From f41fd2c3aec8cb923d9351ab9f948034340194db Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 28 Apr 2025 21:39:20 -0400 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...ding-mistakes-in-a-couple-of-sizeof-.patch | 46 ++++++++ ...sabled-clock-provider-in-of_clk_get_.patch | 61 ++++++++++ ...-null-use-spin-lock-instead-of-mutex.patch | 101 +++++++++++++++++ ...t-fix-dmatest-waiting-less-when-inte.patch | 51 +++++++++ ...390-don-t-use-pk-through-tracepoints.patch | 53 +++++++++ ...ck-for-missing-source-disk-in-proces.patch | 77 +++++++++++++ ...cm-detect-cm-quirks-from-device-tree.patch | 107 ++++++++++++++++++ ...b-reduce-stack-usage-in-idt_scan_mws.patch | 77 +++++++++++++ ...sc-pdt-fix-missing-prototype-warning.patch | 51 +++++++++ queue-5.4/qibfs-fix-_another_-leak.patch | 36 ++++++ ...make-config_cpu_isolation-depend-on-.patch | 46 ++++++++ ...phy_attached-to-zero-when-device-is-.patch | 36 ++++++ .../selftests-ublk-fix-test_stripe_04.patch | 58 ++++++++++ queue-5.4/series | 18 +++ ...f-size-overflow-issue-during-udmabuf.patch | 38 +++++++ ...d-add-null-pointer-check-in-ast_vhub.patch | 41 +++++++ ...-hcd-add-missing-spi_device_id-table.patch | 51 +++++++++ ...ill-rsb-on-vmexit-with-eibrs-retpoli.patch | 64 +++++++++++ ...-config_pci_cnb20le_quirk-depend-on-.patch | 97 ++++++++++++++++ 19 files changed, 1109 insertions(+) create mode 100644 queue-5.4/acpi-pptt-fix-coding-mistakes-in-a-couple-of-sizeof-.patch create mode 100644 queue-5.4/clk-check-for-disabled-clock-provider-in-of_clk_get_.patch create mode 100644 queue-5.4/crypto-null-use-spin-lock-instead-of-mutex.patch create mode 100644 queue-5.4/dmaengine-dmatest-fix-dmatest-waiting-less-when-inte.patch create mode 100644 queue-5.4/kvm-s390-don-t-use-pk-through-tracepoints.patch create mode 100644 queue-5.4/md-raid1-add-check-for-missing-source-disk-in-proces.patch create mode 100644 queue-5.4/mips-cm-detect-cm-quirks-from-device-tree.patch create mode 100644 queue-5.4/ntb-reduce-stack-usage-in-idt_scan_mws.patch create mode 100644 queue-5.4/parisc-pdt-fix-missing-prototype-warning.patch create mode 100644 queue-5.4/qibfs-fix-_another_-leak.patch create mode 100644 queue-5.4/sched-isolation-make-config_cpu_isolation-depend-on-.patch create mode 100644 queue-5.4/scsi-pm80xx-set-phy_attached-to-zero-when-device-is-.patch create mode 100644 queue-5.4/selftests-ublk-fix-test_stripe_04.patch create mode 100644 queue-5.4/udmabuf-fix-a-buf-size-overflow-issue-during-udmabuf.patch create mode 100644 queue-5.4/usb-gadget-aspeed-add-null-pointer-check-in-ast_vhub.patch create mode 100644 queue-5.4/usb-host-max3421-hcd-add-missing-spi_device_id-table.patch create mode 100644 queue-5.4/x86-bugs-don-t-fill-rsb-on-vmexit-with-eibrs-retpoli.patch create mode 100644 queue-5.4/x86-kconfig-make-config_pci_cnb20le_quirk-depend-on-.patch diff --git a/queue-5.4/acpi-pptt-fix-coding-mistakes-in-a-couple-of-sizeof-.patch b/queue-5.4/acpi-pptt-fix-coding-mistakes-in-a-couple-of-sizeof-.patch new file mode 100644 index 0000000000..16365c71e3 --- /dev/null +++ b/queue-5.4/acpi-pptt-fix-coding-mistakes-in-a-couple-of-sizeof-.patch @@ -0,0 +1,46 @@ +From 69fdce8b8ab5c594d61b8b11ba0d75bf7f160cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 17:15:42 -0700 +Subject: ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls + +From: Jean-Marc Eurin + +[ Upstream commit 7ab4f0e37a0f4207e742a8de69be03984db6ebf0 ] + +The end of table checks should be done with the structure size, +but 2 of the 3 similar calls use the pointer size. + +Signed-off-by: Jean-Marc Eurin +Link: https://patch.msgid.link/20250402001542.2600671-1-jmeurin@google.com +[ rjw: Subject edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/pptt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c +index f31544d3656e3..c1c7727ab9324 100644 +--- a/drivers/acpi/pptt.c ++++ b/drivers/acpi/pptt.c +@@ -216,7 +216,7 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr, + node_entry = ACPI_PTR_DIFF(node, table_hdr); + entry = ACPI_ADD_PTR(struct acpi_subtable_header, table_hdr, + sizeof(struct acpi_table_pptt)); +- proc_sz = sizeof(struct acpi_pptt_processor *); ++ proc_sz = sizeof(struct acpi_pptt_processor); + + while ((unsigned long)entry + proc_sz < table_end) { + cpu_node = (struct acpi_pptt_processor *)entry; +@@ -257,7 +257,7 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he + table_end = (unsigned long)table_hdr + table_hdr->length; + entry = ACPI_ADD_PTR(struct acpi_subtable_header, table_hdr, + sizeof(struct acpi_table_pptt)); +- proc_sz = sizeof(struct acpi_pptt_processor *); ++ proc_sz = sizeof(struct acpi_pptt_processor); + + /* find the processor structure associated with this cpuid */ + while ((unsigned long)entry + proc_sz < table_end) { +-- +2.39.5 + diff --git a/queue-5.4/clk-check-for-disabled-clock-provider-in-of_clk_get_.patch b/queue-5.4/clk-check-for-disabled-clock-provider-in-of_clk_get_.patch new file mode 100644 index 0000000000..1c1158c446 --- /dev/null +++ b/queue-5.4/clk-check-for-disabled-clock-provider-in-of_clk_get_.patch @@ -0,0 +1,61 @@ +From 8cbc5defc3e2d69bf7e3763fce5027d05877e056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Feb 2025 23:37:33 +0100 +Subject: clk: check for disabled clock-provider in + of_clk_get_hw_from_clkspec() + +From: Heiko Stuebner + +[ Upstream commit b20150d499b3ee5c2d632fbc5ac94f98dd33accf ] + +of_clk_get_hw_from_clkspec() checks all available clock-providers by +comparing their of nodes to the one from the clkspec. If no matching +clock provider is found, the function returns -EPROBE_DEFER to cause a +re-check at a later date. If a matching clock provider is found, an +authoritative answer can be retrieved from it whether the clock exists +or not. + +This does not take into account that the clock-provider may never +appear, because it's node is disabled. This can happen when a clock is +optional, provided by a separate block which never gets enabled. + +One example of this happening is the rk3588's VOP, which has optional +additional display clocks coming from PLLs inside the hdmiphy blocks. +These can be used for better rates, but the system will also work +without them. + +The problem around that is described in the followups to[1]. As we +already know the of node of the presumed clock provider, add a check via +of_device_is_available() whether this is a "valid" device node. This +prevents eternal defer loops. + +Link: https://lore.kernel.org/dri-devel/20250215-vop2-hdmi1-disp-modes-v1-3-81962a7151d6@collabora.com/ [1] +Reviewed-by: Sebastian Reichel +Tested-by: Cristian Ciocaltea +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250222223733.2990179-1-heiko@sntech.de +[sboyd@kernel.org: Reword commit text a bit] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 56be3f97c265a..6ef5bf61fdd47 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4727,6 +4727,10 @@ of_clk_get_hw_from_clkspec(struct of_phandle_args *clkspec) + if (!clkspec) + return ERR_PTR(-EINVAL); + ++ /* Check if node in clkspec is in disabled/fail state */ ++ if (!of_device_is_available(clkspec->np)) ++ return ERR_PTR(-ENOENT); ++ + mutex_lock(&of_clk_mutex); + list_for_each_entry(provider, &of_clk_providers, link) { + if (provider->node == clkspec->np) { +-- +2.39.5 + diff --git a/queue-5.4/crypto-null-use-spin-lock-instead-of-mutex.patch b/queue-5.4/crypto-null-use-spin-lock-instead-of-mutex.patch new file mode 100644 index 0000000000..c1b476f2bc --- /dev/null +++ b/queue-5.4/crypto-null-use-spin-lock-instead-of-mutex.patch @@ -0,0 +1,101 @@ +From 2d9c85b37848473f2eda134d6841e4eccd95170c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 14:10:07 +0800 +Subject: crypto: null - Use spin lock instead of mutex + +From: Herbert Xu + +[ Upstream commit dcc47a028c24e793ce6d6efebfef1a1e92f80297 ] + +As the null algorithm may be freed in softirq context through +af_alg, use spin locks instead of mutexes to protect the default +null algorithm. + +Reported-by: syzbot+b3e02953598f447d4d2a@syzkaller.appspotmail.com +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/crypto_null.c | 39 ++++++++++++++++++++++++++------------- + 1 file changed, 26 insertions(+), 13 deletions(-) + +diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c +index 5b84b0f7cc178..3378670286535 100644 +--- a/crypto/crypto_null.c ++++ b/crypto/crypto_null.c +@@ -17,10 +17,10 @@ + #include + #include + #include +-#include ++#include + #include + +-static DEFINE_MUTEX(crypto_default_null_skcipher_lock); ++static DEFINE_SPINLOCK(crypto_default_null_skcipher_lock); + static struct crypto_sync_skcipher *crypto_default_null_skcipher; + static int crypto_default_null_skcipher_refcnt; + +@@ -152,23 +152,32 @@ MODULE_ALIAS_CRYPTO("cipher_null"); + + struct crypto_sync_skcipher *crypto_get_default_null_skcipher(void) + { ++ struct crypto_sync_skcipher *ntfm = NULL; + struct crypto_sync_skcipher *tfm; + +- mutex_lock(&crypto_default_null_skcipher_lock); ++ spin_lock_bh(&crypto_default_null_skcipher_lock); + tfm = crypto_default_null_skcipher; + + if (!tfm) { +- tfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); +- if (IS_ERR(tfm)) +- goto unlock; +- +- crypto_default_null_skcipher = tfm; ++ spin_unlock_bh(&crypto_default_null_skcipher_lock); ++ ++ ntfm = crypto_alloc_sync_skcipher("ecb(cipher_null)", 0, 0); ++ if (IS_ERR(ntfm)) ++ return ntfm; ++ ++ spin_lock_bh(&crypto_default_null_skcipher_lock); ++ tfm = crypto_default_null_skcipher; ++ if (!tfm) { ++ tfm = ntfm; ++ ntfm = NULL; ++ crypto_default_null_skcipher = tfm; ++ } + } + + crypto_default_null_skcipher_refcnt++; ++ spin_unlock_bh(&crypto_default_null_skcipher_lock); + +-unlock: +- mutex_unlock(&crypto_default_null_skcipher_lock); ++ crypto_free_sync_skcipher(ntfm); + + return tfm; + } +@@ -176,12 +185,16 @@ EXPORT_SYMBOL_GPL(crypto_get_default_null_skcipher); + + void crypto_put_default_null_skcipher(void) + { +- mutex_lock(&crypto_default_null_skcipher_lock); ++ struct crypto_sync_skcipher *tfm = NULL; ++ ++ spin_lock_bh(&crypto_default_null_skcipher_lock); + if (!