read the hwcaps with getauxval(AT_HWCAP) ++ * rather than attempting to parse this, but there's a body of ++ * software which does already (at least for 32-bit). ++ */ ++ seq_puts(m, "Features\t:"); ++ if (compat) { + #ifdef CONFIG_COMPAT +- for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) { +- if (compat_elf_hwcap & (1 << j)) { +- /* +- * Warn once if any feature should not +- * have been present on arm64 platform. +- */ +- if (WARN_ON_ONCE(!compat_hwcap_str[j])) +- continue; +- +- seq_printf(m, " %s", compat_hwcap_str[j]); +- } ++ for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) { ++ if (compat_elf_hwcap & (1 << j)) { ++ /* ++ * Warn once if any feature should not ++ * have been present on arm64 platform. ++ */ ++ if (WARN_ON_ONCE(!compat_hwcap_str[j])) ++ continue; ++ ++ seq_printf(m, " %s", compat_hwcap_str[j]); + } ++ } + +- for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++) +- if (compat_elf_hwcap2 & (1 << j)) +- seq_printf(m, " %s", compat_hwcap2_str[j]); ++ for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++) ++ if (compat_elf_hwcap2 & (1 << j)) ++ seq_printf(m, " %s", compat_hwcap2_str[j]); + #endif /* CONFIG_COMPAT */ +- } else { +- for (j = 0; j < ARRAY_SIZE(hwcap_str); j++) +- if (cpu_have_feature(j)) +- seq_printf(m, " %s", hwcap_str[j]); +- } +- seq_puts(m, "\n"); +- +- seq_printf(m, "CPU implementer\t: 0x%02x\n", +- MIDR_IMPLEMENTOR(midr)); +- seq_printf(m, "CPU architecture: 8\n"); +- seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr)); +- seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr)); +- seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr)); ++ } else { ++ for (j = 0; j < ARRAY_SIZE(hwcap_str); j++) ++ if (cpu_have_feature(j)) ++ seq_printf(m, " %s", hwcap_str[j]); + } ++ seq_puts(m, "\n"); ++ ++ seq_printf(m, "CPU implementer\t: 0x%02x\n", ++ MIDR_IMPLEMENTOR(midr)); ++ seq_puts(m, "CPU architecture: 8\n"); ++ seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr)); ++ seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr)); ++ seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr)); + + return 0; + } + + static void *c_start(struct seq_file *m, loff_t *pos) + { +- return *pos < 1 ? (void *)1 : NULL; ++ *pos = cpumask_next(*pos - 1, cpu_online_mask); ++ return *pos < nr_cpu_ids ? &per_cpu(cpu_data, *pos) : NULL; + } + + static void *c_next(struct seq_file *m, void *v, loff_t *pos) + { + ++*pos; +- return NULL; ++ return c_start(m, pos); + } + + static void c_stop(struct seq_file *m, void *v) +-- +2.39.5 + diff --git a/queue-5.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch b/queue-5.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch new file mode 100644 index 0000000000..96b2887a5c --- /dev/null +++ b/queue-5.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch @@ -0,0 +1,73 @@ +From 6f4c256988240877d36eeb8e4d14449d6545d679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 09:15:05 +1000 +Subject: ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change + +From: Hector Martin + +[ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ] + +The ISENSE/VSENSE blocks are only powered up when the amplifier +transitions from shutdown to active. This means that if those controls +are flipped on while the amplifier is already playing back audio, they +will have no effect. + +Fix this by forcing a power cycle around transitions in those controls. + +Reviewed-by: Neal Gompa +Signed-off-by: Hector Martin +Signed-off-by: James Calligeros +Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 4e71dc1cf588f..48bef7e5e4002 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch = + static const struct snd_kcontrol_new vsense_switch = + SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1); + ++static int sense_event(struct snd_soc_dapm_widget *w, ++ struct snd_kcontrol *kcontrol, int event) ++{ ++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); ++ struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component); ++ ++ /* ++ * Powering up ISENSE/VSENSE requires a trip through the shutdown state. ++ * Do that here to ensure that our changes are applied properly, otherwise ++ * we might end up with non-functional IVSENSE if playback started earlier, ++ * which would break software speaker protection. ++ */ ++ switch (event) { ++ case SND_SOC_DAPM_PRE_REG: ++ return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, ++ TAS2770_PWR_CTRL_MASK, ++ TAS2770_PWR_CTRL_SHUTDOWN); ++ case SND_SOC_DAPM_POST_REG: ++ return tas2770_update_pwr_ctrl(tas2770); ++ default: ++ return 0; ++ } ++} ++ + static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = { + SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux), +- SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch), +- SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch), ++ SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch, ++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), ++ SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch, ++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), + SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event, + SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), + SND_SOC_DAPM_OUTPUT("OUT"), +-- +2.39.5 + diff --git a/queue-5.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch b/queue-5.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch new file mode 100644 index 0000000000..907931864b --- /dev/null +++ b/queue-5.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch @@ -0,0 +1,36 @@ +From 8a81bc2160229c2cf3f7aced9356efeaa419a8dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 20:37:44 +0800 +Subject: ASoC: tegra210_ahub: Add check to of_device_get_match_data() + +From: Yuanjun Gong + +[ Upstream commit 04cb269c204398763a620d426cbee43064854000 ] + +In tegra_ahub_probe(), check the result of function +of_device_get_match_data(), return an error code in case it fails. + +Signed-off-by: Yuanjun Gong +Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/tegra/tegra210_ahub.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c +index 1b2f7cb8c6adc..686c8ff46ec8a 100644 +--- a/sound/soc/tegra/tegra210_ahub.c ++++ b/sound/soc/tegra/tegra210_ahub.c +@@ -607,6 +607,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) + return -ENOMEM; + + ahub->soc_data = of_device_get_match_data(&pdev->dev); ++ if (!ahub->soc_data) ++ return -ENODEV; + + platform_set_drvdata(pdev, ahub); + +-- +2.39.5 + diff --git a/queue-5.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch b/queue-5.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch new file mode 100644 index 0000000000..44f8d0aa29 --- /dev/null +++ b/queue-5.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch @@ -0,0 +1,68 @@ +From a6300d8ede6ef8ffee7e647a59c6bcd9588e2246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 22:21:20 +0800 +Subject: bpf, sockmap: Fix data lost during EAGAIN retries + +From: Jiayuan Chen + +[ Upstream commit 7683167196bd727ad5f3c3fc6a9ca70f54520a81 ] + +We call skb_bpf_redirect_clear() to clean _sk_redir before handling skb in +backlog, but when sk_psock_handle_skb() return EAGAIN due to sk_rcvbuf +limit, the redirect info in _sk_redir is not recovered. + +Fix skb redir loss during EAGAIN retries by restoring _sk_redir +information using skb_bpf_set_redir(). + +Before this patch: +''' +./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress +Setting up benchmark 'sockmap'... +create socket fd c1:13 p1:14 c2:15 p2:16 +Benchmark 'sockmap' started. +Send Speed 1343.172 MB/s, BPF Speed 1343.238 MB/s, Rcv Speed 65.271 MB/s +Send Speed 1352.022 MB/s, BPF Speed 1352.088 MB/s, Rcv Speed 0 MB/s +Send Speed 1354.105 MB/s, BPF Speed 1354.105 MB/s, Rcv Speed 0 MB/s +Send Speed 1355.018 MB/s, BPF Speed 1354.887 MB/s, Rcv Speed 0 MB/s +''' +Due to the high send rate, the RX processing path may frequently hit the +sk_rcvbuf limit. Once triggered, incorrect _sk_redir will cause the flow +to mistakenly enter the "!ingress" path, leading to send failures. +(The Rcv speed depends on tcp_rmem). + +After this patch: +''' +./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress +Setting up benchmark 'sockmap'... +create socket fd c1:13 p1:14 c2:15 p2:16 +Benchmark 'sockmap' started. +Send Speed 1347.236 MB/s, BPF Speed 1347.367 MB/s, Rcv Speed 65.402 MB/s +Send Speed 1353.320 MB/s, BPF Speed 1353.320 MB/s, Rcv Speed 65.536 MB/s +Send Speed 1353.186 MB/s, BPF Speed 1353.121 MB/s, Rcv Speed 65.536 MB/s +''' + +Signed-off-by: Jiayuan Chen +Link: https://lore.kernel.org/r/20250407142234.47591-2-jiayuan.chen@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 8a0a23079d902..b3d675c3c1ec4 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -672,7 +672,8 @@ static void sk_psock_backlog(struct work_struct *work) + if (ret <= 0) { + if (ret == -EAGAIN) { + sk_psock_skb_state(psock, state, len, off); +- ++ /* Restore redir info we cleared before */ ++ skb_bpf_set_redir(skb, psock->sk, ingress); + /* Delay slightly to prioritize any + * other work that might be here. + */ +-- +2.39.5 + diff --git a/queue-5.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch b/queue-5.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch new file mode 100644 index 0000000000..e90500772c --- /dev/null +++ b/queue-5.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch @@ -0,0 +1,40 @@ +From 88deb24705f8f59d28a6bc4da11668875c60f05e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 13:58:14 +0300 +Subject: bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value + +From: Laurentiu Tudor + +[ Upstream commit 23d060136841c58c2f9ee8c08ad945d1879ead4b ] + +In case the MC firmware runs in debug mode with extensive prints pushed +to the console, the current timeout of 500ms is not enough. +Increase the timeout value so that we don't have any chance of wrongly +assuming that the firmware is not responding when it's just taking more +time. + +Signed-off-by: Laurentiu Tudor +Signed-off-by: Ioana Ciornei +Link: https://lore.kernel.org/r/20250408105814.2837951-7-ioana.ciornei@nxp.com +Signed-off-by: Christophe Leroy +Signed-off-by: Sasha Levin +--- + drivers/bus/fsl-mc/mc-sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c +index f2052cd0a0517..b22c59d57c8f0 100644 +--- a/drivers/bus/fsl-mc/mc-sys.c ++++ b/drivers/bus/fsl-mc/mc-sys.c +@@ -19,7 +19,7 @@ + /* + * Timeout in milliseconds to wait for the completion of an MC command + */ +-#define MC_CMD_COMPLETION_TIMEOUT_MS 500 ++#define MC_CMD_COMPLETION_TIMEOUT_MS 15000 + + /* + * usleep_range() min and max values used to throttle down polling +-- +2.39.5 + diff --git a/queue-5.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch b/queue-5.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch new file mode 100644 index 0000000000..f91fc8a3c9 --- /dev/null +++ b/queue-5.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch @@ -0,0 +1,37 @@ +From aeec9501d5d2025a3344b0c6cc36bfc9015061d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 22:25:31 +0200 +Subject: clk: rockchip: rk3036: mark ddrphy as critical + +From: Heiko Stuebner + +[ Upstream commit 596a977b34a722c00245801a5774aa79cec4e81d ] + +The ddrphy is supplied by the dpll, but due to the limited number of PLLs +on the rk3036, the dpll also is used for other periperhals, like the GPU. + +So it happened, when the Lima driver turned off the gpu clock, this in +turn also disabled the dpll and thus the ram. + +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250503202532.992033-4-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3036.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c +index d644bc155ec6e..f5f27535087a3 100644 +--- a/drivers/clk/rockchip/clk-rk3036.c ++++ b/drivers/clk/rockchip/clk-rk3036.c +@@ -431,6 +431,7 @@ static const char *const rk3036_critical_clocks[] __initconst = { + "hclk_peri", + "pclk_peri", + "pclk_ddrupctl", ++ "ddrphy", + }; + + static void __init rk3036_clk_init(struct device_node *np) +-- +2.39.5 + diff --git a/queue-5.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch b/queue-5.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch new file mode 100644 index 0000000000..29ea937adf --- /dev/null +++ b/queue-5.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch @@ -0,0 +1,60 @@ +From 7c76eac4d1111f1daaf8d0d429137f3af21a5c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Mar 2025 14:36:24 -0300 +Subject: clocksource: Fix the CPUs' choice in the watchdog per CPU + verification + +From: Guilherme G. Piccoli + +[ Upstream commit 08d7becc1a6b8c936e25d827becabfe3bff72a36 ] + +Right now, if the clocksource watchdog detects a clocksource skew, it might +perform a per CPU check, for example in the TSC case on x86. In other +words: supposing TSC is detected as unstable by the clocksource watchdog +running at CPU1, as part of marking TSC unstable the kernel will also run a +check of TSC readings on some CPUs to be sure it is synced between them +all. + +But that check happens only on some CPUs, not all of them; this choice is +based on the parameter "verify_n_cpus" and in some random cpumask +calculation. So, the watchdog runs such per CPU checks on up to +"verify_n_cpus" random CPUs among all online CPUs, with the risk of +repeating CPUs (that aren't double checked) in the cpumask random +calculation. + +But if "verify_n_cpus" > num_online_cpus(), it should skip the random +calculation and just go ahead and check the clocksource sync between +all online CPUs, without the risk of skipping some CPUs due to +duplicity in the random cpumask calculation. + +Tests in a 4 CPU laptop with TSC skew detected led to some cases of the per +CPU verification skipping some CPU even with verify_n_cpus=8, due to the +duplicity on random cpumask generation. Skipping the randomization when the +number of online CPUs is smaller than verify_n_cpus, solves that. + +Suggested-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Guilherme G. Piccoli +Signed-off-by: Thomas Gleixner +Reviewed-by: Paul E. McKenney +Link: https://lore.kernel.org/all/20250323173857.372390-1-gpiccoli@igalia.com +Signed-off-by: Sasha Levin +--- + kernel/time/clocksource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index 32efc87c41f20..57575be840c5a 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -279,7 +279,7 @@ static void clocksource_verify_choose_cpus(void) + { + int cpu, i, n = verify_n_cpus; + +- if (n < 0) { ++ if (n < 0 || n >= num_online_cpus()) { + /* Check all of the CPUs. */ + cpumask_copy(&cpus_chosen, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &cpus_chosen); +-- +2.39.5 + diff --git a/queue-5.15/cpufreq-force-sync-policy-boost-with-global-boost-on.patch b/queue-5.15/cpufreq-force-sync-policy-boost-with-global-boost-on.patch new file mode 100644 index 0000000000..695207ac44 --- /dev/null +++ b/queue-5.15/cpufreq-force-sync-policy-boost-with-global-boost-on.patch @@ -0,0 +1,45 @@ +From b3e0ac7a97e37d86e6284ebc5b55cc6a37c676de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 21:50:18 +0530 +Subject: cpufreq: Force sync policy boost with global boost on sysfs update + +From: Viresh Kumar + +[ Upstream commit 121baab7b88ed865532dadb7ef1aee6e2bea86f5 ] + +If the global boost flag is enabled and policy boost flag is disabled, a +call to `cpufreq_boost_trigger_state(true)` must enable the policy's +boost state. + +The current code misses that because of an optimization. Fix it. + +Suggested-by: Lifeng Zheng +Reviewed-by: Lifeng Zheng +Signed-off-by: Viresh Kumar +Link: https://patch.msgid.link/852ff11c589e6300730d207baac195b2d9d8b95f.1745511526.git.viresh.kumar@linaro.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 2c98ddf2c8db1..bbb0cbb2eb8c2 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2698,8 +2698,10 @@ int cpufreq_boost_trigger_state(int state) + unsigned long flags; + int ret = 0; + +- if (cpufreq_driver->boost_enabled == state) +- return 0; ++ /* ++ * Don't compare 'cpufreq_driver->boost_enabled' with 'state' here to ++ * make sure all policies are in sync with global boost flag. ++ */ + + write_lock_irqsave(&cpufreq_driver_lock, flags); + cpufreq_driver->boost_enabled = state; +-- +2.39.5 + diff --git a/queue-5.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch b/queue-5.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch new file mode 100644 index 0000000000..ca10c90c1f --- /dev/null +++ b/queue-5.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch @@ -0,0 +1,89 @@ +From b31dd5aa34245dd87b0de327a3adec4b98556352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 20:53:12 -0700 +Subject: cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs + +From: Mike Tipton + +[ Upstream commit 6c9bb86922728c7a4cceb99f131e00dd87514f20 ] + +Currently, all SCMI devices with performance domains attempt to register +a cpufreq driver, even if their performance domains aren't used to +control the CPUs. The cpufreq framework only supports registering a +single driver, so only the first device will succeed. And if that device +isn't used for the CPUs, then cpufreq will scale the wrong domains. + +To avoid this, return early from scmi_cpufreq_probe() if the probing +SCMI device isn't referenced by the CPU device phandles. + +This keeps the existing assumption that all CPUs are controlled by a +single SCMI device. + +Signed-off-by: Mike Tipton +Reviewed-by: Peng Fan +Reviewed-by: Cristian Marussi +Reviewed-by: Sudeep Holla +Tested-by: Cristian Marussi +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 36 +++++++++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 8c9c2f710790f..1f12109526fa6 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -288,6 +288,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = { + .register_em = scmi_cpufreq_register_em, + }; + ++static bool scmi_dev_used_by_cpus(struct device *scmi_dev) ++{ ++ struct device_node *scmi_np = dev_of_node(scmi_dev); ++ struct device_node *cpu_np, *np; ++ struct device *cpu_dev; ++ int cpu, idx; ++ ++ if (!scmi_np) ++ return false; ++ ++ for_each_possible_cpu(cpu) { ++ cpu_dev = get_cpu_device(cpu); ++ if (!cpu_dev) ++ continue; ++ ++ cpu_np = dev_of_node(cpu_dev); ++ ++ np = of_parse_phandle(cpu_np, "clocks", 0); ++ of_node_put(np); ++ ++ if (np == scmi_np) ++ return true; ++ ++ idx = of_property_match_string(cpu_np, "power-domain-names", "perf"); ++ np = of_parse_phandle(cpu_np, "power-domains", idx); ++ of_node_put(np); ++ ++ if (np == scmi_np) ++ return true; ++ } ++ ++ return false; ++} ++ + static int scmi_cpufreq_probe(struct scmi_device *sdev) + { + int ret; +@@ -296,7 +330,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) + + handle = sdev->handle; + +- if (!handle) ++ if (!handle || !scmi_dev_used_by_cpus(dev)) + return -ENODEV; + + perf_ops = handle->devm_protocol_get(sdev, SCMI_PROTOCOL_PERF, &ph); +-- +2.39.5 + diff --git a/queue-5.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch b/queue-5.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch new file mode 100644 index 0000000000..b7bf415d43 --- /dev/null +++ b/queue-5.