--crypto_default_null_skcipher_refcnt) { +- crypto_free_sync_skcipher(crypto_default_null_skcipher); ++ tfm = crypto_default_null_skcipher; + crypto_default_null_skcipher = NULL; + } +- mutex_unlock(&crypto_default_null_skcipher_lock); ++ spin_unlock_bh(&crypto_default_null_skcipher_lock); ++ ++ crypto_free_sync_skcipher(tfm); + } + EXPORT_SYMBOL_GPL(crypto_put_default_null_skcipher); + +-- +2.39.5 + diff --git a/queue-5.4/dmaengine-dmatest-fix-dmatest-waiting-less-when-inte.patch b/queue-5.4/dmaengine-dmatest-fix-dmatest-waiting-less-when-inte.patch new file mode 100644 index 0000000000..ecdadf4052 --- /dev/null +++ b/queue-5.4/dmaengine-dmatest-fix-dmatest-waiting-less-when-inte.patch @@ -0,0 +1,51 @@ +From da322433d51a0be1e5c5ebe7495b9046b7d3c369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 15:00:06 -0800 +Subject: dmaengine: dmatest: Fix dmatest waiting less when interrupted + +From: Vinicius Costa Gomes + +[ Upstream commit e87ca16e99118ab4e130a41bdf12abbf6a87656c ] + +Change the "wait for operation finish" logic to take interrupts into +account. + +When using dmatest with idxd DMA engine, it's possible that during +longer tests, the interrupt notifying the finish of an operation +happens during wait_event_freezable_timeout(), which causes dmatest to +cleanup all the resources, some of which might still be in use. + +This fix ensures that the wait logic correctly handles interrupts, +preventing premature cleanup of resources. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202502171134.8c403348-lkp@intel.com +Signed-off-by: Vinicius Costa Gomes +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20250305230007.590178-1-vinicius.gomes@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmatest.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 238936e2dfe2d..6dfa1e038726a 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -809,9 +809,9 @@ static int dmatest_func(void *data) + } else { + dma_async_issue_pending(chan); + +- wait_event_freezable_timeout(thread->done_wait, +- done->done, +- msecs_to_jiffies(params->timeout)); ++ wait_event_timeout(thread->done_wait, ++ done->done, ++ msecs_to_jiffies(params->timeout)); + + status = dma_async_is_tx_complete(chan, cookie, NULL, + NULL); +-- +2.39.5 + diff --git a/queue-5.4/kvm-s390-don-t-use-pk-through-tracepoints.patch b/queue-5.4/kvm-s390-don-t-use-pk-through-tracepoints.patch new file mode 100644 index 0000000000..f769fb8d7e --- /dev/null +++ b/queue-5.4/kvm-s390-don-t-use-pk-through-tracepoints.patch @@ -0,0 +1,53 @@ +From d7567299cb4a71f7d641a4c5e8c550f19f61fa4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 14:13:56 +0100 +Subject: KVM: s390: Don't use %pK through tracepoints +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 6c9567e0850be2f0f94ab64fa6512413fd1a1eb1 ] + +Restricted pointers ("%pK") are not meant to be used through TP_format(). +It can unintentionally expose security sensitive, raw pointer values. + +Use regular pointer formatting instead. + +Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ +Signed-off-by: Thomas Weißschuh +Reviewed-by: Michael Mueller +Link: https://lore.kernel.org/r/20250217-restricted-pointers-s390-v1-1-0e4ace75d8aa@linutronix.de +Signed-off-by: Janosch Frank +Message-ID: <20250217-restricted-pointers-s390-v1-1-0e4ace75d8aa@linutronix.de> +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/trace-s390.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kvm/trace-s390.h b/arch/s390/kvm/trace-s390.h +index 6f0209d45164f..9c5f546a2e1a3 100644 +--- a/arch/s390/kvm/trace-s390.h ++++ b/arch/s390/kvm/trace-s390.h +@@ -56,7 +56,7 @@ TRACE_EVENT(kvm_s390_create_vcpu, + __entry->sie_block = sie_block; + ), + +- TP_printk("create cpu %d at 0x%pK, sie block at 0x%pK", ++ TP_printk("create cpu %d at 0x%p, sie block at 0x%p", + __entry->id, __entry->vcpu, __entry->sie_block) + ); + +@@ -255,7 +255,7 @@ TRACE_EVENT(kvm_s390_enable_css, + __entry->kvm = kvm; + ), + +- TP_printk("enabling channel I/O support (kvm @ %pK)\n", ++ TP_printk("enabling channel I/O support (kvm @ %p)\n", + __entry->kvm) + ); + +-- +2.39.5 + diff --git a/queue-5.4/md-raid1-add-check-for-missing-source-disk-in-proces.patch b/queue-5.4/md-raid1-add-check-for-missing-source-disk-in-proces.patch new file mode 100644 index 0000000000..b83fb160e6 --- /dev/null +++ b/queue-5.4/md-raid1-add-check-for-missing-source-disk-in-proces.patch @@ -0,0 +1,77 @@ +From 5ddb6a0a982bb65fd083bfd0641166345464489b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 17:38:08 +0300 +Subject: md/raid1: Add check for missing source disk in process_checks() + +From: Meir Elisha + +[ Upstream commit b7c178d9e57c8fd4238ff77263b877f6f16182ba ] + +During recovery/check operations, the process_checks function loops +through available disks to find a 'primary' source with successfully +read data. + +If no suitable source disk is found after checking all possibilities, +the 'primary' index will reach conf->raid_disks * 2. Add an explicit +check for this condition after the loop. If no source disk was found, +print an error message and return early to prevent further processing +without a valid primary source. + +Link: https://lore.kernel.org/linux-raid/20250408143808.1026534-1-meir.elisha@volumez.com +Signed-off-by: Meir Elisha +Suggested-and-reviewed-by: Yu Kuai +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index c40237cfdcb0f..395a279e2c885 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2051,14 +2051,9 @@ static int fix_sync_read_error(struct r1bio *r1_bio) + if (!rdev_set_badblocks(rdev, sect, s, 0)) + abort = 1; + } +- if (abort) { +- conf->recovery_disabled = +- mddev->recovery_disabled; +- set_bit(MD_RECOVERY_INTR, &mddev->recovery); +- md_done_sync(mddev, r1_bio->sectors, 0); +- put_buf(r1_bio); ++ if (abort) + return 0; +- } ++ + /* Try next page */ + sectors -= s; + sect += s; +@@ -2198,10 +2193,21 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio) + int disks = conf->raid_disks * 2; + struct bio *wbio; + +- if (!test_bit(R1BIO_Uptodate, &r1_bio->state)) +- /* ouch - failed to read all of that. */ +- if (!fix_sync_read_error(r1_bio)) ++ if (!test_bit(R1BIO_Uptodate, &r1_bio->state)) { ++ /* ++ * ouch - failed to read all of that. ++ * No need to fix read error for check/repair ++ * because all member disks are read. ++ */ ++ if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) || ++ !fix_sync_read_error(r1_bio)) { ++ conf->recovery_disabled = mddev->recovery_disabled; ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); ++ md_done_sync(mddev, r1_bio->sectors, 0); ++ put_buf(r1_bio); + return; ++ } ++ } + + if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) + process_checks(r1_bio); +-- +2.39.5 + diff --git a/queue-5.4/mips-cm-detect-cm-quirks-from-device-tree.patch b/queue-5.4/mips-cm-detect-cm-quirks-from-device-tree.patch new file mode 100644 index 0000000000..0a51fd3a1b --- /dev/null +++ b/queue-5.4/mips-cm-detect-cm-quirks-from-device-tree.patch @@ -0,0 +1,107 @@ +From 738dec51943399206135b38fda452ded2a4082a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 12:01:56 +0100 +Subject: MIPS: cm: Detect CM quirks from device tree + +From: Gregory CLEMENT + +[ Upstream commit e27fbe16af5cfc40639de4ced67d1a866a1953e9 ] + +Some information that should be retrieved at runtime for the Coherence +Manager can be either absent or wrong. This patch allows checking if +some of this information is available from the device tree and updates +the internal variable accordingly. + +For now, only the compatible string associated with the broken HCI is +being retrieved. + +Signed-off-by: Gregory CLEMENT +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mips-cm.h | 22 ++++++++++++++++++++++ + arch/mips/kernel/mips-cm.c | 14 ++++++++++++++ + 2 files changed, 36 insertions(+) + +diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h +index 696b40beb774f..0f31324998c0a 100644 +--- a/arch/mips/include/asm/mips-cm.h ++++ b/arch/mips/include/asm/mips-cm.h +@@ -47,6 +47,16 @@ extern phys_addr_t __mips_cm_phys_base(void); + */ + extern int mips_cm_is64; + ++/* ++ * mips_cm_is_l2_hci_broken - determine if HCI is broken ++ * ++ * Some CM reports show that Hardware Cache Initialization is ++ * complete, but in reality it's not the case. They also incorrectly ++ * indicate that Hardware Cache Initialization is supported. This ++ * flags allows warning about this broken feature. ++ */ ++extern bool mips_cm_is_l2_hci_broken; ++ + /** + * mips_cm_error_report - Report CM cache errors + */ +@@ -85,6 +95,18 @@ static inline bool mips_cm_present(void) + #endif + } + ++/** ++ * mips_cm_update_property - update property from the device tree ++ * ++ * Retrieve the properties from the device tree if a CM node exist and ++ * update the internal variable based on this. ++ */ ++#ifdef CONFIG_MIPS_CM ++extern void mips_cm_update_property(void); ++#else ++static void mips_cm_update_property(void) {} ++#endif ++ + /** + * mips_cm_has_l2sync - determine whether an L2-only sync region is present + * +diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c +index 611ef512c0b81..159354ac9335b 100644 +--- a/arch/mips/kernel/mips-cm.c ++++ b/arch/mips/kernel/mips-cm.