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch @@ -0,0 +1,82 @@ +From cea3062170bc06cabe9f1389b63ff1a152f4810a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 00:57:19 +0530 +Subject: drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() + +From: Srinivasan Shanmugam + +[ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ] + +This commit updates the dm_force_atomic_commit function to replace the +usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after +retrieving the Connector (drm_atomic_get_connector_state), CRTC +(drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state) +states. + +The function utilized PTR_ERR_OR_ZERO for error checking. However, this +approach is inappropriate in this context because the respective +functions do not return NULL; they return pointers that encode errors. + +This change ensures that error pointers are properly checked using +IS_ERR before attempting to dereference. + +Cc: Harry Wentland +Cc: Nicholas Kazlauskas +Cc: Tom Chung +Cc: Roman Li +Cc: Alex Hung +Cc: Aurabindo Pillai +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index e9f592bdac27f..24bb7063670ae 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10044,16 +10044,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector) + */ + conn_state = drm_atomic_get_connector_state(state, connector); + +- ret = PTR_ERR_OR_ZERO(conn_state); +- if (ret) ++ /* Check for error in getting connector state */ ++ if (IS_ERR(conn_state)) { ++ ret = PTR_ERR(conn_state); + goto out; ++ } + + /* Attach crtc to drm_atomic_state*/ + crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base); + +- ret = PTR_ERR_OR_ZERO(crtc_state); +- if (ret) ++ /* Check for error in getting crtc state */ ++ if (IS_ERR(crtc_state)) { ++ ret = PTR_ERR(crtc_state); + goto out; ++ } + + /* force a restore */ + crtc_state->mode_changed = true; +@@ -10061,9 +10065,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector) + /* Attach plane to drm_atomic_state */ + plane_state = drm_atomic_get_plane_state(state, plane); + +- ret = PTR_ERR_OR_ZERO(plane_state); +- if (ret) ++ /* Check for error in getting plane state */ ++ if (IS_ERR(plane_state)) { ++ ret = PTR_ERR(plane_state); + goto out; ++ } + + /* Call commit internally with the state we just constructed */ + ret = drm_atomic_commit(state); +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-gfx10-fix-csib-handling.patch b/queue-5.15/drm-amdgpu-gfx10-fix-csib-handling.patch new file mode 100644 index 0000000000..eca07ec164 --- /dev/null +++ b/queue-5.15/drm-amdgpu-gfx10-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 792fb6e855b04caf1c74a41ef0406d179d36715c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:58:03 -0400 +Subject: drm/amdgpu/gfx10: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit 683308af030cd9b8d3f1de5cbc1ee51788878feb ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 938f13956aeef..d8926d510b3c6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4438,8 +4438,6 @@ static void gfx_v10_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-gfx6-fix-csib-handling.patch b/queue-5.15/drm-amdgpu-gfx6-fix-csib-handling.patch new file mode 100644 index 0000000000..da169a002e --- /dev/null +++ b/queue-5.15/drm-amdgpu-gfx6-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 69a2765ff9e7c469f0dae16181e337b8d3d2326f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:56:02 -0400 +Subject: drm/amdgpu/gfx6: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit 8307ebc15c1ea98a8a0b7837af1faa6c01514577 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +index 6a8dadea40f92..79074d22959b9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +@@ -2897,8 +2897,6 @@ static void gfx_v6_0_get_csb_buffer(struct amdgpu_device *adev, + buffer[count++] = cpu_to_le32(ext->reg_index - 0xa000); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-gfx7-fix-csib-handling.patch b/queue-5.15/drm-amdgpu-gfx7-fix-csib-handling.patch new file mode 100644 index 0000000000..ab734e9ce4 --- /dev/null +++ b/queue-5.15/drm-amdgpu-gfx7-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From c95f86b3d9e3f6a0a8cef3e3e590b1305ce9beda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:19 -0400 +Subject: drm/amdgpu/gfx7: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit be7652c23d833d1ab2c67b16e173b1a4e69d1ae6 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index 37b4a3db63602..b6e5599c8b3cd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -4005,8 +4005,6 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev, + buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-gfx8-fix-csib-handling.patch b/queue-5.15/drm-amdgpu-gfx8-fix-csib-handling.patch new file mode 100644 index 0000000000..ac75e688ce --- /dev/null +++ b/queue-5.15/drm-amdgpu-gfx8-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 4480a7582583aa6c575cd87cb6d373e0dfbd40ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:34 -0400 +Subject: drm/amdgpu/gfx8: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit c8b8d7a4f1c5cdfbd61d75302fb3e3cdefb1a7ab ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index e0302c23e9a7e..4f54b0cf51336 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -1277,8 +1277,6 @@ static void gfx_v8_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-gfx9-fix-csib-handling.patch b/queue-5.15/drm-amdgpu-gfx9-fix-csib-handling.patch new file mode 100644 index 0000000000..c7e13534b7 --- /dev/null +++ b/queue-5.15/drm-amdgpu-gfx9-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From ce2da19e22cb761f8a62bcd5bd34ca86bbb9b96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:49 -0400 +Subject: drm/amdgpu/gfx9: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit a4a4c0ae6742ec7d6bf1548d2c6828de440814a0 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 811cacacc2090..6cc382197378d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -1782,8 +1782,6 @@ static void gfx_v9_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-5.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch b/queue-5.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch new file mode 100644 index 0000000000..56b440491c --- /dev/null +++ b/queue-5.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch @@ -0,0 +1,39 @@ +From 22828c80a9218041f2fa351575c1fe3c942e121e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 15:54:19 -0400 +Subject: drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB + +From: Amber Lin + +[ Upstream commit ab9fcc6362e0699fc1150aa1d8503c40fce2c1e1 ] + +When submitting MQD to CP, set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB bit so +it'll allow SDMA preemption if there is a massive command buffer of +long-running SDMA commands. + +Signed-off-by: Amber Lin +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +index ddaafcd7b8256..d3503072654f3 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -403,6 +403,10 @@ static void update_mqd_sdma(struct mqd_manager *mm, void *mqd, + m->sdma_engine_id = q->sdma_engine_id; + m->sdma_queue_id = q->sdma_queue_id; + m->sdmax_rlcx_dummy_reg = SDMA_RLC_DUMMY_DEFAULT; ++ /* Allow context switch so we don't cross-process starve with a massive ++ * command buffer of long-running SDMA commands ++ */ ++ m->sdmax_rlcx_ib_cntl |= SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK; + + q->is_active = QUEUE_IS_ACTIVE(*q); + } +-- +2.39.5 + diff --git a/queue-5.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch b/queue-5.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch new file mode 100644 index 0000000000..461a99c239 --- /dev/null +++ b/queue-5.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch @@ -0,0 +1,54 @@ +From 0368a1d2661cc680c05ad253533a81a0565c8a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 18:41:02 +0800 +Subject: drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of + calling disable_irq() + +From: Damon Ding + +[ Upstream commit efab13e7d13a641a22c7508cde6e1a5285161944 ] + +The IRQF_NO_AUTOEN can be used for the drivers that don't want +interrupts to be enabled automatically via devm_request_threaded_irq(). +Using this flag can provide be more robust compared to the way of +calling disable_irq() after devm_request_threaded_irq() without the +IRQF_NO_AUTOEN flag. + +Suggested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Signed-off-by: Damon Ding +Link: https://lore.kernel.org/r/20250310104114.2608063-2-damon.ding@rock-chips.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index f0305f833b6c0..8c35bc016dbcc 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1771,10 +1771,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + * that we can get the current state of the GPIO. + */ + dp->irq = gpiod_to_irq(dp->hpd_gpiod); +- irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING; ++ irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN; + } else { + dp->irq = platform_get_irq(pdev, 0); +- irq_flags = 0; ++ irq_flags = IRQF_NO_AUTOEN; + } + + if (dp->irq == -ENXIO) { +@@ -1791,7 +1791,6 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + dev_err(&pdev->dev, "failed to request irq\n"); + goto err_disable_clk; + } +- disable_irq(dp->irq); + + return dp; + +-- +2.39.5 + diff --git a/queue-5.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch b/queue-5.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch new file mode 100644 index 0000000000..744ca47e73 --- /dev/null +++ b/queue-5.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch @@ -0,0 +1,63 @@ +From c98474fa2005fc7bfee2b327212736e670c1bcc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 15:12:45 +0530 +Subject: drm/bridge: anx7625: change the gpiod_set_value API + +From: Ayushi Makhija + +[ Upstream commit 50935044e58e563cdcfd556d62f27bc8744dd64e ] + +Use gpiod_set_value_cansleep() instead of gpiod_set_value() +to fix the below call trace in the boot log: + +[ 5.690534] Call trace: +[ 5.690536] gpiod_set_value+0x40/0xa4 +[ 5.690540] anx7625_runtime_pm_resume+0xa0/0x324 [anx7625] +[ 5.690545] __rpm_callback+0x48/0x1d8 +[ 5.690549] rpm_callback+0x6c/0x78 + +Certain GPIO controllers require access via message-based buses +such as I2C or SPI, which may cause the GPIOs to enter a sleep +state. Therefore, use the gpiod_set_value_cansleep(). + +Signed-off-by: Ayushi Makhija +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250505094245.2660750-7-quic_amakhija@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 01612d2c034af..257f69b5e1783 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -920,10 +920,10 @@ static void anx7625_power_on(struct anx7625_data *ctx) + usleep_range(11000, 12000); + + /* Power on pin enable */ +- gpiod_set_value(ctx->pdata.gpio_p_on, 1); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 1); + usleep_range(10000, 11000); + /* Power reset pin enable */ +- gpiod_set_value(ctx->pdata.gpio_reset, 1); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 1); + usleep_range(10000, 11000); + + DRM_DEV_DEBUG_DRIVER(dev, "power on !\n"); +@@ -943,9 +943,9 @@ static void anx7625_power_standby(struct anx7625_data *ctx) + return; + } + +- gpiod_set_value(ctx->pdata.gpio_reset, 0); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 0); + usleep_range(1000, 1100); +- gpiod_set_value(ctx->pdata.gpio_p_on, 0); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 0); + usleep_range(1000, 1100); + + ret = regulator_bulk_disable(ARRAY_SIZE(ctx->pdata.supplies), +-- +2.39.5 + diff --git a/queue-5.15/drm-msm-a6xx-increase-hfi-response-timeout.patch b/queue-5.15/drm-msm-a6xx-increase-hfi-response-timeout.patch new file mode 100644 index 0000000000..55ca8aa9c7 --- /dev/null +++ b/queue-5.15/drm-msm-a6xx-increase-hfi-response-timeout.patch @@ -0,0 +1,39 @@ +From 15f2b35442f9449996041fed31edd6100985c30d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Apr 2025 20:21:31 +0530 +Subject: drm/msm/a6xx: Increase HFI response timeout + +From: Akhil P Oommen + +[ Upstream commit 5f02f5e78ec9688e29b6857813185b1181796abe ] + +When ACD feature is enabled, it triggers some internal calibrations +which result in a pretty long delay during the first HFI perf vote. +So, increase the HFI response timeout to match the downstream driver. + +Signed-off-by: Akhil P Oommen +Tested-by: Maya Matuszczyk +Tested-by: Anthony Ruhier +Patchwork: https://patchwork.freedesktop.org/patch/649344/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c +index d4c65bf0a1b7f..a40ad74877623 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c +@@ -102,7 +102,7 @@ static int a6xx_hfi_wait_for_ack(struct a6xx_gmu *gmu, u32 id, u32 seqnum, + + /* Wait for a response */ + ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO, val, +- val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 5000); ++ val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 1000000); + + if (ret) { + DRM_DEV_ERROR(gmu->dev, +-- +2.39.5 + diff --git a/queue-5.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch b/queue-5.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch new file mode 100644 index 0000000000..300212d35e --- /dev/null +++ b/queue-5.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch @@ -0,0 +1,39 @@ +From b37d8a391c91941166712b674b43473468782cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Mar 2025 08:24:53 +0200 +Subject: drm/msm/dpu: don't select single flush for active CTL blocks + +From: Dmitry Baryshkov + +[ Upstream commit e93eee524bb78f3ee4b78654d0083382f98b3d23 ] + +In case of ACTIVE CTLs, a single CTL is being used for flushing all INTF +blocks. Don't skip programming the CTL on those targets. + +Tested-by: Neil Armstrong # on SM8550-QRD +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/641585/ +Link: https://lore.kernel.org/r/20250307-dpu-active-ctl-v3-5-5d20655f10ca@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +index 7c58e9ba71b77..7ddb4df885b0f 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +@@ -360,7 +360,8 @@ static void dpu_encoder_phys_vid_underrun_irq(void *arg, int irq_idx) + static bool dpu_encoder_phys_vid_needs_single_flush( + struct dpu_encoder_phys *phys_enc) + { +- return phys_enc->split_role != ENC_ROLE_SOLO; ++ return !(phys_enc->hw_ctl->caps->features & BIT(DPU_CTL_ACTIVE_CFG)) && ++ phys_enc->split_role != ENC_ROLE_SOLO; + } + + static void dpu_encoder_phys_vid_mode_set( +-- +2.39.5 + diff --git a/queue-5.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch b/queue-5.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch new file mode 100644 index 0000000000..9693de2b44 --- /dev/null +++ b/queue-5.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch @@ -0,0 +1,70 @@ +From 6719da31b7c261e95498a675c6d2aff96b07fd3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 03:14:52 +0300 +Subject: drm/msm/hdmi: add runtime PM calls to DDC transfer function + +From: Dmitry Baryshkov + +[ Upstream commit 531b4e2c206e5f7dead04d9da84dfa693ac57481 ] + +We must be sure that the HDMI controller is powered on, while performing +the DDC transfer. Add corresponding runtime PM calls to +msm_hdmi_i2c_xfer(). + +Reviewed-by: Jessica Zhang +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/651727/ +Link: https://lore.kernel.org/r/20250505-fd-hdmi-hpd-v5-8-48541f76318c@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +index de182c0048434..9c78c6c528bea 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +@@ -107,11 +107,15 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + if (num == 0) + return num; + ++ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev); ++ if (ret) ++ return ret; ++ + init_ddc(hdmi_i2c); + + ret = ddc_clear_irq(hdmi_i2c); + if (ret) +- return ret; ++ goto fail; + + for (i = 0; i < num; i++) { + struct i2c_msg *p = &msgs[i]; +@@ -169,7 +173,7 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS), + hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS), + hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL)); +- return ret; ++ goto fail; + } + + ddc_status = hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS); +@@ -202,7 +206,13 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + } + } + ++ pm_runtime_put(&hdmi->pdev->dev); ++ + return i; ++ ++fail: ++ pm_runtime_put(&hdmi->pdev->dev); ++ return ret; + } + + static u32 msm_hdmi_i2c_func(struct i2c_adapter *adapter) +-- +2.39.5 + diff --git a/queue-5.15/emulex-benet-correct-command-version-selection-in-be.patch b/queue-5.15/emulex-benet-correct-command-version-selection-in-be.patch new file mode 100644 index 0000000000..dc98bc7e19 --- /dev/null +++ b/queue-5.15/emulex-benet-correct-command-version-selection-in-be.patch @@ -0,0 +1,39 @@ +From 74bf3bf8155f9d8eb307268670c8d02b63797ed7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 May 2025 07:17:19 -0700 +Subject: emulex/benet: correct command version selection in be_cmd_get_stats() + +From: Alok Tiwari + +[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ] + +Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip, +even if it is BE2. Use 'else if' to prevent multiple assignments, setting +version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others. +Fixes potential incorrect version setting when BE2_chip and +BE3_chip/lancer_chip checks could both be true. + +Signed-off-by: Alok Tiwari +Link: https://patch.msgid.link/20250519141731.691136-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 88f69c486ed09..1cdb7ca019f57 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -1608,7 +1608,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd) + /* version 1 of the cmd is not supported only by BE2 */ + if (BE2_chip(adapter)) + hdr->version = 0; +- if (BE3_chip(adapter) || lancer_chip(adapter)) ++ else if (BE3_chip(adapter) || lancer_chip(adapter)) + hdr->version = 1; + else + hdr->version = 2; +-- +2.39.5 + diff --git a/queue-5.15/exfat-fix-double-free-in-delayed_free.patch b/queue-5.15/exfat-fix-double-free-in-delayed_free.patch new file mode 100644 index 0000000000..e1af349adc --- /dev/null +++ b/queue-5.15/exfat-fix-double-free-in-delayed_free.patch @@ -0,0 +1,40 @@ +From 9e1890c06d2924e4037f0291be6ac8ef51487ecb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 13:50:39 +0900 +Subject: exfat: fix double free in delayed_free + +From: Namjae Jeon + +[ Upstream commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 ] + +The double free could happen in the following path. + +exfat_create_upcase_table() + exfat_create_upcase_table() : return error + exfat_free_upcase_table() : free ->vol_utbl + exfat_load_default_upcase_table : return error + exfat_kill_sb() + delayed_free() + exfat_free_upcase_table() <--------- double free +This patch set ->vol_util as NULL after freeing it. + +Reported-by: Jianzhou Zhao +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/nls.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c +index 314d5407a1be5..a75d5fb2404c7 100644 +--- a/fs/exfat/nls.c ++++ b/fs/exfat/nls.c +@@ -804,4 +804,5 @@ int exfat_create_upcase_table(struct super_block *sb) + void exfat_free_upcase_table(struct exfat_sb_info *sbi) + { + kvfree(sbi->vol_utbl); ++ sbi->vol_utbl = NULL; + } +-- +2.39.5 + diff --git a/queue-5.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch b/queue-5.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch new file mode 100644 index 0000000000..e58a4415d8 --- /dev/null +++ b/queue-5.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch @@ -0,0 +1,108 @@ +From a576315ed497b1e0de3bd85fad5bf752e07f6a50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 16:52:49 +0800 +Subject: ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in + ext4_ext_remove_space() + +From: Zhang Yi + +[ Upstream commit 53ce42accd2002cc490fc86000ac532530507a74 ] + +When removing space, we should use EXT4_EX_NOCACHE because we don't +need to cache extents, and we should also use EXT4_EX_NOFAIL to prevent +metadata inconsistencies that may arise from memory allocation failures. +While ext4_ext_remove_space() already uses these two flags in most +places, they are missing in ext4_ext_search_right() and +read_extent_tree_block() calls. Unify the flags to ensure consistent +behavior throughout the extent removal process. + +Signed-off-by: Zhang Yi +Link: https://patch.msgid.link/20250423085257.122685-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 461a698794d22..e41a6d642472b 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -1531,7 +1531,7 @@ static int ext4_ext_search_left(struct inode *inode, + static int ext4_ext_search_right(struct inode *inode, + struct ext4_ext_path *path, + ext4_lblk_t *logical, ext4_fsblk_t *phys, +- struct ext4_extent *ret_ex) ++ struct ext4_extent *ret_ex, int flags) + { + struct buffer_head *bh = NULL; + struct ext4_extent_header *eh; +@@ -1605,7 +1605,8 @@ static int ext4_ext_search_right(struct inode *inode, + ix++; + while (++depth < path->p_depth) { + /* subtract from p_depth to get proper eh_depth */ +- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); ++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, ++ flags); + if (IS_ERR(bh)) + return PTR_ERR(bh); + eh = ext_block_hdr(bh); +@@ -1613,7 +1614,7 @@ static int ext4_ext_search_right(struct inode *inode, + put_bh(bh); + } + +- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); ++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, flags); + if (IS_ERR(bh)) + return PTR_ERR(bh); + eh = ext_block_hdr(bh); +@@ -2799,6 +2800,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + struct partial_cluster partial; + handle_t *handle; + int i = 0, err = 0; ++ int flags = EXT4_EX_NOCACHE | EXT4_EX_NOFAIL; + + partial.pclu = 0; + partial.lblk = 0; +@@ -2829,8 +2831,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + ext4_fsblk_t pblk; + + /* find extent for or closest extent to this block */ +- path = ext4_find_extent(inode, end, NULL, +- EXT4_EX_NOCACHE | EXT4_EX_NOFAIL); ++ path = ext4_find_extent(inode, end, NULL, flags); + if (IS_ERR(path)) { + ext4_journal_stop(handle); + return PTR_ERR(path); +@@ -2895,7 +2896,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + */ + lblk = ex_end + 1; + err = ext4_ext_search_right(inode, path, &lblk, &pblk, +- NULL); ++ NULL, flags); + if (err < 0) + goto out; + if (pblk) { +@@ -2972,8 +2973,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + i + 1, ext4_idx_pblock(path[i].p_idx)); + memset(path + i + 1, 0, sizeof(*path)); + bh = read_extent_tree_block(inode, path[i].p_idx, +- depth - i - 1, +- EXT4_EX_NOCACHE); ++ depth - i - 1, flags); + if (IS_ERR(bh)) { + /* should we reset i_size? */ + err = PTR_ERR(bh); +@@ -4276,7 +4276,8 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + if (err) + goto out; + ar.lright = map->m_lblk; +- err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright, &ex2); ++ err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright, ++ &ex2, 0); + if (err < 0) + goto out; + +-- +2.39.5 + diff --git a/queue-5.