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + +@@ -14,6 +15,7 @@ + void __iomem *mips_gcr_base; + void __iomem *mips_cm_l2sync_base; + int mips_cm_is64; ++bool mips_cm_is_l2_hci_broken; + + static char *cm2_tr[8] = { + "mem", "gcr", "gic", "mmio", +@@ -196,6 +198,18 @@ static void mips_cm_probe_l2sync(void) + mips_cm_l2sync_base = ioremap_nocache(addr, MIPS_CM_L2SYNC_SIZE); + } + ++void mips_cm_update_property(void) ++{ ++ struct device_node *cm_node; ++ ++ cm_node = of_find_compatible_node(of_root, NULL, "mobileye,eyeq6-cm"); ++ if (!cm_node) ++ return; ++ pr_info("HCI (Hardware Cache Init for the L2 cache) in GCR_L2_RAM_CONFIG from the CM3 is broken"); ++ mips_cm_is_l2_hci_broken = true; ++ of_node_put(cm_node); ++} ++ + int mips_cm_probe(void) + { + phys_addr_t addr; +-- +2.39.5 + diff --git a/queue-5.4/ntb-reduce-stack-usage-in-idt_scan_mws.patch b/queue-5.4/ntb-reduce-stack-usage-in-idt_scan_mws.patch new file mode 100644 index 0000000000..8d874f17d0 --- /dev/null +++ b/queue-5.4/ntb-reduce-stack-usage-in-idt_scan_mws.patch @@ -0,0 +1,77 @@ +From 24d74a044100955ebf6a5abbc22bdf81ec2d1d76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2025 09:57:25 +0100 +Subject: ntb: reduce stack usage in idt_scan_mws + +From: Arnd Bergmann + +[ Upstream commit aff12700b8dd7422bfe2277696e192af4df9de8f ] + +idt_scan_mws() puts a large fixed-size array on the stack and copies +it into a smaller dynamically allocated array at the end. On 32-bit +targets, the fixed size can easily exceed the warning limit for +possible stack overflow: + +drivers/ntb/hw/idt/ntb_hw_idt.c:1041:27: error: stack frame size (1032) exceeds limit (1024) in 'idt_scan_mws' [-Werror,-Wframe-larger-than] + +Change it to instead just always use dynamic allocation for the +array from the start. It's too big for the stack, but not actually +all that much for a permanent allocation. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/all/202205111109.PiKTruEj-lkp@intel.com/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Dave Jiang +Reviewed-by: Damien Le Moal +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/idt/ntb_hw_idt.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c +index a0091900b0cfb..c74d958ffc62f 100644 +--- a/drivers/ntb/hw/idt/ntb_hw_idt.c ++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c +@@ -1041,7 +1041,7 @@ static inline char *idt_get_mw_name(enum idt_mw_type mw_type) + static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, + unsigned char *mw_cnt) + { +- struct idt_mw_cfg mws[IDT_MAX_NR_MWS], *ret_mws; ++ struct idt_mw_cfg *mws; + const struct idt_ntb_bar *bars; + enum idt_mw_type mw_type; + unsigned char widx, bidx, en_cnt; +@@ -1049,6 +1049,11 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, + int aprt_size; + u32 data; + ++ mws = devm_kcalloc(&ndev->ntb.pdev->dev, IDT_MAX_NR_MWS, ++ sizeof(*mws), GFP_KERNEL); ++ if (!mws) ++ return ERR_PTR(-ENOMEM); ++ + /* Retrieve the array of the BARs registers */ + bars = portdata_tbl[port].bars; + +@@ -1103,16 +1108,7 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, + } + } + +- /* Allocate memory for memory window descriptors */ +- ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws), +- GFP_KERNEL); +- if (!ret_mws) +- return ERR_PTR(-ENOMEM); +- +- /* Copy the info of detected memory windows */ +- memcpy(ret_mws, mws, (*mw_cnt)*sizeof(*ret_mws)); +- +- return ret_mws; ++ return mws; + } + + /* +-- +2.39.5 + diff --git a/queue-5.4/parisc-pdt-fix-missing-prototype-warning.patch b/queue-5.4/parisc-pdt-fix-missing-prototype-warning.patch new file mode 100644 index 0000000000..8ad69c2fa3 --- /dev/null +++ b/queue-5.4/parisc-pdt-fix-missing-prototype-warning.patch @@ -0,0 +1,51 @@ +From 6e41f36c21d4fee8370e0b843ac41eecceb9439d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 01:43:04 +0800 +Subject: parisc: PDT: Fix missing prototype warning + +From: Yu-Chun Lin + +[ Upstream commit b899981750dcb958ceffa4462d903963ee494aa2 ] + +As reported by the kernel test robot, the following error occurs: + +arch/parisc/kernel/pdt.c:65:6: warning: no previous prototype for 'arch_report_meminfo' [-Wmissing-prototypes] + 65 | void arch_report_meminfo(struct seq_file *m) + | ^~~~~~~~~~~~~~~~~~~ + +arch_report_meminfo() is declared in include/linux/proc_fs.h and only +defined when CONFIG_PROC_FS is enabled. Wrap its definition in #ifdef +CONFIG_PROC_FS to fix the -Wmissing-prototypes warning. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202502082315.IPaHaTyM-lkp@intel.com/ +Signed-off-by: Yu-Chun Lin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/pdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/parisc/kernel/pdt.c b/arch/parisc/kernel/pdt.c +index 36434d4da381a..d1c980900cdd4 100644 +--- a/arch/parisc/kernel/pdt.c ++++ b/arch/parisc/kernel/pdt.c +@@ -60,6 +60,7 @@ static unsigned long pdt_entry[MAX_PDT_ENTRIES] __page_aligned_bss; + #define PDT_ADDR_PERM_ERR (pdt_type != PDT_PDC ? 2UL : 0UL) + #define PDT_ADDR_SINGLE_ERR 1UL + ++#ifdef CONFIG_PROC_FS + /* report PDT entries via /proc/meminfo */ + void arch_report_meminfo(struct seq_file *m) + { +@@ -71,6 +72,7 @@ void arch_report_meminfo(struct seq_file *m) + seq_printf(m, "PDT_cur_entries: %7lu\n", + pdt_status.pdt_entries); + } ++#endif + + static int get_info_pat_new(void) + { +-- +2.39.5 + diff --git a/queue-5.4/qibfs-fix-_another_-leak.patch b/queue-5.4/qibfs-fix-_another_-leak.patch new file mode 100644 index 0000000000..f9f3d1384b --- /dev/null +++ b/queue-5.4/qibfs-fix-_another_-leak.patch @@ -0,0 +1,36 @@ +From 96ba862010e37cf111997186a1e98b4fda93dde3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 17:50:34 -0600 +Subject: qibfs: fix _another_ leak + +From: Al Viro + +[ Upstream commit bdb43af4fdb39f844ede401bdb1258f67a580a27 ] + +failure to allocate inode => leaked dentry... + +this one had been there since the initial merge; to be fair, +if we are that far OOM, the odds of failing at that particular +allocation are low... + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qib/qib_fs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c +index e336d778e076e..5ec67e3c2d03c 100644 +--- a/drivers/infiniband/hw/qib/qib_fs.c ++++ b/drivers/infiniband/hw/qib/qib_fs.c +@@ -56,6 +56,7 @@ static int qibfs_mknod(struct inode *dir, struct dentry *dentry, + struct inode *inode = new_inode(dir->i_sb); + + if (!inode) { ++ dput(dentry); + error = -EPERM; + goto bail; + } +-- +2.39.5 + diff --git a/queue-5.4/sched-isolation-make-config_cpu_isolation-depend-on-.patch b/queue-5.4/sched-isolation-make-config_cpu_isolation-depend-on-.patch new file mode 100644 index 0000000000..44b87b1247 --- /dev/null +++ b/queue-5.4/sched-isolation-make-config_cpu_isolation-depend-on-.patch @@ -0,0 +1,46 @@ +From 6417038c52bd410d3388d7ff18510e8f26f22d39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 15:49:55 +0200 +Subject: sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP + +From: Oleg Nesterov + +[ Upstream commit 975776841e689dd8ba36df9fa72ac3eca3c2957a ] + +kernel/sched/isolation.c obviously makes no sense without CONFIG_SMP, but +the Kconfig entry we have right now: + + config CPU_ISOLATION + bool "CPU isolation" + depends on SMP || COMPILE_TEST + +allows the creation of pointless .config's which cause +build failures. + +Reported-by: kernel test robot +Signed-off-by: Oleg Nesterov +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20250330134955.GA7910@redhat.com + +Closes: https://lore.kernel.org/oe-kbuild-all/202503260646.lrUqD3j5-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + init/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/init/Kconfig b/init/Kconfig +index 293da9b0bea6b..41e87e8a5c6c1 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -559,7 +559,7 @@ endmenu # "CPU/Task time and stats accounting" + + config CPU_ISOLATION + bool "CPU isolation" +- depends on SMP || COMPILE_TEST ++ depends on SMP + default y + help + Make sure that CPUs running critical tasks are not disturbed by +-- +2.39.5 + diff --git a/queue-5.4/scsi-pm80xx-set-phy_attached-to-zero-when-device-is-.patch b/queue-5.4/scsi-pm80xx-set-phy_attached-to-zero-when-device-is-.patch new file mode 100644 index 0000000000..a1facd081d --- /dev/null +++ b/queue-5.4/scsi-pm80xx-set-phy_attached-to-zero-when-device-is-.patch @@ -0,0 +1,36 @@ +From ab95dcca4387fa31d9c024ce38cdc521a4eedcff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 23:03:05 +0000 +Subject: scsi: pm80xx: Set phy_attached to zero when device is gone + +From: Igor Pylypiv + +[ Upstream commit f7b705c238d1483f0a766e2b20010f176e5c0fb7 ] + +When a fatal error occurs, a phy down event may not be received to set +phy->phy_attached to zero. + +Signed-off-by: Igor Pylypiv +Signed-off-by: Salomon Dushimirimana +Link: https://lore.kernel.org/r/20250319230305.3172920-1-salomondush@google.