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch b/queue-5.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch new file mode 100644 index 0000000000..5b859b9432 --- /dev/null +++ b/queue-5.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch @@ -0,0 +1,73 @@ +From cd17d121c0232ea8c6111f5c327aa00b4918a1e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 16:52:53 +0800 +Subject: ext4: prevent stale extent cache entries caused by concurrent get + es_cache + +From: Zhang Yi + +[ Upstream commit f22a0ef2231a7d8374bb021eb86404d0e9de5a02 ] + +The EXT4_IOC_GET_ES_CACHE and EXT4_IOC_PRECACHE_EXTENTS currently +invokes ext4_ext_precache() to preload the extent cache without holding +the inode's i_rwsem. This can result in stale extent cache entries when +competing with operations such as ext4_collapse_range() which calls +ext4_ext_remove_space() or ext4_ext_shift_extents(). + +The problem arises when ext4_ext_remove_space() temporarily releases +i_data_sem due to insufficient journal credits. During this interval, a +concurrent EXT4_IOC_GET_ES_CACHE or EXT4_IOC_PRECACHE_EXTENTS may cache +extent entries that are about to be deleted. As a result, these cached +entries become stale and inconsistent with the actual extents. + +Loading the extents cache without holding the inode's i_rwsem or the +mapping's invalidate_lock is not permitted besides during the writeback. +Fix this by holding the i_rwsem during EXT4_IOC_GET_ES_CACHE and +EXT4_IOC_PRECACHE_EXTENTS. + +Signed-off-by: Zhang Yi +Link: https://patch.msgid.link/20250423085257.122685-6-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 2 ++ + fs/ext4/ioctl.c | 8 +++++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index e41a6d642472b..35bc58a26f7f4 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5041,7 +5041,9 @@ int ext4_get_es_cache(struct inode *inode, struct fiemap_extent_info *fieinfo, + } + + if (fieinfo->fi_flags & FIEMAP_FLAG_CACHE) { ++ inode_lock_shared(inode); + error = ext4_ext_precache(inode); ++ inode_unlock_shared(inode); + if (error) + return error; + fieinfo->fi_flags &= ~FIEMAP_FLAG_CACHE; +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 18002b0a908ce..bd90b454c6213 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1130,8 +1130,14 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + return 0; + } + case EXT4_IOC_PRECACHE_EXTENTS: +- return ext4_ext_precache(inode); ++ { ++ int ret; + ++ inode_lock_shared(inode); ++ ret = ext4_ext_precache(inode); ++ inode_unlock_shared(inode); ++ return ret; ++ } + case FS_IOC_SET_ENCRYPTION_POLICY: + if (!ext4_has_feature_encrypt(sb)) + return -EOPNOTSUPP; +-- +2.39.5 + diff --git a/queue-5.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch b/queue-5.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch new file mode 100644 index 0000000000..7339891b32 --- /dev/null +++ b/queue-5.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch @@ -0,0 +1,79 @@ +From 5d0f4ea67e159f472c5bac0bfc6a7310851f076e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 10:33:03 +0800 +Subject: i2c: designware: Invoke runtime suspend on quick slave + re-registration + +From: Tan En De + +[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ] + +Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure +the runtime suspend is invoked immediately when unregistering a slave. +This prevents a race condition where suspend was skipped when +unregistering and registering slave in quick succession. + +For example, consider the rapid sequence of +`delete_device -> new_device -> delete_device -> new_device`. +In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() +might not be invoked after `delete_device` operation. + +This is because after `delete_device` operation, when the +pm_runtime_put() is about to trigger suspend, the following `new_device` +operation might race and cancel the suspend. + +If that happens, during the `new_device` operation, +dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which +means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped. +Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is +skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect +the interrupt mask register using devmem, it will show as zero. + +Example shell script to reproduce the issue: +``` + #!/bin/sh + + SLAVE_LADDR=0x1010 + SLAVE_BUS=13 + NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device + DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device + + # Create initial device + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + sleep 2 + + # Rapid sequence of + # delete_device -> new_device -> delete_device -> new_device + echo $SLAVE_LADDR > $DELETE_DEVICE + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + echo $SLAVE_LADDR > $DELETE_DEVICE + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + + # Using devmem to inspect IC_INTR_MASK will show as zero +``` + +Signed-off-by: Tan En De +Acked-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-slave.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 5b54a9b9ed1a3..09b8ccc040c6e 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -97,7 +97,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) + dev->disable(dev); + synchronize_irq(dev->irq); + dev->slave = NULL; +- pm_runtime_put(dev->dev); ++ pm_runtime_put_sync_suspend(dev->dev); + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/i2c-npcm-add-clock-toggle-recovery.patch b/queue-5.15/i2c-npcm-add-clock-toggle-recovery.patch new file mode 100644 index 0000000000..d6442eec13 --- /dev/null +++ b/queue-5.15/i2c-npcm-add-clock-toggle-recovery.patch @@ -0,0 +1,49 @@ +From ccea92b6967b4ea00d30fcc4462e041d7e9302be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Mar 2025 19:32:50 +0000 +Subject: i2c: npcm: Add clock toggle recovery + +From: Tali Perry + +[ Upstream commit 38010591a0fc3203f1cee45b01ab358b72dd9ab2 ] + +During init of the bus, the module checks that the bus is idle. +If one of the lines are stuck try to recover them first before failing. +Sometimes SDA and SCL are low if improper reset occurs (e.g., reboot). + +Signed-off-by: Tali Perry +Signed-off-by: Mohammed Elbadry +Reviewed-by: Mukesh Kumar Savaliya +Link: https://lore.kernel.org/r/20250328193252.1570811-1-mohammed.0.elbadry@gmail.com +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c +index d97694ac29ca9..3f30c3cff7201 100644 +--- a/drivers/i2c/busses/i2c-npcm7xx.c ++++ b/drivers/i2c/busses/i2c-npcm7xx.c +@@ -1950,10 +1950,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode, + + /* check HW is OK: SDA and SCL should be high at this point. */ + if ((npcm_i2c_get_SDA(&bus->adap) == 0) || (npcm_i2c_get_SCL(&bus->adap) == 0)) { +- dev_err(bus->dev, "I2C%d init fail: lines are low\n", bus->num); +- dev_err(bus->dev, "SDA=%d SCL=%d\n", npcm_i2c_get_SDA(&bus->adap), +- npcm_i2c_get_SCL(&bus->adap)); +- return -ENXIO; ++ dev_warn(bus->dev, " I2C%d SDA=%d SCL=%d, attempting to recover\n", bus->num, ++ npcm_i2c_get_SDA(&bus->adap), npcm_i2c_get_SCL(&bus->adap)); ++ if (npcm_i2c_recovery_tgclk(&bus->adap)) { ++ dev_err(bus->dev, "I2C%d init fail: SDA=%d SCL=%d\n", ++ bus->num, npcm_i2c_get_SDA(&bus->adap), ++ npcm_i2c_get_SCL(&bus->adap)); ++ return -ENXIO; ++ } + } + + npcm_i2c_int_enable(bus, true); +-- +2.39.5 + diff --git a/queue-5.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch b/queue-5.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch new file mode 100644 index 0000000000..bca852b891 --- /dev/null +++ b/queue-5.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch @@ -0,0 +1,48 @@ +From 7650410f5be56cb204d8e4df08ef6d69fab7a87d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 14:16:02 +0900 +Subject: i40e: fix MMIO write access to an invalid page in i40e_clear_hw + +From: Kyungwook Boo + +[ Upstream commit 015bac5daca978448f2671478c553ce1f300c21e ] + +When the device sends a specific input, an integer underflow can occur, leading +to MMIO write access to an invalid page. + +Prevent the integer underflow by changing the type of related variables. + +Signed-off-by: Kyungwook Boo +Link: https://lore.kernel.org/lkml/ffc91764-1142-4ba2-91b6-8c773f6f7095@gmail.com/T/ +Reviewed-by: Przemek Kitszel +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_common.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 99dd8187476ba..fe8e6db53f23b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -1061,10 +1061,11 @@ int i40e_pf_reset(struct i40e_hw *hw) + void i40e_clear_hw(struct i40e_hw *hw) + { + u32 num_queues, base_queue; +- u32 num_pf_int; +- u32 num_vf_int; ++ s32 num_pf_int; ++ s32 num_vf_int; + u32 num_vfs; +- u32 i, j; ++ s32 i; ++ u32 j; + u32 val; + u32 eol = 0x7ff; + +-- +2.39.5 + diff --git a/queue-5.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch b/queue-5.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch new file mode 100644 index 0000000000..d8f11dac72 --- /dev/null +++ b/queue-5.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch @@ -0,0 +1,43 @@ +From d9138ad956087377936b8494e57898eab8b7807c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 20:10:48 -0700 +Subject: iommu/amd: Ensure GA log notifier callbacks finish running before + module unload + +From: Sean Christopherson + +[ Upstream commit 94c721ea03c7078163f41dbaa101ac721ddac329 ] + +Synchronize RCU when unregistering KVM's GA log notifier to ensure all +in-flight interrupt handlers complete before KVM-the module is unloaded. + +Signed-off-by: Sean Christopherson +Link: https://lore.kernel.org/r/20250315031048.2374109-1-seanjc@google.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 7d38cc5c04e68..714c78bf69db0 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -679,6 +679,14 @@ int amd_iommu_register_ga_log_notifier(int (*notifier)(u32)) + { + iommu_ga_log_notifier = notifier; + ++ /* ++ * Ensure all in-flight IRQ handlers run to completion before returning ++ * to the caller, e.g. to ensure module code isn't unloaded while it's ++ * being executed in the IRQ handler. ++ */ ++ if (!notifier) ++ synchronize_rcu(); ++ + return 0; + } + EXPORT_SYMBOL(amd_iommu_register_ga_log_notifier); +-- +2.39.5 + diff --git a/queue-5.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch b/queue-5.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch new file mode 100644 index 0000000000..0aa2132025 --- /dev/null +++ b/queue-5.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch @@ -0,0 +1,44 @@ +From e461fb22e49106a70945cb76070bf4976aefea42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 11:27:24 +0200 +Subject: ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ] + +The statistics are incremented with raw_cpu_inc() assuming it always +happens with bottom half disabled. Without per-CPU locking in +local_bh_disable() on PREEMPT_RT this is no longer true. + +Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about +preemption. + +Cc: David Ahern +Signed-off-by: Sebastian Andrzej Siewior +Link: https://patch.msgid.link/20250512092736.229935-4-bigeasy@linutronix.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index a4884d434038e..cbc584c386e9e 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -200,7 +200,11 @@ const __u8 ip_tos2prio[16] = { + EXPORT_SYMBOL(ip_tos2prio); + + static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat); ++#ifndef CONFIG_PREEMPT_RT + #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field) ++#else ++#define RT_CACHE_STAT_INC(field) this_cpu_inc(rt_cache_stat.field) ++#endif + + #ifdef CONFIG_PROC_FS + static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos) +-- +2.39.5 + diff --git a/queue-5.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch b/queue-5.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch new file mode 100644 index 0000000000..7c1867be4d --- /dev/null +++ b/queue-5.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch @@ -0,0 +1,85 @@ +From 2afcb553311d44713e662a780c95ab92e1aa99b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 20:59:16 +0530 +Subject: jfs: fix array-index-out-of-bounds read in add_missing_indices + +From: Aditya Dutt + +[ Upstream commit 5dff41a86377563f7a2b968aae00d25b4ceb37c9 ] + +stbl is s8 but it must contain offsets into slot which can go from 0 to +127. + +Added a bound check for that error and return -EIO if the check fails. +Also make jfs_readdir return with error if add_missing_indices returns +with an error. + +Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b +Signed-off-by: Aditya Dutt +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dtree.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index 417d1c2fc2911..27ca98614b0bb 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -2909,7 +2909,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot) + * fsck.jfs should really fix this, but it currently does not. + * Called from jfs_readdir when bad index is detected. + */ +-static void add_missing_indices(struct inode *inode, s64 bn) ++static int add_missing_indices(struct inode *inode, s64 bn) + { + struct ldtentry *d; + struct dt_lock *dtlck; +@@ -2918,7 +2918,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) + struct lv *lv; + struct metapage *mp; + dtpage_t *p; +- int rc; ++ int rc = 0; + s8 *stbl; + tid_t tid; + struct tlock *tlck; +@@ -2943,6 +2943,16 @@ static void add_missing_indices(struct inode *inode, s64 bn) + + stbl = DT_GETSTBL(p); + for (i = 0; i < p->header.nextindex; i++) { ++ if (stbl[i] < 0) { ++ jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld", ++ i, stbl[i], (long)inode->i_ino, (long long)bn); ++ rc = -EIO; ++ ++ DT_PUTPAGE(mp); ++ txAbort(tid, 0); ++ goto end; ++ } ++ + d = (struct ldtentry *) &p->slot[stbl[i]]; + index = le32_to_cpu(d->index); + if ((index < 2) || (index >= JFS_IP(inode)->next_index)) { +@@ -2960,6 +2970,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) + (void) txCommit(tid, 1, &inode, 0); + end: + txEnd(tid); ++ return rc; + } + + /* +@@ -3313,7 +3324,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) + } + + if (fix_page) { +- add_missing_indices(ip, bn); ++ if ((rc = add_missing_indices(ip, bn))) ++ goto out; + page_fixed = 1; + } + +-- +2.39.5 + diff --git a/queue-5.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch b/queue-5.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch new file mode 100644 index 0000000000..de96d146e7 --- /dev/null +++ b/queue-5.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch @@ -0,0 +1,119 @@ +From d990199c39eabd75de3a7c1c97a66905317aa48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 16:02:00 +0800 +Subject: jfs: Fix null-ptr-deref in jfs_ioc_trim + +From: Dylan Wolff + +[ Upstream commit a4685408ff6c3e2af366ad9a7274f45ff3f394ee ] + +[ Syzkaller Report ] + +Oops: general protection fault, probably for non-canonical address +0xdffffc0000000087: 0000 [#1 +KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] +CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted +6.13.0-rc6-gfbfd64d25c7a-dirty #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Sched_ext: serialise (enabled+all), task: runnable_at=-30ms +RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 +Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 +90 82 fe ff 4c 89 ff 31 f6 +RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 +RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a +RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 +RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 +R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 +FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +? __die_body+0x61/0xb0 +? die_addr+0xb1/0xe0 +? exc_general_protection+0x333/0x510 +? asm_exc_general_protection+0x26/0x30 +? jfs_ioc_trim+0x34b/0x8f0 +jfs_ioctl+0x3c8/0x4f0 +? __pfx_jfs_ioctl+0x10/0x10 +? __pfx_jfs_ioctl+0x10/0x10 +__se_sys_ioctl+0x269/0x350 +? __pfx___se_sys_ioctl+0x10/0x10 +? do_syscall_64+0xfb/0x210 +do_syscall_64+0xee/0x210 +? syscall_exit_to_user_mode+0x1e0/0x330 +entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7fe51f4903ad +Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 +89 f7 48 89 d6 48 89 ca 4d +RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad +RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640 +R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000 + +Modules linked in: +---[ end trace 0000000000000000 ]--- +RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 +Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 +90 82 fe ff 4c 89 ff 31 f6 +RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 +RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a +RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 +RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 +R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 +FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Kernel panic - not syncing: Fatal exception + +[ Analysis ] + +We believe that we have found a concurrency bug in the `fs/jfs` module +that results in a null pointer dereference. There is a closely related +issue which has been fixed: + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 + +... but, unfortunately, the accepted patch appears to still be +susceptible to a null pointer dereference under some interleavings. + +To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set +to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This +bug manifests quite rarely under normal circumstances, but is +triggereable from a syz-program. + +Reported-and-tested-by: Dylan J. Wolff +Reported-and-tested-by: Jiacheng Xu +Signed-off-by: Dylan J. Wolff +Signed-off-by: Jiacheng Xu +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_discard.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c +index 5f4b305030ad5..4b660296caf39 100644 +--- a/fs/jfs/jfs_discard.c ++++ b/fs/jfs/jfs_discard.c +@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) + down_read(&sb->s_umount); + bmp = JFS_SBI(ip->i_sb)->bmap; + +- if (minlen > bmp->db_agsize || ++ if (bmp == NULL || ++ minlen > bmp->db_agsize || + start >= bmp->db_mapsize || + range->len < sb->s_blocksize) { + up_read(&sb->s_umount); +-- +2.39.5 + diff --git a/queue-5.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch b/queue-5.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch new file mode 100644 index 0000000000..2136bd18b3 --- /dev/null +++ b/queue-5.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch @@ -0,0 +1,71 @@ +From 868cfa6356fe779a38736bbb6790c78030135662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 17:10:42 +0100 +Subject: libbpf: Add identical pointer detection to btf_dedup_is_equiv() + +From: Alan Maguire + +[ Upstream commit 8e64c387c942229c551d0f23de4d9993d3a2acb6 ] + +Recently as a side-effect of + +commit ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro") + +issues were observed in deduplication between modules and kernel BTF +such that a large number of kernel types were not deduplicated so +were found in module BTF (task_struct, bpf_prog etc). The root cause +appeared to be a failure to dedup struct types, specifically those +with members that were pointers with __percpu annotations. + +The issue in dedup is at the point that we are deduplicating structures, +we have not yet deduplicated reference types like pointers. If multiple +copies of a pointer point at the same (deduplicated) integer as in this +case, we do not see them as identical. Special handling already exists +to deal with structures and arrays, so add pointer handling here too. + +Reported-by: Alexei Starovoitov +Signed-off-by: Alan Maguire +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index fd23095129782..4d29bd28520ae 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -3770,6 +3770,19 @@ static bool btf_dedup_identical_structs(struct btf_dedup *d, __u32 id1, __u32 id + return true; + } + ++static bool btf_dedup_identical_ptrs(struct btf_dedup *d, __u32 id1, __u32 id2) ++{ ++ struct btf_type *t1, *t2; ++ ++ t1 = btf_type_by_id(d->btf, id1); ++ t2 = btf_type_by_id(d->btf, id2); ++ ++ if (!btf_is_ptr(t1) || !btf_is_ptr(t2)) ++ return false; ++ ++ return t1->type == t2->type; ++} ++ + /* + * Check equivalence of BTF type graph formed by candidate struct/union (we'll + * call it "candidate graph" in this description for brevity) to a type graph +@@ -3902,6 +3915,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id, + */ + if (btf_dedup_identical_structs(d, hypot_type_id, cand_id)) + return 1; ++ /* A similar case is again observed for PTRs. */ ++ if (btf_dedup_identical_ptrs(d, hypot_type_id, cand_id)) ++ return 1; + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/media-ccs-pll-better-validate-vt-pll-branch.patch b/queue-5.15/media-ccs-pll-better-validate-vt-pll-branch.patch new file mode 100644 index 0000000000..9e7e2912da --- /dev/null +++ b/queue-5.15/media-ccs-pll-better-validate-vt-pll-branch.patch @@ -0,0 +1,67 @@ +From 77e7df348ac7e012656e6855ba8164d03528628e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 14:27:58 +0200 +Subject: media: ccs-pll: Better validate VT PLL branch + +From: Sakari Ailus + +[ Upstream commit cd9cb0313a42ae029cd5af9293b0add984ed252e ] + +Check that the VT PLL dividers are actually found, don't trust they always +are even though they should be. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ccs-pll.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/ccs-pll.c b/drivers/media/i2c/ccs-pll.c +index c876ea851ed7c..fe9e3a90749de 100644 +--- a/drivers/media/i2c/ccs-pll.c ++++ b/drivers/media/i2c/ccs-pll.c +@@ -442,7 +442,7 @@ static int ccs_pll_calculate_vt_tree(struct device *dev, + return -EINVAL; + } + +-static void ++static int + ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + const struct ccs_pll_branch_limits_bk *op_lim_bk, + struct ccs_pll *pll, struct ccs_pll_branch_fr *pll_fr, +@@ -565,6 +565,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + if (best_pix_div < SHRT_MAX >> 1) + break; + } ++ if (best_pix_div == SHRT_MAX >> 1) ++ return -EINVAL; + + pll->vt_bk.sys_clk_div = DIV_ROUND_UP(vt_div, best_pix_div); + pll->vt_bk.pix_clk_div = best_pix_div; +@@ -577,6 +579,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + out_calc_pixel_rate: + pll->pixel_rate_pixel_array = + pll->vt_bk.pix_clk_freq_hz * pll->vt_lanes; ++ ++ return 0; + } + + /* +@@ -852,8 +856,10 @@ int ccs_pll_calculate(struct device *dev, const struct ccs_pll_limits *lim, + if (pll->flags & CCS_PLL_FLAG_DUAL_PLL) + break; + +- ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr, +- op_pll_bk, cphy, phy_const); ++ rval = ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr, ++ op_pll_bk, cphy, phy_const); ++ if (rval) ++ continue; + + rval = check_bk_bounds(dev, lim, pll, PLL_VT); + if (rval) +-- +2.39.5 + diff --git a/queue-5.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch b/queue-5.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch new file mode 100644 index 0000000000..8d787d9fc1 --- /dev/null +++ b/queue-5.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch @@ -0,0 +1,55 @@ +From 84d442ee7cdce5c2b0f50825cf49074a7b2143b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 11:13:29 +0530 +Subject: media: i2c: imx334: Enable runtime PM before sub-device registration + +From: Tarang Raval + +[ Upstream commit 01dfdf6a80c57151af0589af0db7adbbdd1361c7 ] + +Runtime PM is fully initialized before calling +v4l2_async_register_subdev_sensor(). Moving the runtime PM initialization +earlier prevents potential access to an uninitialized or powered-down +device. + +Signed-off-by: Tarang Raval +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index 062125501788a..57b7416bbfab3 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -1058,6 +1058,9 @@ static int imx334_probe(struct i2c_client *client) + goto error_handler_free; + } + ++ pm_runtime_set_active(imx334->dev); ++ pm_runtime_enable(imx334->dev); ++ + ret = v4l2_async_register_subdev_sensor(&imx334->sd); + if (ret < 0) { + dev_err(imx334->dev, +@@ -1065,13 +1068,13 @@ static int imx334_probe(struct i2c_client *client) + goto error_media_entity; + } + +- pm_runtime_set_active(imx334->dev); +- pm_runtime_enable(imx334->dev); + pm_runtime_idle(imx334->dev); + + return 0; + + error_media_entity: ++ pm_runtime_disable(imx334->dev); ++ pm_runtime_set_suspended(imx334->dev); + media_entity_cleanup(&imx334->sd.entity); + error_handler_free: + v4l2_ctrl_handler_free(imx334->sd.ctrl_handler); +-- +2.39.5 + diff --git a/queue-5.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch b/queue-5.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch new file mode 100644 index 0000000000..75672b78fc --- /dev/null +++ b/queue-5.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch @@ -0,0 +1,46 @@ +From 5006da10235254b9876d42ffcfc5fd0d04d31139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 11:13:28 +0530 +Subject: media: i2c: imx334: Fix runtime PM handling in remove function + +From: Tarang Raval + +[ Upstream commit b493cd3c03641f9bbaa9787e43ca92163cb50051 ] + +pm_runtime_suspended() only checks the current runtime PM status and does +not modify it, making it ineffective in this context. This could result in +improper power management if the device remains active when removed. + +This patch fixes the issue by introducing a check with +pm_runtime_status_suspended() to determine if the device is already +suspended. If it is not, it calls imx334_power_off() to power down the +device and then uses pm_runtime_set_suspended() to correctly update the +runtime PM status to suspended. + +Signed-off-by: Tarang Raval +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index 57b7416bbfab3..af09aafeddf78 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -1102,7 +1102,10 @@ static int imx334_remove(struct i2c_client *client) + v4l2_ctrl_handler_free(sd->ctrl_handler); + + pm_runtime_disable(&client->dev); +- pm_runtime_suspended(&client->dev); ++ if (!pm_runtime_status_suspended(&client->dev)) { ++ imx334_power_off(&client->dev); ++ pm_runtime_set_suspended(&client->dev); ++ } + + mutex_destroy(&imx334->mutex); + +-- +2.39.5 + diff --git a/queue-5.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch b/queue-5.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch new file mode 100644 index 0000000000..a48c2c1a53 --- /dev/null +++ b/queue-5.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch @@ -0,0 +1,42 @@ +From 6faa6b1e10f26a32c691e4982a3824130f3c244a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 10:44:41 +0530 +Subject: media: i2c: imx334: update mode_3840x2160_regs array + +From: Shravan Chippa + +[ Upstream commit 35132d039c566b0e9d8e53f76f512b22607c2405 ] + +The 3840x2160 mode operates with the imx334 reset values. +If we switch to other modes and then return to the 3840x2160 mode, +it should function correctly. so updated the mode_3840x2160_regs +array with the imx334 reset values. + +Signed-off-by: Shravan Chippa +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index af09aafeddf78..88ce5ec9c1822 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -168,6 +168,12 @@ static const struct imx334_reg mode_3840x2160_regs[] = { + {0x302c, 0x3c}, + {0x302e, 0x00}, + {0x302f, 0x0f}, ++ {0x3074, 0xb0}, ++ {0x3075, 0x00}, ++ {0x308e, 0xb1}, ++ {0x308f, 0x00}, ++ {0x30d8, 0x20}, ++ {0x30d9, 0x12}, + {0x3076, 0x70}, + {0x3077, 0x08}, + {0x3090, 0x70}, +-- +2.39.5 + diff --git a/queue-5.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch b/queue-5.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch new file mode 100644 index 0000000000..f6d6c62e42 --- /dev/null +++ b/queue-5.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch @@ -0,0 +1,39 @@ +From 15eb3d63976814b9ef39bca823761e049d345310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 10:13:45 +0800 +Subject: media: platform: exynos4-is: Add hardware sync wait to + fimc_is_hw_change_mode() + +From: Wentao Liang + +[ Upstream commit bd9f6ce7d512fa21249415c16af801a4ed5d97b6 ] + +In fimc_is_hw_change_mode(), the function changes camera modes without +waiting for hardware completion, risking corrupted data or system hangs +if subsequent operations proceed before the hardware is ready. + +Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring +hardware state synchronization and stable interrupt handling. + +Signed-off-by: Wentao Liang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/exynos4-is/fimc-is-regs.c b/drivers/media/platform/exynos4-is/fimc-is-regs.c +index 366e6393817d2..5f9c44e825a5f 100644 +--- a/drivers/media/platform/exynos4-is/fimc-is-regs.c ++++ b/drivers/media/platform/exynos4-is/fimc-is-regs.c +@@ -164,6 +164,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is) + if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd))) + return -EINVAL; + ++ fimc_is_hw_wait_intmsr0_intmsd0(is); + mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0)); + mcuctl_write(is->sensor_index, is, MCUCTL_REG_ISSR(1)); + mcuctl_write(is->setfile.sub_index, is, MCUCTL_REG_ISSR(2)); +-- +2.39.5 + diff --git a/queue-5.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch b/queue-5.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch new file mode 100644 index 0000000000..03e85b4485 --- /dev/null +++ b/queue-5.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch @@ -0,0 +1,59 @@ +From 39c853c50c077335977ee2c823081880aa697c55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 15:55:48 -0400 +Subject: media: rkvdec: Initialize the m2m context before the controls + +From: Nicolas Dufresne + +[ Upstream commit d43d7db3c8a1868dcbc6cb8de90a3cdf309d6cbb ] + +Setting up the control handler calls into .s_ctrl ops. While validating +the controls the ops may need to access some of the context state, which +could lead to a crash if not properly initialized. + +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index 9c85370fd81bc..41b93f09e6df0 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -794,24 +794,24 @@ static int rkvdec_open(struct file *filp) + rkvdec_reset_decoded_fmt(ctx); + v4l2_fh_init(&ctx->fh, video_devdata(filp)); + +- ret = rkvdec_init_ctrls(ctx); +- if (ret) +- goto err_free_ctx; +- + ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(rkvdec->m2m_dev, ctx, + rkvdec_queue_init); + if (IS_ERR(ctx->fh.m2m_ctx)) { + ret = PTR_ERR(ctx->fh.m2m_ctx); +- goto err_cleanup_ctrls; ++ goto err_free_ctx; + } + ++ ret = rkvdec_init_ctrls(ctx); ++ if (ret) ++ goto err_cleanup_m2m_ctx; ++ + filp->private_data = &ctx->fh; + v4l2_fh_add(&ctx->fh); + + return 0; + +-err_cleanup_ctrls: +- v4l2_ctrl_handler_free(&ctx->ctrl_hdl); ++err_cleanup_m2m_ctx: ++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + + err_free_ctx: + kfree(ctx); +-- +2.39.5 + diff --git a/queue-5.15/media-tc358743-ignore-video-while-hpd-is-low.patch b/queue-5.15/media-tc358743-ignore-video-while-hpd-is-low.patch new file mode 100644 index 0000000000..4bd9acf0bc --- /dev/null +++ b/queue-5.15/media-tc358743-ignore-video-while-hpd-is-low.patch @@ -0,0 +1,43 @@ +From 1935f6f105524cb775f5d34e564bef5ab31559c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 11:54:17 +0200 +Subject: media: tc358743: ignore video while HPD is low + +From: Hans Verkuil + +[ Upstream commit 6829c5b5d26b1be31880d74ec24cb32d2d75f1ae ] + +If the HPD is low (happens if there is no EDID or the +EDID is being updated), then return -ENOLINK in +tc358743_get_detected_timings() instead of detecting video. + +This avoids userspace thinking that it can start streaming when +the HPD is low. + +Signed-off-by: Hans Verkuil +Tested-by: Maxime Ripard +Link: https://lore.kernel.org/linux-media/20240628-stoic-bettong-of-fortitude-e25611@houat/ +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 6f5ca3d63dbdb..87feada1f6020 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -309,6 +309,10 @@ static int tc358743_get_detected_timings(struct v4l2_subdev *sd, + + memset(timings, 0, sizeof(struct v4l2_dv_timings)); + ++ /* if HPD is low, ignore any video */ ++ if (!(i2c_rd8(sd, HPD_CTL) & MASK_HPD_OUT0)) ++ return -ENOLINK; ++ + if (no_signal(sd)) { + v4l2_dbg(1, debug, sd, "%s: no valid signal\n", __func__); + return -ENOLINK; +-- +2.39.5 + diff --git a/queue-5.15/media-ti-cal-fix-wrong-goto-on-error-path.patch b/queue-5.15/media-ti-cal-fix-wrong-goto-on-error-path.patch new file mode 100644 index 0000000000..a4c4837a97 --- /dev/null +++ b/queue-5.15/media-ti-cal-fix-wrong-goto-on-error-path.patch @@ -0,0 +1,47 @@ +From aa87c25c24a0d234c810732cad80ae8a790fd860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 13:34:02 +0200 +Subject: media: ti: cal: Fix wrong goto on error path + +From: Tomi Valkeinen + +[ Upstream commit a5b18fd769b7dc2e77a9e6a390844cbf50626ae8 ] + +If pm_runtime_resume_and_get() fails, we should unprepare the context, +but currently we skip that as we goto to a later line. + +Reviewed-by: Kieran Bingham +Signed-off-by: Tomi Valkeinen +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/cal-video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/ti-vpe/cal-video.c b/drivers/media/platform/ti-vpe/cal-video.c +index d87177d04e921..2e93c1b8f3597 100644 +--- a/drivers/media/platform/ti-vpe/cal-video.c ++++ b/drivers/media/platform/ti-vpe/cal-video.c +@@ -744,7 +744,7 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count) + + ret = pm_runtime_resume_and_get(ctx->cal->dev); + if (ret < 0) +- goto error_pipeline; ++ goto error_unprepare; + + cal_ctx_set_dma_addr(ctx, addr); + cal_ctx_start(ctx); +@@ -761,8 +761,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count) + error_stop: + cal_ctx_stop(ctx); + pm_runtime_put_sync(ctx->cal->dev); ++error_unprepare: + cal_ctx_unprepare(ctx); +- + error_pipeline: + media_pipeline_stop(&ctx->vdev.entity); + error_release_buffers: +-- +2.39.5 + diff --git a/queue-5.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch b/queue-5.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch new file mode 100644 index 0000000000..5c04f759e1 --- /dev/null +++ b/queue-5.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch @@ -0,0 +1,57 @@ +From 4810866108fc230cfe71f50b47354c111db0a466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 15:10:32 +0900 +Subject: media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition + +From: Nas Chung + +[ Upstream commit ad2698efce37e910dcf3c3914263e6cb3e86f8cd ] + +Explicitly compare a buffer type only with valid buffer types, +to avoid matching a buffer type outside of the valid buffer type set. + +Signed-off-by: Nas Chung +Reviewed-by: Michael Tretter +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index 4e305496edf27..96802f9b0955d 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -153,10 +153,18 @@ enum v4l2_buf_type { + V4L2_BUF_TYPE_SDR_OUTPUT = 12, + V4L2_BUF_TYPE_META_CAPTURE = 13, + V4L2_BUF_TYPE_META_OUTPUT = 14, ++ /* ++ * Note: V4L2_TYPE_IS_VALID and V4L2_TYPE_IS_OUTPUT must ++ * be updated if a new type is added. ++ */ + /* Deprecated, do not use */ + V4L2_BUF_TYPE_PRIVATE = 0x80, + }; + ++#define V4L2_TYPE_IS_VALID(type) \ ++ ((type) >= V4L2_BUF_TYPE_VIDEO_CAPTURE &&\ ++ (type) <= V4L2_BUF_TYPE_META_OUTPUT) ++ + #define V4L2_TYPE_IS_MULTIPLANAR(type) \ + ((type) == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) +@@ -170,7 +178,8 @@ enum v4l2_buf_type { + || (type) == V4L2_BUF_TYPE_SDR_OUTPUT \ + || (type) == V4L2_BUF_TYPE_META_OUTPUT) + +-#define V4L2_TYPE_IS_CAPTURE(type) (!V4L2_TYPE_IS_OUTPUT(type)) ++#define V4L2_TYPE_IS_CAPTURE(type) \ ++ (V4L2_TYPE_IS_VALID(type) && !V4L2_TYPE_IS_OUTPUT(type)) + + enum v4l2_tuner_type { + V4L2_TUNER_RADIO = 1, +-- +2.39.5 + diff --git a/queue-5.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch b/queue-5.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch new file mode 100644 index 0000000000..3c4d36ed06 --- /dev/null +++ b/queue-5.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch @@ -0,0 +1,35 @@ +From c61ece18b2c25e9f43478886145dde79b75d8a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 15:10:34 +0900 +Subject: media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition + +From: Nas Chung + +[ Upstream commit f81f69a0e3da141bdd73a16b8676f4e542533d87 ] + +V4L2_TYPE_IS_OUTPUT() returns true for V4L2_BUF_TYPE_VIDEO_OVERLAY +which definitely belongs to CAPTURE. + +Signed-off-by: Nas Chung +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index f5c6758464f25..4e305496edf27 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -164,7 +164,6 @@ enum v4l2_buf_type { + #define V4L2_TYPE_IS_OUTPUT(type) \ + ((type) == V4L2_BUF_TYPE_VIDEO_OUTPUT \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE \ +- || (type) == V4L2_BUF_TYPE_VIDEO_OVERLAY \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY \ + || (type) == V4L2_BUF_TYPE_VBI_OUTPUT \ + || (type) == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT \ +-- +2.39.5 + diff --git a/queue-5.15/net-atlantic-generate-software-timestamp-just-before.patch b/queue-5.15/net-atlantic-generate-software-timestamp-just-before.patch new file mode 100644 index 0000000000..83ec37ca50 --- /dev/null +++ b/queue-5.15/net-atlantic-generate-software-timestamp-just-before.patch @@ -0,0 +1,49 @@ +From 0d6ec3605ed8cff9b637a54e1da482aa238b5970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 21:48:10 +0800 +Subject: net: atlantic: generate software timestamp just before the doorbell + +From: Jason Xing + +[ Upstream commit 285ad7477559b6b5ceed10ba7ecfed9d17c0e7c6 ] + +Make sure the call of skb_tx_timestamp is as close as possible to the +doorbell. + +Signed-off-by: Jason Xing +Link: https://patch.msgid.link/20250510134812.48199-2-kerneljasonxing@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 - + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 ++ + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index 45ed097bfe49a..026e628664a9d 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -117,7 +117,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd + } + #endif + +- skb_tx_timestamp(skb); + return aq_nic_xmit(aq_nic, skb); + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 25349a2ae5cfe..2afa61e9bf8c6 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -751,6 +751,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) + + frags = aq_nic_map_skb(self, skb, ring); + ++ skb_tx_timestamp(skb); ++ + if (likely(frags)) { + err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw, + ring, frags); +-- +2.39.5 + diff --git a/queue-5.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch b/queue-5.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch new file mode 100644 index 0000000000..a9d0813834 --- /dev/null +++ b/queue-5.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch @@ -0,0 +1,173 @@ +From be3f616778ee9fcb74d6b87d5c323f62da997ed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 15:43:12 +0200 +Subject: net: bridge: mcast: re-implement br_multicast_{enable, disable}_port + functions + +From: Yong Wang + +[ Upstream commit 4b30ae9adb047dd0a7982975ec3933c529537026 ] + +When a bridge port STP state is changed from BLOCKING/DISABLED to +FORWARDING, the port's igmp query timer will NOT re-arm itself if the +bridge has been configured as per-VLAN multicast snooping. + +Solve this by choosing the correct multicast context(s) to enable/disable +port multicast based on whether per-VLAN multicast snooping is enabled or +not, i.e. using per-{port, VLAN} context in case of per-VLAN multicast +snooping by re-implementing br_multicast_enable_port() and +br_multicast_disable_port() functions. + +Before the patch, the IGMP query does not happen in the last step of the +following test sequence, i.e. no growth for tx counter: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # bridge link set dev swp1 state 0 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge link set dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + +After the patch, the IGMP query happens in the last step of the test: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # bridge link set dev swp1 state 0 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge link set dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +3 + +Signed-off-by: Yong Wang +Reviewed-by: Andy Roulin +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_multicast.c | 77 +++++++++++++++++++++++++++++++++++---- + 1 file changed, 69 insertions(+), 8 deletions(-) + +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 3cd2b648408d6..085c9e706bc47 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1931,12 +1931,17 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) + } + } + +-void br_multicast_enable_port(struct net_bridge_port *port) ++static void br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) + { +- struct net_bridge *br = port->br; ++ struct net_bridge *br = pmctx->port->br; + + spin_lock_bh(&br->multicast_lock); +- __br_multicast_enable_port_ctx(&port->multicast_ctx); ++ if (br_multicast_port_ctx_is_vlan(pmctx) && ++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { ++ spin_unlock_bh(&br->multicast_lock); ++ return; ++ } ++ __br_multicast_enable_port_ctx(pmctx); + spin_unlock_bh(&br->multicast_lock); + } + +@@ -1963,11 +1968,67 @@ static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) + br_multicast_rport_del_notify(pmctx, del); + } + ++static void br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) ++{ ++ struct net_bridge *br = pmctx->port->br; ++ ++ spin_lock_bh(&br->multicast_lock); ++ if (br_multicast_port_ctx_is_vlan(pmctx) && ++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { ++ spin_unlock_bh(&br->multicast_lock); ++ return; ++ } ++ ++ __br_multicast_disable_port_ctx(pmctx); ++ spin_unlock_bh(&br->multicast_lock); ++} ++ ++static void br_multicast_toggle_port(struct net_bridge_port *port, bool on) ++{ ++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING) ++ if (br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) { ++ struct net_bridge_vlan_group *vg; ++ struct net_bridge_vlan *vlan; ++ ++ rcu_read_lock(); ++ vg = nbp_vlan_group_rcu(port); ++ if (!vg) { ++ rcu_read_unlock(); ++ return; ++ } ++ ++ /* iterate each vlan, toggle vlan multicast context */ ++ list_for_each_entry_rcu(vlan, &vg->vlan_list, vlist) { ++ struct net_bridge_mcast_port *pmctx = ++ &vlan->port_mcast_ctx; ++ u8 state = br_vlan_get_state(vlan); ++ /* enable vlan multicast context when state is ++ * LEARNING or FORWARDING ++ */ ++ if (on && br_vlan_state_allowed(state, true)) ++ br_multicast_enable_port_ctx(pmctx); ++ else ++ br_multicast_disable_port_ctx(pmctx); ++ } ++ rcu_read_unlock(); ++ return; ++ } ++#endif ++ /* toggle port multicast context when vlan snooping is disabled */ ++ if (on) ++ br_multicast_enable_port_ctx(&port->multicast_ctx); ++ else ++ br_multicast_disable_port_ctx(&port->multicast_ctx); ++} ++ ++void br_multicast_enable_port(struct net_bridge_port *port) ++{ ++ br_multicast_toggle_port(port, true); ++} ++ + void br_multicast_disable_port(struct net_bridge_port *port) + { +- spin_lock_bh(&port->br->multicast_lock); +- __br_multicast_disable_port_ctx(&port->multicast_ctx); +- spin_unlock_bh(&port->br->multicast_lock); ++ br_multicast_toggle_port(port, false); + } + + static int __grp_src_delete_marked(struct net_bridge_port_group *pg) +@@ -4130,9 +4191,9 @@ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on, + __br_multicast_open(&br->multicast_ctx); + list_for_each_entry(p, &br->port_list, list) { + if (on) +- br_multicast_disable_port(p); ++ br_multicast_disable_port_ctx(&p->multicast_ctx); + else +- br_multicast_enable_port(p); ++ br_multicast_enable_port_ctx(&p->multicast_ctx); + } + + list_for_each_entry(vlan, &vg->vlan_list, vlist) +-- +2.39.5 + diff --git a/queue-5.15/net-dlink-add-synchronization-for-stats-update.patch b/queue-5.15/net-dlink-add-synchronization-for-stats-update.patch new file mode 100644 index 0000000000..e4e654914c --- /dev/null +++ b/queue-5.15/net-dlink-add-synchronization-for-stats-update.patch @@ -0,0 +1,102 @@ +From c2cb5ecd479b7b5162851a0431a4bc697066d1f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 16:53:31 +0900 +Subject: net: dlink: add synchronization for stats update + +From: Moon Yeounsu + +[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ] + +This patch synchronizes code that accesses from both user-space +and IRQ contexts. The `get_stats()` function can be called from both +context. + +`dev->stats.tx_errors` and `dev->stats.collisions` are also updated +in the `tx_errors()` function. Therefore, these fields must also be +protected by synchronized. + +There is no code that accessses `dev->stats.tx_errors` between the +previous and updated lines, so the updating point can be moved. + +Signed-off-by: Moon Yeounsu +Link: https://patch.msgid.link/20250515075333.48290-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++- + drivers/net/ethernet/dlink/dl2k.h | 2 ++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index af0b6fa296e56..09a275eb44487 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) + np->ioaddr = ioaddr; + np->chip_id = chip_idx; + np->pdev = pdev; ++ ++ spin_lock_init(&np->stats_lock); + spin_lock_init (&np->tx_lock); + spin_lock_init (&np->rx_lock); + +@@ -869,7 +871,6 @@ tx_error (struct net_device *dev, int tx_status) + frame_id = (tx_status & 0xffff0000); + printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n", + dev->name, tx_status, frame_id); +- dev->stats.tx_errors++; + /* Ttransmit Underrun */ + if (tx_status & 0x10) { + dev->stats.tx_fifo_errors++; +@@ -906,9 +907,15 @@ tx_error (struct net_device *dev, int tx_status) + rio_set_led_mode(dev); + /* Let TxStartThresh stay default value */ + } ++ ++ spin_lock(&np->stats_lock); + /* Maximum Collisions */ + if (tx_status & 0x08) + dev->stats.collisions++; ++ ++ dev->stats.tx_errors++; ++ spin_unlock(&np->stats_lock); ++ + /* Restart the Tx */ + dw32(MACCtrl, dr16(MACCtrl) | TxEnable); + } +@@ -1077,7 +1084,9 @@ get_stats (struct net_device *dev) + int i; + #endif + unsigned int stat_reg; ++ unsigned long flags; + ++ spin_lock_irqsave(&np->stats_lock, flags); + /* All statistics registers need to be acknowledged, + else statistic overflow could cause problems */ + +@@ -1127,6 +1136,9 @@ get_stats (struct net_device *dev) + dr16(TCPCheckSumErrors); + dr16(UDPCheckSumErrors); + dr16(IPCheckSumErrors); ++ ++ spin_unlock_irqrestore(&np->stats_lock, flags); ++ + return &dev->stats; + } + +diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h +index 0e33e2eaae960..56aff2f0bdbfa 100644 +--- a/drivers/net/ethernet/dlink/dl2k.h ++++ b/drivers/net/ethernet/dlink/dl2k.h +@@ -372,6 +372,8 @@ struct netdev_private { + struct pci_dev *pdev; + void __iomem *ioaddr; + void __iomem *eeprom_addr; ++ // To ensure synchronization when stats are updated. ++ spinlock_t stats_lock; + spinlock_t tx_lock; + spinlock_t rx_lock; + unsigned int rx_buf_sz; /* Based on MTU+slack. */ +-- +2.39.5 + diff --git a/queue-5.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch b/queue-5.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch new file mode 100644 index 0000000000..e429611e21 --- /dev/null +++ b/queue-5.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch @@ -0,0 +1,42 @@ +From 0fd63d77aedbbd945e5c81160822b635a8463734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 May 2025 21:20:31 -0600 +Subject: net: macb: Check return value of dma_set_mask_and_coherent() + +From: Sergio Perez Gonzalez + +[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ] + +Issue flagged by coverity. Add a safety check for the return value +of dma_set_mask_and_coherent, go to a safe exit if it returns error. + +Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754 +Signed-off-by: Sergio Perez Gonzalez +Reviewed-by: Claudiu Beznea +Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 667af80a739b9..2266a3ecc5533 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -4809,7 +4809,11 @@ static int macb_probe(struct platform_device *pdev) + + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT + if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) { +- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); ++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); ++ if (err) { ++ dev_err(&pdev->dev, "failed to set DMA mask\n"); ++ goto err_out_free_netdev; ++ } + bp->hw_dma_cap |= HW_DMA_CAP_64B; + } + #endif +-- +2.39.5 + diff --git a/queue-5.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch b/queue-5.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch new file mode 100644 index 0000000000..6fb20f6fda --- /dev/null +++ b/queue-5.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch @@ -0,0 +1,37 @@ +From 878a02704c925fc1e5c7d40a22c7770cc6faad41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 17:34:42 +0800 +Subject: net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info + +From: Jason Xing + +[ Upstream commit b86bcfee30576b752302c55693fff97242b35dfd ] + +As mlx4 has implemented skb_tx_timestamp() in mlx4_en_xmit(), the +SOFTWARE flag is surely needed when users are trying to get timestamp +information. + +Signed-off-by: Jason Xing +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250510093442.79711-1-kerneljasonxing@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index c3cffb32fb067..d8c1a52d54c67 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1909,6 +1909,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev, + if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) { + info->so_timestamping |= + SOF_TIMESTAMPING_TX_HARDWARE | ++ SOF_TIMESTAMPING_TX_SOFTWARE | + SOF_TIMESTAMPING_RX_HARDWARE | + SOF_TIMESTAMPING_RAW_HARDWARE; + +-- +2.39.5 + diff --git a/queue-5.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch b/queue-5.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch new file mode 100644 index 0000000000..0eaf1c8695 --- /dev/null +++ b/queue-5.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch @@ -0,0 +1,85 @@ +From 9373962426137353a4737cb1b83ff58ef1ac9f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 14:54:22 +0100 +Subject: nios2: force update_mmu_cache on spurious tlb-permission--related + pagefaults + +From: Simon Schuster + +[ Upstream commit 2d8a3179ea035f9341b6a73e5ba4029fc67e983d ] + +NIOS2 uses a software-managed TLB for virtual address translation. To +flush a cache line, the original mapping is replaced by one to physical +address 0x0 with no permissions (rwx mapped to 0) set. This can lead to +TLB-permission--related traps when such a nominally flushed entry is +encountered as a mapping for an otherwise valid virtual address within a +process (e.g. due to an MMU-PID-namespace rollover that previously +flushed the complete TLB including entries of existing, running +processes). + +The default ptep_set_access_flags implementation from mm/pgtable-generic.c +only forces a TLB-update when the page-table entry has changed within the +page table: + + /* + * [...] We return whether the PTE actually changed, which in turn + * instructs the caller to do things like update__mmu_cache. [...] + */ + int ptep_set_access_flags(struct vm_area_struct *vma, + unsigned long address, pte_t *ptep, + pte_t entry, int dirty) + { + int changed = !pte_same(*ptep, entry); + if (changed) { + set_pte_at(vma->vm_mm, address, ptep, entry); + flush_tlb_fix_spurious_fault(vma, address); + } + return changed; + } + +However, no cross-referencing with the TLB-state occurs, so the +flushing-induced pseudo entries that are responsible for the pagefault +in the first place are never pre-empted from TLB on this code path. + +This commit fixes this behaviour by always requesting a TLB-update in +this part of the pagefault handling, fixing spurious page-faults on the +way. The handling is a straightforward port of the logic from the MIPS +architecture via an arch-specific ptep_set_access_flags function ported +from arch/mips/include/asm/pgtable.h. + +Signed-off-by: Simon Schuster +Signed-off-by: Andreas Oetken +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/nios2/include/asm/pgtable.h | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/nios2/include/asm/pgtable.h b/arch/nios2/include/asm/pgtable.h +index 4a995fa628eef..58208325462cd 100644 +--- a/arch/nios2/include/asm/pgtable.h ++++ b/arch/nios2/include/asm/pgtable.h +@@ -275,4 +275,20 @@ extern void __init mmu_init(void); + extern void update_mmu_cache(struct vm_area_struct *vma, + unsigned long address, pte_t *pte); + ++static inline int pte_same(pte_t pte_a, pte_t pte_b); ++ ++#define __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS ++static inline int ptep_set_access_flags(struct vm_area_struct *vma, ++ unsigned long address, pte_t *ptep, ++ pte_t entry, int dirty) ++{ ++ if (!pte_same(*ptep, entry)) ++ set_ptes(vma->vm_mm, address, ptep, entry, 1); ++ /* ++ * update_mmu_cache will unconditionally execute, handling both ++ * the case that the PTE changed and the spurious fault case. ++ */ ++ return true; ++} ++ + #endif /* _ASM_NIOS2_PGTABLE_H */ +-- +2.39.5 + diff --git a/queue-5.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch b/queue-5.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch new file mode 100644 index 0000000000..68c223403c --- /dev/null +++ b/queue-5.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch @@ -0,0 +1,47 @@ +From 1a76e67f6414767c26d4f7ae91155faa5212848c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 11:26:02 +0800 +Subject: octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() + +From: Wentao Liang + +[ Upstream commit 9c056ec6dd1654b1420dafbbe2a69718850e6ff2 ] + +The cn10k_free_matchall_ipolicer() calls the cn10k_map_unmap_rq_policer() +for each queue in a for loop without checking for any errors. + +Check the return value of the cn10k_map_unmap_rq_policer() function during +each loop, and report a warning if the function fails. + +Signed-off-by: Wentao Liang +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250408032602.2909-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +index 942ec8f394559..59fef7b50ebb6 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +@@ -351,9 +351,12 @@ int cn10k_free_matchall_ipolicer(struct otx2_nic *pfvf) + mutex_lock(&pfvf->mbox.lock); + + /* Remove RQ's policer mapping */ +- for (qidx = 0; qidx < hw->rx_queues; qidx++) +- cn10k_map_unmap_rq_policer(pfvf, qidx, +- hw->matchall_ipolicer, false); ++ for (qidx = 0; qidx < hw->rx_queues; qidx++) { ++ rc = cn10k_map_unmap_rq_policer(pfvf, qidx, hw->matchall_ipolicer, false); ++ if (rc) ++ dev_warn(pfvf->dev, "Failed to unmap RQ %d's policer (error %d).", ++ qidx, rc); ++ } + + rc = cn10k_free_leaf_profile(pfvf, hw->matchall_ipolicer); + +-- +2.39.5 + diff --git a/queue-5.15/openvswitch-stricter-validation-for-the-userspace-ac.patch b/queue-5.15/openvswitch-stricter-validation-for-the-userspace-ac.patch new file mode 100644 index 0000000000..e4d0b641dd --- /dev/null +++ b/queue-5.15/openvswitch-stricter-validation-for-the-userspace-ac.patch @@ -0,0 +1,45 @@ +From 264f2f3d01dbe23a4aea695c646b3538f280722b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 10:08:24 +0200 +Subject: openvswitch: Stricter validation for the userspace action + +From: Eelco Chaudron + +[ Upstream commit 88906f55954131ed2d3974e044b7fb48129b86ae ] + +This change enhances the robustness of validate_userspace() by ensuring +that all Netlink attributes are fully contained within the parent +attribute. The previous use of nla_parse_nested_deprecated() could +silently skip trailing or malformed attributes, as it stops parsing at +the first invalid entry. + +By switching to nla_parse_deprecated_strict(), we make sure only fully +validated attributes are copied for later use. + +Signed-off-by: Eelco Chaudron +Reviewed-by: Simon Horman +Acked-by: Ilya Maximets +Link: https://patch.msgid.link/67eb414e2d250e8408bb8afeb982deca2ff2b10b.1747037304.git.echaudro@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/flow_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 7db0f8938c145..8e7238a4f5339 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -3004,7 +3004,8 @@ static int validate_userspace(const struct nlattr *attr) + struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1]; + int error; + +- error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr, ++ error = nla_parse_deprecated_strict(a, OVS_USERSPACE_ATTR_MAX, ++ nla_data(attr), nla_len(attr), + userspace_policy, NULL); + if (error) + return error; +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch new file mode 100644 index 0000000000..818a7bba49 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch @@ -0,0 +1,41 @@ +From 5bfd5bf71a79c95344e9d570c4b9bd932ec484fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:38 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_pmx_set_by_name() + +From: Gabor Juhos + +[ Upstream commit 4229c28323db141eda69cb99427be75d3edba071 ] + +The regmap_update_bits() function can fail, so propagate its error +up to the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-7-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 7ed7b6484d704..e95d30ef5711b 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -354,9 +354,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev, + + val = grp->val[func]; + +- regmap_update_bits(info->regmap, reg, mask, val); +- +- return 0; ++ return regmap_update_bits(info->regmap, reg, mask, val); + } + + static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev, +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009 b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009 new file mode 100644 index 0000000000..ab5b1db4fe --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009 @@ -0,0 +1,45 @@ +From f7fc6a31a48f9c90ab2a0beea3faa381e3792691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:37 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_gpio_get_direction() + +From: Gabor Juhos + +[ Upstream commit 6481c0a83367b0672951ccc876fbae7ee37b594b ] + +The regmap_read() function can fail, so propagate its error up to +the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-6-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index e95d30ef5711b..3a9a3a1d5d4be 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -396,10 +396,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip, + struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); + unsigned int reg = OUTPUT_EN; + unsigned int val, mask; ++ int ret; + + armada_37xx_update_reg(®, &offset); + mask = BIT(offset); +- regmap_read(info->regmap, reg, &val); ++ ret = regmap_read(info->regmap, reg, &val); ++ if (ret) ++ return ret; + + if (val & mask) + return GPIO_LINE_DIRECTION_OUT; +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690 b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690 new file mode 100644 index 0000000000..55277fe2f8 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690 @@ -0,0 +1,52 @@ +From cf9f23eed49cb24bc1b2b228279b90403f2c5caa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:36 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_pmx_gpio_set_direction() + +From: Gabor Juhos + +[ Upstream commit bfa0ff804ffa8b1246ade8be08de98c9eb19d16f ] + +The armada_37xx_gpio_direction_{in,out}put() functions can fail, so +propagate their error values back to the stack instead of silently +ignoring those. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-5-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 3a9a3a1d5d4be..9c8ed5a03a825 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -468,16 +468,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev, + { + struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev); + struct gpio_chip *chip = range->gc; ++ int ret; + + dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n", + offset, range->name, offset, input ? "input" : "output"); + + if (input) +- armada_37xx_gpio_direction_input(chip, offset); ++ ret = armada_37xx_gpio_direction_input(chip, offset); + else +- armada_37xx_gpio_direction_output(chip, offset, 0); ++ ret = armada_37xx_gpio_direction_output(chip, offset, 0); + +- return 0; ++ return ret; + } + + static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev, +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264 b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264 new file mode 100644 index 0000000000..b56cca87c1 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264 @@ -0,0 +1,45 @@ +From 7b544ef2661475950058df200d97ec80b10c66b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:35 +0200 +Subject: pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() + +From: Gabor Juhos + +[ Upstream commit 57273ff8bb16f3842c2597b5bbcd49e7fa12edf7 ] + +The regmap_read() function can fail, so propagate its error up to +the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-4-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 9c8ed5a03a825..e0dbac0c9227a 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -439,11 +439,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset) + struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); + unsigned int reg = INPUT_VAL; + unsigned int val, mask; ++ int ret; + + armada_37xx_update_reg(®, &offset); + mask = BIT(offset); + +- regmap_read(info->regmap, reg, &val); ++ ret = regmap_read(info->regmap, reg, &val); ++ if (ret) ++ return ret; + + return (val & mask) != 0; + } +-- +2.39.5 + diff --git a/queue-5.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch b/queue-5.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch new file mode 100644 index 0000000000..3c253de6cb --- /dev/null +++ b/queue-5.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch @@ -0,0 +1,47 @@ +From 72d510e24433deb8b390148c02200f6117174485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 16:17:45 +0100 +Subject: pinctrl: mcp23s08: Reset all pins to input at probe + +From: Mike Looijmans + +[ Upstream commit 3ede3f8b4b4b399b0ca41e44959f80d5cf84fc98 ] + +At startup, the driver just assumes that all registers have their +default values. But after a soft reset, the chip will just be in the +state it was, and some pins may have been configured as outputs. Any +modification of the output register will cause these pins to be driven +low, which leads to unexpected/unwanted effects. To prevent this from +happening, set the chip's IO configuration register to a known safe +mode (all inputs) before toggling any other bits. + +Signed-off-by: Mike Looijmans +Link: https://lore.kernel.org/20250314151803.28903-1-mike.looijmans@topic.nl +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 852354f6681b4..a743d9c6e1c77 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -567,6 +567,14 @@ int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, + + mcp->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + ++ /* ++ * Reset the chip - we don't really know what state it's in, so reset ++ * all pins to input first to prevent surprises. ++ */ ++ ret = mcp_write(mcp, MCP_IODIR, mcp->chip.ngpio == 16 ? 0xFFFF : 0xFF); ++ if (ret < 0) ++ return ret; ++ + /* verify MCP_IOCON.SEQOP = 0, so sequential reads work, + * and MCP_IOCON.HAEN = 1, so we work with all chips. + */ +-- +2.39.5 + diff --git a/queue-5.15/platform-x86-dell_rbu-fix-list-usage.patch b/queue-5.15/platform-x86-dell_rbu-fix-list-usage.patch new file mode 100644 index 0000000000..67df8f87d1 --- /dev/null +++ b/queue-5.15/platform-x86-dell_rbu-fix-list-usage.patch @@ -0,0 +1,54 @@ +From d99a77de0c8b67937609e105a9e199fc25fc6748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 13:46:56 -0500 +Subject: platform/x86: dell_rbu: Fix list usage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stuart Hayes + +[ Upstream commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 ] + +Pass the correct list head to list_for_each_entry*() when looping through +the packet list. + +Without this patch, reading the packet data via sysfs will show the data +incorrectly (because it starts at the wrong packet), and clearing the +packet list will result in a NULL pointer dereference. + +Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()") +Signed-off-by: Stuart Hayes +Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell_rbu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c +index e9f4b30dcafab..25a01c728c072 100644 +--- a/drivers/platform/x86/dell/dell_rbu.c ++++ b/drivers/platform/x86/dell/dell_rbu.c +@@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length) + remaining_bytes = *pread_length; + bytes_read = rbu_data.packet_read_count; + +- list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) { ++ list_for_each_entry(newpacket, &packet_data_head.list, list) { + bytes_copied = do_packet_read(pdest, newpacket, + remaining_bytes, bytes_read, &temp_count); + remaining_bytes -= bytes_copied; +@@ -315,7 +315,7 @@ static void packet_empty_list(void) + { + struct packet_data *newpacket, *tmp; + +- list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) { ++ list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) { + list_del(&newpacket->list); + + /* +-- +2.39.5 + diff --git a/queue-5.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch b/queue-5.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch new file mode 100644 index 0000000000..75c83f5b47 --- /dev/null +++ b/queue-5.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch @@ -0,0 +1,55 @@ +From 73a9e5b536d2177f8803c8fdac3f396925585574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 13:46:58 -0500 +Subject: platform/x86: dell_rbu: Stop overwriting data buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stuart Hayes + +[ Upstream commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 ] + +The dell_rbu driver will use memset() to clear the data held by each +packet when it is no longer needed (when the driver is unloaded, the +packet size is changed, etc). + +The amount of memory that is cleared (before this patch) is the normal +packet size. However, the last packet in the list may be smaller. + +Fix this to only clear the memory actually used by each packet, to prevent +it from writing past the end of data buffer. + +Because the packet data buffers are allocated with __get_free_pages() (in +page-sized increments), this bug could only result in a buffer being +overwritten when a packet size larger than one page is used. The only user +of the dell_rbu module should be the Dell BIOS update program, which uses +a packet size of 4096, so no issues should be seen without the patch, it +just blocks the possiblity. + +Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver") +Signed-off-by: Stuart Hayes +Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell_rbu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c +index 25a01c728c072..9fc5d3e9e7934 100644 +--- a/drivers/platform/x86/dell/dell_rbu.c ++++ b/drivers/platform/x86/dell/dell_rbu.c +@@ -322,7 +322,7 @@ static void packet_empty_list(void) + * zero out the RBU packet memory before freeing + * to make sure there are no stale RBU packets left in memory + */ +- memset(newpacket->data, 0, rbu_data.packetsize); ++ memset(newpacket->data, 0, newpacket->length); + set_memory_wb((unsigned long)newpacket->data, + 1 << newpacket->ordernum); + free_pages((unsigned long) newpacket->data, +-- +2.39.5 + diff --git a/queue-5.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch b/queue-5.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch new file mode 100644 index 0000000000..ec683dd3a2 --- /dev/null +++ b/queue-5.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch @@ -0,0 +1,61 @@ +From e5a4c5e83c7989830cb4054bf0b8d2e351d5917e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 12:11:25 +0530 +Subject: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() + +From: Charan Teja Kalla + +[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ] + +pm_runtime_put_autosuspend() schedules a hrtimer to expire +at "dev->power.timer_expires". If the hrtimer's callback, +pm_suspend_timer_fn(), observes that the current time equals +"dev->power.timer_expires", it unexpectedly bails out instead of +proceeding with runtime suspend. + +pm_suspend_timer_fn(): + + if (expires > 0 && expires < ktime_get_mono_fast_ns()) { + dev->power.timer_expires = 0; + rpm_suspend(..) + } + +Additionally, as ->timer_expires is not cleared, all the future auto +suspend requests will not schedule hrtimer to perform auto suspend. + +rpm_suspend(): + + if ((rpmflags & RPM_AUTO) &&...) { + if (!(dev->power.timer_expires && ...) { <-- this will fail. + hrtimer_start_range_ns(&dev->power.suspend_timer,...); + } + } + +Fix this by as well checking if current time reaches the set expiration. + +Co-developed-by: Patrick Daly +Signed-off-by: Patrick Daly +Signed-off-by: Charan Teja Kalla +Link: https://patch.msgid.link/20250515064125.1211561-1-quic_charante@quicinc.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index edee7f1af1cec..35e1a090ef901 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -996,7 +996,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer) + * If 'expires' is after the current time, we've been called + * too early. + */ +- if (expires > 0 && expires < ktime_get_mono_fast_ns()) { ++ if (expires > 0 && expires <= ktime_get_mono_fast_ns()) { + dev->power.timer_expires = 0; + rpm_suspend(dev, dev->power.timer_autosuspends ? + (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC); +-- +2.39.5 + diff --git a/queue-5.15/pmdomain-ti-fix-standby-handling-of-per-power-domain.patch b/queue-5.15/pmdomain-ti-fix-standby-handling-of-per-power-domain.patch new file mode 100644 index 0000000000..079cb56ae0 --- /dev/null +++ b/queue-5.15/pmdomain-ti-fix-standby-handling-of-per-power-domain.patch @@ -0,0 +1,60 @@ +From 598b69d9c16ccc4448eecd2af0fa9a50d50e4469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 16:00:40 -0700 +Subject: pmdomain: ti: Fix STANDBY handling of PER power domain + +From: Sukrut Bellary + +[ Upstream commit 36795548dcc841c73f03793ed6cf741a88130922 ] + +Per AM335x TRM[1](section 8.1.4.3 Power mode), in case of STANDBY, +PER domain should be ON. So, fix the PER power domain handling on standby. + +[1] https://www.ti.com/lit/ug/spruh73q/spruh73q.pdf + +Signed-off-by: Sukrut Bellary +Reviewed-by: Kevin Hilman +Tested-by: Judith Mendez +Link: https://lore.kernel.org/r/20250318230042.3138542-3-sbellary@baylibre.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/omap_prm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c +index 1248d5d56c8d4..544e57fff96ca 100644 +--- a/drivers/soc/ti/omap_prm.c ++++ b/drivers/soc/ti/omap_prm.c +@@ -19,7 +19,9 @@ + #include + #include + #include +- ++#if IS_ENABLED(CONFIG_SUSPEND) ++#include ++#endif + #include + + enum omap_prm_domain_mode { +@@ -89,6 +91,7 @@ struct omap_reset_data { + #define OMAP_PRM_HAS_RSTST BIT(1) + #define OMAP_PRM_HAS_NO_CLKDM BIT(2) + #define OMAP_PRM_RET_WHEN_IDLE BIT(3) ++#define OMAP_PRM_ON_WHEN_STANDBY BIT(4) + + #define OMAP_PRM_HAS_RESETS (OMAP_PRM_HAS_RSTCTRL | OMAP_PRM_HAS_RSTST) + +@@ -405,7 +408,8 @@ static const struct omap_prm_data am3_prm_data[] = { + .name = "per", .base = 0x44e00c00, + .pwrstctrl = 0xc, .pwrstst = 0x8, .dmap = &omap_prm_noinact, + .rstctrl = 0x0, .rstmap = am3_per_rst_map, +- .flags = OMAP_PRM_HAS_RSTCTRL, .clkdm_name = "pruss_ocp" ++ .flags = OMAP_PRM_HAS_RSTCTRL | OMAP_PRM_ON_WHEN_STANDBY, ++ .clkdm_name = "pruss_ocp", + }, + { + .name = "wkup", .base = 0x44e00d00, +-- +2.39.5 + diff --git a/queue-5.15/power-supply-bq27xxx-retrieve-again-when-busy.patch b/queue-5.15/power-supply-bq27xxx-retrieve-again-when-busy.patch new file mode 100644 index 0000000000..34ce131e37 --- /dev/null +++ b/queue-5.15/power-supply-bq27xxx-retrieve-again-when-busy.patch @@ -0,0 +1,90 @@ +From 31ed7b286f0b64b05b83416099636c98d3071143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 11:40:47 +0800 +Subject: power: supply: bq27xxx: Retrieve again when busy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jerry Lv + +[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ] + +Multiple applications may access the battery gauge at the same time, so +the gauge may be busy and EBUSY will be returned. The driver will set a +flag to record the EBUSY state, and this flag will be kept until the next +periodic update. When this flag is set, bq27xxx_battery_get_property() +will just return ENODEV until the flag is updated. + +Even if the gauge was busy during the last accessing attempt, returning +ENODEV is not ideal, and can cause confusion in the applications layer. + +Instead, retry accessing the I2C to update the flag is as expected, for +the gauge typically recovers from busy state within a few milliseconds. +If still failed to access the gauge, the real error code would be returned +instead of ENODEV (as suggested by Pali Rohár). + +Reviewed-by: Pali Rohár +Signed-off-by: Jerry Lv +Link: https://lore.kernel.org/r/20250415-foo-fix-v2-1-5b45a395e4cc@axis.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq27xxx_battery.c | 2 +- + drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index b86674df7b3b2..3fb1c912f86a0 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -2044,7 +2044,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, + mutex_unlock(&di->lock); + + if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0) +- return -ENODEV; ++ return di->cache.flags; + + switch (psp) { + case POWER_SUPPLY_PROP_STATUS: +diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c +index 4e5d773b3bf8d..4d64275ecdfc6 100644 +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -6,6 +6,7 @@ + * Andrew F. Davis + */ + ++#include + #include + #include + #include +@@ -32,6 +33,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, + struct i2c_msg msg[2]; + u8 data[2]; + int ret; ++ int retry = 0; + + if (!client->adapter) + return -ENODEV; +@@ -48,7 +50,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, + else + msg[1].len = 2; + +- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); ++ do { ++ ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); ++ if (ret == -EBUSY && ++retry < 3) { ++ /* sleep 10 milliseconds when busy */ ++ usleep_range(10000, 11000); ++ continue; ++ } ++ break; ++ } while (1); ++ + if (ret < 0) + return ret; + +-- +2.39.5 + diff --git a/queue-5.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch b/queue-5.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch new file mode 100644 index 0000000000..97cdc38f8d --- /dev/null +++ b/queue-5.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch @@ -0,0 +1,67 @@ +From 6a11b01a54ca74aaa4628c0b10f1767b1bd456dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 02:29:28 -0400 +Subject: powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH + recovery + +From: Narayana Murty N + +[ Upstream commit 33bc69cf6655cf60829a803a45275f11a74899e5 ] + +VFIO EEH recovery for PCI passthrough devices fails on PowerNV and pseries +platforms due to missing host-side PE bridge reconfiguration. In the +current implementation, eeh_pe_configure() only performs RTAS or OPAL-based +bridge reconfiguration for native host devices, but skips it entirely for +PEs managed through VFIO in guest passthrough scenarios. + +This leads to incomplete EEH recovery when a PCI error affects a +passthrough device assigned to a QEMU/KVM guest. Although VFIO triggers the +EEH recovery flow through VFIO_EEH_PE_ENABLE ioctl, the platform-specific +bridge reconfiguration step is silently bypassed. As a result, the PE's +config space is not fully restored, causing subsequent config space access +failures or EEH freeze-on-access errors inside the guest. + +This patch fixes the issue by ensuring that eeh_pe_configure() always +invokes the platform's configure_bridge() callback (e.g., +pseries_eeh_phb_configure_bridge) even for VFIO-managed PEs. This ensures +that RTAS or OPAL calls to reconfigure the PE bridge are correctly issued +on the host side, restoring the PE's configuration space after an EEH +event. + +This fix is essential for reliable EEH recovery in QEMU/KVM guests using +VFIO PCI passthrough on PowerNV and pseries systems. + +Tested with: +- QEMU/KVM guest using VFIO passthrough (IBM Power9,(lpar)Power11 host) +- Injected EEH errors with pseries EEH errinjct tool on host, recovery + verified on qemu guest. +- Verified successful config space access and CAP_EXP DevCtl restoration + after recovery + +Fixes: 212d16cdca2d ("powerpc/eeh: EEH support for VFIO PCI device") +Signed-off-by: Narayana Murty N +Reviewed-by: Vaibhav Jain +Reviewed-by: Ganesh Goudar +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250508062928.146043-1-nnmlinux@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index e9b597ed423cf..209d1a61eb94f 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -1504,6 +1504,8 @@ int eeh_pe_configure(struct eeh_pe *pe) + /* Invalid PE ? */ + if (!pe) + return -ENODEV; ++ else ++ ret = eeh_ops->configure_bridge(pe); + + return ret; + } +-- +2.39.5 + diff --git a/queue-5.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch b/queue-5.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch new file mode 100644 index 0000000000..406e7d0f9b --- /dev/null +++ b/queue-5.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch @@ -0,0 +1,112 @@ +From 795057d6465d99874138527fd0ff330669456716 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 11:06:34 +0200 +Subject: Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect + devices first" + +From: Alexander Sverdlin + +[ Upstream commit 36305857b1ead8f6ca033a913162ebc09bee0b43 ] + +This reverts commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6. + +It breaks target-module@2b300050 ("ti,sysc-omap2") probe on AM62x in a case +when minimally-configured system tries to network-boot: + +[ 6.888776] probe of 2b300050.target-module returned 517 after 258 usecs +[ 17.129637] probe of 2b300050.target-module returned 517 after 708 usecs +[ 17.137397] platform 2b300050.target-module: deferred probe pending: (reason unknown) +[ 26.878471] Waiting up to 100 more seconds for network. + +There are minimal configurations possible when the deferred device is not +being probed any more (because everything else has been successfully +probed) and deferral lists are not processed any more. + +Stable mmc enumeration can be achieved by filling /aliases node properly +(4700a00755fb commit's rationale). + +After revert: + +[ 9.006816] IP-Config: Complete: +[ 9.010058] device=lan0, ... + +Tested-by: Andreas Kemnade # GTA04, Panda, BT200 +Reviewed-by: Tony Lindgren +Signed-off-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/20250401090643.2776793-1-alexander.sverdlin@siemens.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 49 ------------------------------------------- + 1 file changed, 49 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 05ae577758539..20e0907234855 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -687,51 +687,6 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata) + return 0; + } + +-/* Interconnect instances to probe before l4_per instances */ +-static struct resource early_bus_ranges[] = { +- /* am3/4 l4_wkup */ +- { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, }, +- /* omap4/5 and dra7 l4_cfg */ +- { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, }, +- /* omap4 l4_wkup */ +- { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, }, +- /* omap5 and dra7 l4_wkup without dra7 dcan segment */ +- { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, }, +-}; +- +-static atomic_t sysc_defer = ATOMIC_INIT(10); +- +-/** +- * sysc_defer_non_critical - defer non_critical interconnect probing +- * @ddata: device driver data +- * +- * We want to probe l4_cfg and l4_wkup interconnect instances before any +- * l4_per instances as l4_per instances depend on resources on l4_cfg and +- * l4_wkup interconnects. +- */ +-static int sysc_defer_non_critical(struct sysc *ddata) +-{ +- struct resource *res; +- int i; +- +- if (!atomic_read(&sysc_defer)) +- return 0; +- +- for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) { +- res = &early_bus_ranges[i]; +- if (ddata->module_pa >= res->start && +- ddata->module_pa <= res->end) { +- atomic_set(&sysc_defer, 0); +- +- return 0; +- } +- } +- +- atomic_dec_if_positive(&sysc_defer); +- +- return -EPROBE_DEFER; +-} +- + static struct device_node *stdout_path; + + static void sysc_init_stdout_path(struct sysc *ddata) +@@ -957,10 +912,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata) + if (error) + return error; + +- error = sysc_defer_non_critical(ddata); +- if (error) +- return error; +- + sysc_check_children(ddata); + + if (!of_get_property(np, "reg", NULL)) +-- +2.39.5 + diff --git a/queue-5.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch b/queue-5.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch new file mode 100644 index 0000000000..0fa3fcb801 --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch @@ -0,0 +1,40 @@ +From 580505b404e25a78d31f76ce03d884830aac13ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 12:47:59 -0700 +Subject: scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 + commands + +From: Justin Tee + +[ Upstream commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126 ] + +In lpfc_check_sli_ndlp(), the get_job_els_rsp64_did remote_id assignment +does not apply for GEN_REQUEST64 commands as it only has meaning for a +ELS_REQUEST64 command. So, if (iocb->ndlp == ndlp) is false, we could +erroneously return the wrong value. Fix by replacing the fallthrough +statement with a break statement before the remote_id check. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20250425194806.3585-2-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index d04669ae878bd..413b7adca0211 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -5086,7 +5086,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba, + case CMD_GEN_REQUEST64_CR: + if (iocb->context_un.ndlp == ndlp) + return 1; +- fallthrough; ++ break; + case CMD_ELS_REQUEST64_CR: + if (icmd->un.elsreq64.remoteID == ndlp->nlp_DID) + return 1; +-- +2.39.5 + diff --git a/queue-5.15/scsi-lpfc-use-memcpy-for-bios-version.patch b/queue-5.15/scsi-lpfc-use-memcpy-for-bios-version.patch new file mode 100644 index 0000000000..a1bc16a6f1 --- /dev/null +++ b/queue-5.15/scsi-lpfc-use-memcpy-for-bios-version.patch @@ -0,0 +1,47 @@ +From 2363ce1be5083aea324578e7b89b4d12573c321a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 13:34:22 +0200 +Subject: scsi: lpfc: Use memcpy() for BIOS version + +From: Daniel Wagner + +[ Upstream commit ae82eaf4aeea060bb736c3e20c0568b67c701d7d ] + +The strlcat() with FORTIFY support is triggering a panic because it +thinks the target buffer will overflow although the correct target +buffer size is passed in. + +Anyway, instead of memset() with 0 followed by a strlcat(), just use +memcpy() and ensure that the resulting buffer is NULL terminated. + +BIOSVersion is only used for the lpfc_printf_log() which expects a +properly terminated string. + +Signed-off-by: Daniel Wagner +Link: https://lore.kernel.org/r/20250409-fix-lpfc-bios-str-v1-1-05dac9e51e13@kernel.org +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 68b015bb6d157..fb139e1e35ca3 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -5926,9 +5926,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba) + phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr); + phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr); + +- memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion)); +- strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str, ++ memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str, + sizeof(phba->BIOSVersion)); ++ phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0'; + + lpfc_printf_log(phba, KERN_INFO, LOG_SLI, + "3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, " +-- +2.39.5 + diff --git a/queue-5.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch b/queue-5.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch new file mode 100644 index 0000000000..c6487f7476 --- /dev/null +++ b/queue-5.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch @@ -0,0 +1,42 @@ +From 7d89b65784300ee25cb0c09ddcffe5e0777f4bc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 10:17:28 +0200 +Subject: sctp: Do not wake readers in __sctp_write_space() + +From: Petr Malat + +[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ] + +Function __sctp_write_space() doesn't set poll key, which leads to +ep_poll_callback() waking up all waiters, not only these waiting +for the socket being writable. Set the key properly using +wake_up_interruptible_poll(), which is preferred over the sync +variant, as writers are not woken up before at least half of the +queue is available. Also, TCP does the same. + +Signed-off-by: Petr Malat +Acked-by: Xin Long +Link: https://patch.msgid.link/20250516081727.1361451-1-oss@malat.biz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 5e84083e50d7a..0aaea911b21ef 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -9092,7 +9092,8 @@ static void __sctp_write_space(struct sctp_association *asoc) + wq = rcu_dereference(sk->sk_wq); + if (wq) { + if (waitqueue_active(&wq->wait)) +- wake_up_interruptible(&wq->wait); ++ wake_up_interruptible_poll(&wq->wait, EPOLLOUT | ++ EPOLLWRNORM | EPOLLWRBAND); + + /* Note that we try to include the Async I/O support + * here by modeling from the current TCP/UDP code. +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series index b5f2a7752e..9cf90a8ad0 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -258,3 +258,89 @@ pci-dw-rockchip-fix-phy-function-call-sequence-in-rockchip_pcie_phy_deinit.patch iio-accel-fxls8962af-fix-temperature-scan-element-sign.patch iio-imu-inv_icm42600-fix-temperature-calculation.patch iio-adc-ad7606_spi-fix-reg-write-value-mask.patch +acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch +clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch +acpica-avoid-sequence-overread-in-call-to-strncmp.patch +asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch +acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch +acpica-fix-acpi-parse-and-parseext-cache-leaks.patch +power-supply-bq27xxx-retrieve-again-when-busy.patch +acpica-utilities-fix-overflow-check-in-vsnprintf.patch +asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch +pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch +acpi-battery-negate-current-when-discharging.patch +drm-amdgpu-gfx6-fix-csib-handling.patch +sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch +drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch +exfat-fix-double-free-in-delayed_free.patch +arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch +drm-bridge-anx7625-change-the-gpiod_set_value-api.patch +media-i2c-imx334-enable-runtime-pm-before-sub-device.patch +drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch +media-uapi-v4l-fix-v4l2_type_is_output-condition.patch +drm-amd-display-add-null-pointer-checks-in-dm_force_.patch +drm-msm-a6xx-increase-hfi-response-timeout.patch +media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch +drm-amdgpu-gfx10-fix-csib-handling.patch +media-ccs-pll-better-validate-vt-pll-branch.patch +media-uapi-v4l-change-v4l2_type_is_capture-condition.patch +drm-amdgpu-gfx7-fix-csib-handling.patch +ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch +jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch +media-ti-cal-fix-wrong-goto-on-error-path.patch +media-rkvdec-initialize-the-m2m-context-before-the-c.patch +sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch +ext4-prevent-stale-extent-cache-entries-caused-by-co.patch +drm-amdgpu-gfx8-fix-csib-handling.patch +drm-amdgpu-gfx9-fix-csib-handling.patch +jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch +drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch +drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch +media-tc358743-ignore-video-while-hpd-is-low.patch +media-platform-exynos4-is-add-hardware-sync-wait-to-.patch +media-i2c-imx334-update-mode_3840x2160_regs-array.patch +nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch +pmdomain-ti-fix-standby-handling-of-per-power-domain.patch +thermal-drivers-qcom-tsens-update-conditions-to-stri.patch +cpufreq-force-sync-policy-boost-with-global-boost-on.patch +net-macb-check-return-value-of-dma_set_mask_and_cohe.patch +tipc-use-kfree_sensitive-for-aead-cleanup.patch +i2c-designware-invoke-runtime-suspend-on-quick-slave.patch +emulex-benet-correct-command-version-selection-in-be.patch +wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch +sctp-do-not-wake-readers-in-__sctp_write_space.patch +cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch +i2c-npcm-add-clock-toggle-recovery.patch +net-dlink-add-synchronization-for-stats-update.patch +tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch +tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch +ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch +openvswitch-stricter-validation-for-the-userspace-ac.patch +net-atlantic-generate-software-timestamp-just-before.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009 +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690 +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264 +net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch +wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch +clk-rockchip-rk3036-mark-ddrphy-as-critical.patch +libbpf-add-identical-pointer-detection-to-btf_dedup_.patch +scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch +iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch +net-bridge-mcast-re-implement-br_multicast_-enable-d.patch +vxlan-do-not-treat-dst-cache-initialization-errors-a.patch +software-node-correct-a-oob-check-in-software_node_g.patch +pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch +scsi-lpfc-use-memcpy-for-bios-version.patch +sock-correct-error-checking-condition-for-assign-rel.patch +i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch +bpf-sockmap-fix-data-lost-during-eagain-retries.patch +octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch +watchdog-da9052_wdt-respect-twdmin.patch +bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch +arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch +tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch +revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch +platform-x86-dell_rbu-fix-list-usage.patch +platform-x86-dell_rbu-stop-overwriting-data-buffer.patch +powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch diff --git a/queue-5.15/sock-correct-error-checking-condition-for-assign-rel.patch b/queue-5.15/sock-correct-error-checking-condition-for-assign-rel.patch new file mode 100644 index 0000000000..20da0ca5b1 --- /dev/null +++ b/queue-5.15/sock-correct-error-checking-condition-for-assign-rel.patch @@ -0,0 +1,49 @@ +From 15d9f45ba09578cfc17be6aff4edd9004d98fba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 09:01:27 +0800 +Subject: sock: Correct error checking condition for + (assign|release)_proto_idx() + +From: Zijun Hu + +[ Upstream commit faeefc173be40512341b102cf1568aa0b6571acd ] + +(assign|release)_proto_idx() wrongly check find_first_zero_bit() failure +by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously. + +Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)' + +Signed-off-by: Zijun Hu +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250410-fix_net-v2-1-d69e7c5739a4@quicinc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 7f7f02a01f2dd..3634a4f1f76c6 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -3571,7 +3571,7 @@ static int assign_proto_idx(struct proto *prot) + { + prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); + +- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { ++ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) { + pr_err("PROTO_INUSE_NR exhausted\n"); + return -ENOSPC; + } +@@ -3582,7 +3582,7 @@ static int assign_proto_idx(struct proto *prot) + + static void release_proto_idx(struct proto *prot) + { +- if (prot->inuse_idx != PROTO_INUSE_NR - 1) ++ if (prot->inuse_idx != PROTO_INUSE_NR) + clear_bit(prot->inuse_idx, proto_inuse_idx); + } + #else +-- +2.39.5 + diff --git a/queue-5.15/software-node-correct-a-oob-check-in-software_node_g.patch b/queue-5.15/software-node-correct-a-oob-check-in-software_node_g.patch new file mode 100644 index 0000000000..7dddea971b --- /dev/null +++ b/queue-5.15/software-node-correct-a-oob-check-in-software_node_g.patch @@ -0,0 +1,42 @@ +From 0352a979b41622054b00de7c8f2be3857aed4853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 19:36:52 +0800 +Subject: software node: Correct a OOB check in + software_node_get_reference_args() + +From: Zijun Hu + +[ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ] + +software_node_get_reference_args() wants to get @index-th element, so +the property value requires at least '(index + 1) * sizeof(*ref)' bytes +but that can not be guaranteed by current OOB check, and may cause OOB +for malformed property. + +Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'. + +Reviewed-by: Sakari Ailus +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/swnode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c +index 15f149fc19401..0af6071f86641 100644 +--- a/drivers/base/swnode.c ++++ b/drivers/base/swnode.c +@@ -524,7 +524,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, + if (prop->is_inline) + return -EINVAL; + +- if (index * sizeof(*ref) >= prop->length) ++ if ((index + 1) * sizeof(*ref) > prop->length) + return -ENOENT; + + ref_array = prop->pointer; +-- +2.39.5 + diff --git a/queue-5.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch b/queue-5.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch new file mode 100644 index 0000000000..ed1508678e --- /dev/null +++ b/queue-5.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch @@ -0,0 +1,81 @@ +From 51a32b17198f4a84c0c960cec2e7a269f037a2e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Mar 2025 14:48:36 +0800 +Subject: sunrpc: fix race in cache cleanup causing stale nextcheck time + +From: Long Li + +[ Upstream commit 2298abcbe11e9b553d03c0f1d084da786f7eff88 ] + +When cache cleanup runs concurrently with cache entry removal, a race +condition can occur that leads to incorrect nextcheck times. This can +delay cache cleanup for the cache_detail by up to 1800 seconds: + +1. cache_clean() sets nextcheck to current time plus 1800 seconds +2. While scanning a non-empty bucket, concurrent cache entry removal can + empty that bucket +3. cache_clean() finds no cache entries in the now-empty bucket to update + the nextcheck time +4. This maybe delays the next scan of the cache_detail by up to 1800 + seconds even when it should be scanned earlier based on remaining + entries + +Fix this by moving the hash_lock acquisition earlier in cache_clean(). +This ensures bucket emptiness checks and nextcheck updates happen +atomically, preventing the race between cleanup and entry removal. + +Signed-off-by: Long Li +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/cache.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index e8448e9e03d59..715f7d080f7a2 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -451,24 +451,21 @@ static int cache_clean(void) + } + } + ++ spin_lock(¤t_detail->hash_lock); ++ + /* find a non-empty bucket in the table */ +- while (current_detail && +- current_index < current_detail->hash_size && ++ while (current_index < current_detail->hash_size && + hlist_empty(¤t_detail->hash_table[current_index])) + current_index++; + + /* find a cleanable entry in the bucket and clean it, or set to next bucket */ +- +- if (current_detail && current_index < current_detail->hash_size) { ++ if (current_index < current_detail->hash_size) { + struct cache_head *ch = NULL; + struct cache_detail *d; + struct hlist_head *head; + struct hlist_node *tmp; + +- spin_lock(¤t_detail->hash_lock); +- + /* Ok, now to clean this strand */ +- + head = ¤t_detail->hash_table[current_index]; + hlist_for_each_entry_safe(ch, tmp, head, cache_list) { + if (current_detail->nextcheck > ch->expiry_time) +@@ -489,8 +486,10 @@ static int cache_clean(void) + spin_unlock(&cache_list_lock); + if (ch) + sunrpc_end_cache_remove_entry(ch, d); +- } else ++ } else { ++ spin_unlock(¤t_detail->hash_lock); + spin_unlock(&cache_list_lock); ++ } + + return rv; + } +-- +2.39.5 + diff --git a/queue-5.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch b/queue-5.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch new file mode 100644 index 0000000000..5e5570fafe --- /dev/null +++ b/queue-5.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch @@ -0,0 +1,52 @@ +From 6730491e0b84bf2c3e343956438098e57c810b81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Mar 2025 14:48:35 +0800 +Subject: sunrpc: update nextcheck time when adding new cache entries + +From: Long Li + +[ Upstream commit 5ca00634c8bbb2979c73465588f486b9632f5ed5 ] + +The cache_detail structure uses a "nextcheck" field to control hash table +scanning intervals. When a table scan begins, nextcheck is set to current +time plus 1800 seconds. During scanning, if cache_detail is not empty and +a cache entry's expiry time is earlier than the current nextcheck, the +nextcheck is updated to that expiry time. + +This mechanism ensures that: +1) Empty cache_details are scanned every 1800 seconds to avoid unnecessary + scans +2) Non-empty cache_details are scanned based on the earliest expiry time + found + +However, when adding a new cache entry to an empty cache_detail, the +nextcheck time was not being updated, remaining at 1800 seconds. This +could delay cache cleanup for up to 1800 seconds, potentially blocking +threads(such as nfsd) that are waiting for cache cleanup. + +Fix this by updating the nextcheck time whenever a new cache entry is +added. + +Signed-off-by: Long Li +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/cache.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 95aab48d32e67..e8448e9e03d59 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -133,6 +133,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + + hlist_add_head_rcu(&new->cache_list, head); + detail->entries++; ++ if (detail->nextcheck > new->expiry_time) ++ detail->nextcheck = new->expiry_time + 1; + cache_get(new); + spin_unlock(&detail->hash_lock); + +-- +2.39.5 + diff --git a/queue-5.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch b/queue-5.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch new file mode 100644 index 0000000000..d64c831be2 --- /dev/null +++ b/queue-5.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch @@ -0,0 +1,71 @@ +From d975e1daf0c020ac5f41ac55bc20268225383f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:15 +0000 +Subject: tcp: always seek for minimal rtt in tcp_rcv_rtt_update() + +From: Eric Dumazet + +[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ] + +tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT +in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust() + +When TCP TS are enabled, tcp_rcv_rtt_update() is using +EWMA to smooth the samples. + +Change this to immediately latch the incoming value if it +is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust() +does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf. + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250513193919.1089692-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 8859a38b45d5e..000557f5c54bc 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -641,10 +641,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss); + */ + static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) + { +- u32 new_sample = tp->rcv_rtt_est.rtt_us; +- long m = sample; ++ u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us; ++ long m = sample << 3; + +- if (new_sample != 0) { ++ if (old_sample == 0 || m < old_sample) { ++ new_sample = m; ++ } else { + /* If we sample in larger samples in the non-timestamp + * case, we could grossly overestimate the RTT especially + * with chatty applications or bulk transfer apps which +@@ -655,17 +657,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) + * else with timestamps disabled convergence takes too + * long. + */ +- if (!win_dep) { +- m -= (new_sample >> 3); +- new_sample += m; +- } else { +- m <<= 3; +- if (m < new_sample) +- new_sample = m; +- } +- } else { +- /* No previous measure. */ +- new_sample = m << 3; ++ if (win_dep) ++ return; ++ new_sample = old_sample - (old_sample >> 3) + sample; + } + + tp->rcv_rtt_est.rtt_us = new_sample; +-- +2.39.5 + diff --git a/queue-5.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch b/queue-5.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch new file mode 100644 index 0000000000..5db99dedcf --- /dev/null +++ b/queue-5.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch @@ -0,0 +1,52 @@ +From 3f77ff0062903bf3840400919fc34cd65c700006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:14 +0000 +Subject: tcp: fix initial tp->rcvq_space.space value for passive TS enabled + flows + +From: Eric Dumazet + +[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ] + +tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows +before the call to tcp_init_transfer() / tcp_init_buffer_space(). + +Otherwise tp->rcvq_space.space is off by 120 bytes +(TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED). + +Signed-off-by: Eric Dumazet +Reviewed-by: Wei Wang +Link: https://patch.msgid.link/20250513193919.1089692-7-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 000557f5c54bc..a52d5b718e6e1 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6573,6 +6573,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + if (!tp->srtt_us) + tcp_synack_rtt_meas(sk, req); + ++ if (tp->rx_opt.tstamp_ok) ++ tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; ++ + if (req) { + tcp_rcv_synrecv_state_fastopen(sk); + } else { +@@ -6597,9 +6600,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale; + tcp_init_wl(tp, TCP_SKB_CB(skb)->seq); + +- if (tp->rx_opt.tstamp_ok) +- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; +- + if (!inet_csk(sk)->icsk_ca_ops->cong_control) + tcp_update_pacing_rate(sk); + +-- +2.39.5 + diff --git a/queue-5.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch b/queue-5.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch new file mode 100644 index 0000000000..6ecdc7be6d --- /dev/null +++ b/queue-5.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch @@ -0,0 +1,87 @@ +From 09f14ffff91617bcc8de23667ee4194576c96e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 15:06:43 +0200 +Subject: tee: Prevent size calculation wraparound on 32-bit kernels + +From: Jann Horn + +[ Upstream commit 39bb67edcc582b3b386a9ec983da67fa8a10ec03 ] + +The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on +32-bit kernels: Multiplying a user-provided 32-bit value with the +size of a structure can wrap around on such platforms. + +Fix it by using saturating arithmetic for the size calculation. + +This has no security consequences because, in all users of +TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks +for wrapping. + +Signed-off-by: Jann Horn +Signed-off-by: Jens Wiklander +Tested-by: Rouven Czerwinski +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index a44e5b53e7a91..a7e89c229fc51 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -19,7 +20,7 @@ + + #define TEE_NUM_DEVICES 32 + +-#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x)) ++#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x))) + + #define TEE_UUID_NS_NAME_SIZE 128 + +@@ -493,7 +494,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx, + if (copy_from_user(&arg, uarg, sizeof(arg))) + return -EFAULT; + +- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) ++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) + return -EINVAL; + + if (arg.num_params) { +@@ -571,7 +572,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx, + if (copy_from_user(&arg, uarg, sizeof(arg))) + return -EFAULT; + +- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) ++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) + return -EINVAL; + + if (arg.num_params) { +@@ -705,7 +706,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx, + if (get_user(num_params, &uarg->num_params)) + return -EFAULT; + +- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len) ++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len) + return -EINVAL; + + params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); +@@ -804,7 +805,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx, + get_user(num_params, &uarg->num_params)) + return -EFAULT; + +- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len) ++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len) + return -EINVAL; + + params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); +-- +2.39.5 + diff --git a/queue-5.15/thermal-drivers-qcom-tsens-update-conditions-to-stri.patch b/queue-5.15/thermal-drivers-qcom-tsens-update-conditions-to-stri.patch new file mode 100644 index 0000000000..44f06ac744 --- /dev/null +++ b/queue-5.15/thermal-drivers-qcom-tsens-update-conditions-to-stri.patch @@ -0,0 +1,79 @@ +From 71304f53b1a558535fcdffac591d6f9f4575e106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2025 09:11:36 +0400 +Subject: thermal/drivers/qcom/tsens: Update conditions to strictly evaluate + for IP v2+ + +From: George Moussalem + +[ Upstream commit e3f90f167a49902cda2408f7e91cca0dcfd5040a ] + +TSENS v2.0+ leverage features not available to prior versions such as +updated interrupts init routine, masked interrupts, and watchdog. +Currently, the checks in place evaluate whether the IP version is greater +than v1 which invalidates when updates to v1 or v1 minor versions are +implemented. As such, update the conditional statements to strictly +evaluate whether the version is greater than or equal to v2 (inclusive). + +Signed-off-by: George Moussalem +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Amit Kucheria +Link: https://lore.kernel.org/r/DS7PR19MB8883434CAA053648E22AA8AC9DCC2@DS7PR19MB8883.namprd19.prod.outlook.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index 2f31129cd5471..21f980464e71b 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -266,7 +266,7 @@ static void tsens_set_interrupt(struct tsens_priv *priv, u32 hw_id, + dev_dbg(priv->dev, "[%u] %s: %s -> %s\n", hw_id, __func__, + irq_type ? ((irq_type == 1) ? "UP" : "CRITICAL") : "LOW", + enable ? "en" : "dis"); +- if (tsens_version(priv) > VER_1_X) ++ if (tsens_version(priv) >= VER_2_X) + tsens_set_interrupt_v2(priv, hw_id, irq_type, enable); + else + tsens_set_interrupt_v1(priv, hw_id, irq_type, enable); +@@ -318,7 +318,7 @@ static int tsens_read_irq_state(struct tsens_priv *priv, u32 hw_id, + ret = regmap_field_read(priv->rf[LOW_INT_CLEAR_0 + hw_id], &d->low_irq_clear); + if (ret) + return ret; +- if (tsens_version(priv) > VER_1_X) { ++ if (tsens_version(priv) >= VER_2_X) { + ret = regmap_field_read(priv->rf[UP_INT_MASK_0 + hw_id], &d->up_irq_mask); + if (ret) + return ret; +@@ -362,7 +362,7 @@ static int tsens_read_irq_state(struct tsens_priv *priv, u32 hw_id, + + static inline u32 masked_irq(u32 hw_id, u32 mask, enum tsens_ver ver) + { +- if (ver > VER_1_X) ++ if (ver >= VER_2_X) + return mask & (1 << hw_id); + + /* v1, v0.1 don't have a irq mask register */ +@@ -578,7 +578,7 @@ static int tsens_set_trips(void *_sensor, int low, int high) + static int tsens_enable_irq(struct tsens_priv *priv) + { + int ret; +- int val = tsens_version(priv) > VER_1_X ? 7 : 1; ++ int val = tsens_version(priv) >= VER_2_X ? 7 : 1; + + ret = regmap_field_write(priv->rf[INT_EN], val); + if (ret < 0) +@@ -892,7 +892,7 @@ int __init init_common(struct tsens_priv *priv) + } + } + +- if (tsens_version(priv) > VER_1_X && ver_minor > 2) { ++ if (tsens_version(priv) >= VER_2_X && ver_minor > 2) { + /* Watchdog is present only on v2.3+ */ + priv->feat->has_watchdog = 1; + for (i = WDOG_BARK_STATUS; i <= CC_MON_MASK; i++) { +-- +2.39.5 + diff --git a/queue-5.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch b/queue-5.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch new file mode 100644 index 0000000000..e9d2f6cd53 --- /dev/null +++ b/queue-5.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch @@ -0,0 +1,45 @@ +From 011abeaf5998bef27217ee9721f1b102bd83ddb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 May 2025 11:47:17 +0000 +Subject: tipc: use kfree_sensitive() for aead cleanup + +From: Zilin Guan + +[ Upstream commit c8ef20fe7274c5766a317f9193b70bed717b6b3d ] + +The tipc_aead_free() function currently uses kfree() to release the aead +structure. However, this structure contains sensitive information, such +as key's SALT value, which should be securely erased from memory to +prevent potential leakage. + +To enhance security, replace kfree() with kfree_sensitive() when freeing +the aead structure. This change ensures that sensitive data is explicitly +cleared before memory deallocation, aligning with the approach used in +tipc_aead_init() and adhering to best practices for handling confidential +information. + +Signed-off-by: Zilin Guan +Reviewed-by: Tung Nguyen +Link: https://patch.msgid.link/20250523114717.4021518-1-zilin@seu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index 07f35c48bd3a2..b525e6483881a 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp) + } + free_percpu(aead->tfm_entry); + kfree_sensitive(aead->key); +- kfree(aead); ++ kfree_sensitive(aead); + } + + static int tipc_aead_users(struct tipc_aead __rcu *aead) +-- +2.39.5 + diff --git a/queue-5.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch b/queue-5.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch new file mode 100644 index 0000000000..fd3e3c0687 --- /dev/null +++ b/queue-5.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch @@ -0,0 +1,75 @@ +From dbc82263d2575bcab0fc28c91c6250b6ed2a87e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 15:11:41 +0300 +Subject: vxlan: Do not treat dst cache initialization errors as fatal + +From: Ido Schimmel + +[ Upstream commit 20c76dadc783759fd3819d289c72be590660cc8b ] + +FDB entries are allocated in an atomic context as they can be added from +the data path when learning is enabled. + +After converting the FDB hash table to rhashtable, the insertion rate +will be much higher (*) which will entail a much higher rate of per-CPU +allocations via dst_cache_init(). + +When adding a large number of entries (e.g., 256k) in a batch, a small +percentage (< 0.02%) of these per-CPU allocations will fail [1]. This +does not happen with the current code since the insertion rate is low +enough to give the per-CPU allocator a chance to asynchronously create +new chunks of per-CPU memory. + +Given that: + +a. Only a small percentage of these per-CPU allocations fail. + +b. The scenario where this happens might not be the most realistic one. + +c. The driver can work correctly without dst caches. The dst_cache_*() +APIs first check that the dst cache was properly initialized. + +d. The dst caches are not always used (e.g., 'tos inherit'). + +It seems reasonable to not treat these allocation failures as fatal. + +Therefore, do not bail when dst_cache_init() fails and suppress warnings +by specifying '__GFP_NOWARN'. + +[1] percpu: allocation failed, size=40 align=8 atomic=1, atomic alloc failed, no space left + +(*) 97% reduction in average latency of vxlan_fdb_update() when adding +256k entries in a batch. + +Reviewed-by: Petr Machata +Signed-off-by: Ido Schimmel +Link: https://patch.msgid.link/20250415121143.345227-14-idosch@nvidia.com +Reviewed-by: Nikolay Aleksandrov +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 9c4d7bedc7641..91122d4d404b7 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -713,10 +713,10 @@ static int vxlan_fdb_append(struct vxlan_fdb *f, + if (rd == NULL) + return -ENOMEM; + +- if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) { +- kfree(rd); +- return -ENOMEM; +- } ++ /* The driver can work correctly without a dst cache, so do not treat ++ * dst cache initialization errors as fatal. ++ */ ++ dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN); + + rd->remote_ip = *ip; + rd->remote_port = port; +-- +2.39.5 + diff --git a/queue-5.15/watchdog-da9052_wdt-respect-twdmin.patch b/queue-5.15/watchdog-da9052_wdt-respect-twdmin.patch new file mode 100644 index 0000000000..cb37d772a8 --- /dev/null +++ b/queue-5.15/watchdog-da9052_wdt-respect-twdmin.patch @@ -0,0 +1,39 @@ +From 9774d4d189034b10c6ad419264bec2bbc8220457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 09:29:51 +0100 +Subject: watchdog: da9052_wdt: respect TWDMIN + +From: Marcus Folkesson + +[ Upstream commit 325f510fcd9cda5a44bcb662b74ba4e3dabaca10 ] + +We have to wait at least the minimium time for the watchdog window +(TWDMIN) before writings to the wdt register after the +watchdog is activated. +Otherwise the chip will assert TWD_ERROR and power down to reset mode. + +Signed-off-by: Marcus Folkesson +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-4-a38a560fef0e@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/da9052_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c +index d708c091bf1b1..180526220d8c4 100644 +--- a/drivers/watchdog/da9052_wdt.c ++++ b/drivers/watchdog/da9052_wdt.c +@@ -164,6 +164,7 @@ static int da9052_wdt_probe(struct platform_device *pdev) + da9052_wdt = &driver_data->wdt; + + da9052_wdt->timeout = DA9052_DEF_TIMEOUT; ++ da9052_wdt->min_hw_heartbeat_ms = DA9052_TWDMIN; + da9052_wdt->info = &da9052_wdt_info; + da9052_wdt->ops = &da9052_wdt_ops; + da9052_wdt->parent = dev; +-- +2.39.5 + diff --git a/queue-5.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch b/queue-5.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch new file mode 100644 index 0000000000..90c619a48d --- /dev/null +++ b/queue-5.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch @@ -0,0 +1,67 @@ +From a4fed1719c7626ca2d85e3b7e2350bb33f05d901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 21:10:42 +0200 +Subject: wifi: mac80211: do not offer a mesh path if forwarding is disabled + +From: Benjamin Berg + +[ Upstream commit cf1b684a06170d253b47d6a5287821de976435bd ] + +When processing a PREQ the code would always check whether we have a +mesh path locally and reply accordingly. However, when forwarding is +disabled then we should not reply with this information as we will not +forward data packets down that path. + +Move the check for dot11MeshForwarding up in the function and skip the +mesh path lookup in that case. In the else block, set forward to false +so that the rest of the function becomes a no-op and the +dot11MeshForwarding check does not need to be duplicated. + +This explains an effect observed in the Freifunk community where mesh +forwarding is disabled. In that case a mesh with three STAs and only bad +links in between them, individual STAs would occionally have indirect +mpath entries. This should not have happened. + +Signed-off-by: Benjamin Berg +Reviewed-by: Rouven Czerwinski +Link: https://patch.msgid.link/20250430191042.3287004-1-benjamin@sipsolutions.net +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_hwmp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c +index e6b6a7508ff1b..8bf238afb5442 100644 +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -620,7 +620,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + mesh_path_add_gate(mpath); + } + rcu_read_unlock(); +- } else { ++ } else if (ifmsh->mshcfg.dot11MeshForwarding) { + rcu_read_lock(); + mpath = mesh_path_lookup(sdata, target_addr); + if (mpath) { +@@ -638,6 +638,8 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + } + } + rcu_read_unlock(); ++ } else { ++ forward = false; + } + + if (reply) { +@@ -655,7 +657,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + } + } + +- if (forward && ifmsh->mshcfg.dot11MeshForwarding) { ++ if (forward) { + u32 preq_id; + u8 hopcount; + +-- +2.39.5 + diff --git a/queue-5.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch b/queue-5.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch new file mode 100644 index 0000000000..4d83254f43 --- /dev/null +++ b/queue-5.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch @@ -0,0 +1,86 @@ +From e144e1b63d05d5e5dd970c5dc964689853237589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 16:39:14 +0200 +Subject: wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R + +From: Henk Vergonet + +[ Upstream commit 3c0e4f606d8693795a2c965d6f4987b1bfc31097 ] + +Adds support for: + - LiteOn WN4516R + - LiteOn WN4519R + Both use: + - A nonstandard USB connector + - Mediatek chipset MT7600U + - ASIC revision: 76320044 + +Disabled VHT support on ASIC revision 76320044: + + This fixes the 5G connectibity issue on LiteOn WN4519R module + see https://github.com/openwrt/mt76/issues/971 + + And may also fix the 5G issues on the XBox One Wireless Adapter + see https://github.com/openwrt/mt76/issues/200 + + I have looked at the FCC info related to the MT7632U chip as mentioned in here: + https://github.com/openwrt/mt76/issues/459 + These confirm the chipset does not support 'ac' mode and hence VHT should be turned of. + +Signed-off-by: Henk Vergonet +Acked-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250418143914.31384-1-henk.vergonet@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 ++ + .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 ++++++++++++- + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +index 09b01e09bcfe0..1f2990d45d9e3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = { + { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */ + { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */ + { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */ ++ { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */ ++ { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */ + { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */ + { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */ + { USB_DEVICE(0x045e, 0x02e6) }, /* XBox One Wireless Adapter */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c +index 85dcdc22fbebf..41b9a99665822 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c +@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) + { + struct ieee80211_hw *hw = mt76_hw(dev); + struct mt76_usb *usb = &dev->mt76.usb; ++ bool vht; + int err; + + INIT_DELAYED_WORK(&dev->cal_work, mt76x2u_phy_calibrate); +@@ -215,7 +216,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) + + /* check hw sg support in order to enable AMSDU */ + hw->max_tx_fragments = dev->mt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1; +- err = mt76_register_device(&dev->mt76, true, mt76x02_rates, ++ switch (dev->mt76.rev) { ++ case 0x76320044: ++ /* these ASIC revisions do not support VHT */ ++ vht = false; ++ break; ++ default: ++ vht = true; ++ break; ++ } ++ ++ err = mt76_register_device(&dev->mt76, vht, mt76x02_rates, + ARRAY_SIZE(mt76x02_rates)); + if (err) + goto fail; +-- +2.39.5 + -- 2.47.2