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 36f5bab09f73e..1215fc36862da 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -893,6 +893,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + PM8001_DISC_DBG(pm8001_ha, +-- +2.39.5 + diff --git a/queue-5.4/selftests-ublk-fix-test_stripe_04.patch b/queue-5.4/selftests-ublk-fix-test_stripe_04.patch new file mode 100644 index 0000000000..599dd56a9f --- /dev/null +++ b/queue-5.4/selftests-ublk-fix-test_stripe_04.patch @@ -0,0 +1,58 @@ +From c19cd9808d6321a73f29e4919d3bfd2d7bb81c5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 08:18:49 +0800 +Subject: selftests: ublk: fix test_stripe_04 + +From: Ming Lei + +[ Upstream commit 72070e57b0a518ec8e562a2b68fdfc796ef5c040 ] + +Commit 57ed58c13256 ("selftests: ublk: enable zero copy for stripe target") +added test entry of test_stripe_04, but forgot to add the test script. + +So fix the test by adding the script file. + +Reported-by: Uday Shankar +Signed-off-by: Ming Lei +Reviewed-by: Uday Shankar +Link: https://lore.kernel.org/r/20250404001849.1443064-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + .../testing/selftests/ublk/test_stripe_04.sh | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + create mode 100755 tools/testing/selftests/ublk/test_stripe_04.sh + +diff --git a/tools/testing/selftests/ublk/test_stripe_04.sh b/tools/testing/selftests/ublk/test_stripe_04.sh +new file mode 100755 +index 0000000000000..1f2b642381d17 +--- /dev/null ++++ b/tools/testing/selftests/ublk/test_stripe_04.sh +@@ -0,0 +1,24 @@ ++#!/bin/bash ++# SPDX-License-Identifier: GPL-2.0 ++ ++. "$(cd "$(dirname "$0")" && pwd)"/test_common.sh ++ ++TID="stripe_04" ++ERR_CODE=0 ++ ++_prep_test "stripe" "mkfs & mount & umount on zero copy" ++ ++backfile_0=$(_create_backfile 256M) ++backfile_1=$(_create_backfile 256M) ++dev_id=$(_add_ublk_dev -t stripe -z -q 2 "$backfile_0" "$backfile_1") ++_check_add_dev $TID $? "$backfile_0" "$backfile_1" ++ ++_mkfs_mount_test /dev/ublkb"${dev_id}" ++ERR_CODE=$? ++ ++_cleanup_test "stripe" ++ ++_remove_backfile "$backfile_0" ++_remove_backfile "$backfile_1" ++ ++_show_result $TID $ERR_CODE +-- +2.39.5 + diff --git a/queue-5.4/series b/queue-5.4/series index eef501572a..5f8ac47164 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -157,3 +157,21 @@ usb-dwc3-gadget-check-that-event-count-does-not-exceed-event-buffer-length.patch usb-quirks-add-delay_init-quirk-for-silicon-motion-flash-drive.patch usb-quirks-add-delay-init-quirk-for-sandisk-3.2gen1-flash-drive.patch usb-vli-disk-crashes-if-lpm-is-used.patch +mips-cm-detect-cm-quirks-from-device-tree.patch +crypto-null-use-spin-lock-instead-of-mutex.patch +clk-check-for-disabled-clock-provider-in-of_clk_get_.patch +parisc-pdt-fix-missing-prototype-warning.patch +x86-kconfig-make-config_pci_cnb20le_quirk-depend-on-.patch +usb-host-max3421-hcd-add-missing-spi_device_id-table.patch +dmaengine-dmatest-fix-dmatest-waiting-less-when-inte.patch +usb-gadget-aspeed-add-null-pointer-check-in-ast_vhub.patch +qibfs-fix-_another_-leak.patch +ntb-reduce-stack-usage-in-idt_scan_mws.patch +sched-isolation-make-config_cpu_isolation-depend-on-.patch +kvm-s390-don-t-use-pk-through-tracepoints.patch +udmabuf-fix-a-buf-size-overflow-issue-during-udmabuf.patch +selftests-ublk-fix-test_stripe_04.patch +acpi-pptt-fix-coding-mistakes-in-a-couple-of-sizeof-.patch +x86-bugs-don-t-fill-rsb-on-vmexit-with-eibrs-retpoli.patch +scsi-pm80xx-set-phy_attached-to-zero-when-device-is-.patch +md-raid1-add-check-for-missing-source-disk-in-proces.patch diff --git a/queue-5.4/udmabuf-fix-a-buf-size-overflow-issue-during-udmabuf.patch b/queue-5.4/udmabuf-fix-a-buf-size-overflow-issue-during-udmabuf.patch new file mode 100644 index 0000000000..6056d7dc0f --- /dev/null +++ b/queue-5.4/udmabuf-fix-a-buf-size-overflow-issue-during-udmabuf.patch @@ -0,0 +1,38 @@ +From 0518646923218d20dceb6924cd54dd9ba6bcfb87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 11:41:26 -0500 +Subject: udmabuf: fix a buf size overflow issue during udmabuf creation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaogang Chen + +[ Upstream commit 021ba7f1babd029e714d13a6bf2571b08af96d0f ] + +by casting size_limit_mb to u64 when calculate pglimit. + +Signed-off-by: Xiaogang Chen +Link: https://patchwork.freedesktop.org/patch/msgid/20250321164126.329638-1-xiaogang.chen@amd.com +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/udmabuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index ae42e98cf8350..dfb572282097b 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -138,7 +138,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head, + if (!ubuf) + return -ENOMEM; + +- pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; ++ pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; + for (i = 0; i < head->count; i++) { + if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) + goto err; +-- +2.39.5 + diff --git a/queue-5.4/usb-gadget-aspeed-add-null-pointer-check-in-ast_vhub.patch b/queue-5.4/usb-gadget-aspeed-add-null-pointer-check-in-ast_vhub.patch new file mode 100644 index 0000000000..2d1a019892 --- /dev/null +++ b/queue-5.4/usb-gadget-aspeed-add-null-pointer-check-in-ast_vhub.patch @@ -0,0 +1,41 @@ +From 92a78a83c87ce82c463f59f2641d86270d350303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 20:27:05 -0500 +Subject: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() + +From: Chenyuan Yang + +[ Upstream commit 8c75f3e6a433d92084ad4e78b029ae680865420f ] + +The variable d->name, returned by devm_kasprintf(), could be NULL. +A pointer check is added to prevent potential NULL pointer dereference. +This is similar to the fix in commit 3027e7b15b02 +("ice: Fix some null pointer dereference issues in ice_ptp.c"). + +This issue is found by our static analysis tool + +Signed-off-by: Chenyuan Yang +Link: https://lore.kernel.org/r/20250311012705.1233829-1-chenyuan0y@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/aspeed-vhub/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/udc/aspeed-vhub/dev.c b/drivers/usb/gadget/udc/aspeed-vhub/dev.c +index 4008e7a511889..89d7d3b24718d 100644 +--- a/drivers/usb/gadget/udc/aspeed-vhub/dev.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/dev.c +@@ -542,6 +542,9 @@ int ast_vhub_init_dev(struct ast_vhub *vhub, unsigned int idx) + d->vhub = vhub; + d->index = idx; + d->name = devm_kasprintf(parent, GFP_KERNEL, "port%d", idx+1); ++ if (!d->name) ++ return -ENOMEM; ++ + d->regs = vhub->regs + 0x100 + 0x10 * idx; + + ast_vhub_init_ep0(vhub, &d->ep0, d); +-- +2.39.5 + diff --git a/queue-5.4/usb-host-max3421-hcd-add-missing-spi_device_id-table.patch b/queue-5.4/usb-host-max3421-hcd-add-missing-spi_device_id-table.patch new file mode 100644 index 0000000000..901577eac4 --- /dev/null +++ b/queue-5.4/usb-host-max3421-hcd-add-missing-spi_device_id-table.patch @@ -0,0 +1,51 @@ +From 87a227c46d2e141aea68a5945c86b0d8be0452f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 20:51:13 +0100 +Subject: usb: host: max3421-hcd: Add missing spi_device_id table + +From: Alexander Stein + +[ Upstream commit 41d5e3806cf589f658f92c75195095df0b66f66a ] + +"maxim,max3421" DT compatible is missing its SPI device ID entry, not +allowing module autoloading and leading to the following message: + "SPI driver max3421-hcd has no spi_device_id for maxim,max3421" + +Fix this by adding the spi_device_id table. + +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250128195114.56321-1-alexander.stein@mailbox.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 0a5e0e6449826..5a21777197e95 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1956,6 +1956,12 @@ max3421_remove(struct spi_device *spi) + return 0; + } + ++static const struct spi_device_id max3421_spi_ids[] = { ++ { "max3421" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, max3421_spi_ids); ++ + static const struct of_device_id max3421_of_match_table[] = { + { .compatible = "maxim,max3421", }, + {}, +@@ -1965,6 +1971,7 @@ MODULE_DEVICE_TABLE(of, max3421_of_match_table); + static struct spi_driver max3421_driver = { + .probe = max3421_probe, + .remove = max3421_remove, ++ .id_table = max3421_spi_ids, + .driver = { + .name = "max3421-hcd", + .of_match_table = of_match_ptr(max3421_of_match_table), +-- +2.39.5 + diff --git a/queue-5.4/x86-bugs-don-t-fill-rsb-on-vmexit-with-eibrs-retpoli.patch b/queue-5.4/x86-bugs-don-t-fill-rsb-on-vmexit-with-eibrs-retpoli.patch new file mode 100644 index 0000000000..d25c5fcce8 --- /dev/null +++ b/queue-5.4/x86-bugs-don-t-fill-rsb-on-vmexit-with-eibrs-retpoli.patch @@ -0,0 +1,64 @@ +From 64d1a55bf7171672d0b86e760e18bf22b1276fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 14:47:33 -0700 +Subject: x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline + +From: Josh Poimboeuf + +[ Upstream commit 18bae0dfec15b24ec14ca17dc18603372f5f254f ] + +eIBRS protects against guest->host RSB underflow/poisoning attacks. +Adding retpoline to the mix doesn't change that. Retpoline has a +balanced CALL/RET anyway. + +So the current full RSB filling on VMEXIT with eIBRS+retpoline is +overkill. Disable it or do the VMEXIT_LITE mitigation if needed. + +Suggested-by: Pawan Gupta +Signed-off-by: Josh Poimboeuf +Signed-off-by: Ingo Molnar +Reviewed-by: Pawan Gupta +Reviewed-by: Amit Shah +Reviewed-by: Nikolay Borisov +Cc: Paolo Bonzini +Cc: Vitaly Kuznetsov +Cc: Sean Christopherson +Cc: David Woodhouse +Link: https://lore.kernel.org/r/84a1226e5c9e2698eae1b5ade861f1b8bf3677dc.1744148254.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/bugs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index af748d1c78d41..4f803aed2ef0e 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -1348,20 +1348,20 @@ static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_ + case SPECTRE_V2_NONE: + return; + +- case SPECTRE_V2_EIBRS_LFENCE: + case SPECTRE_V2_EIBRS: ++ case SPECTRE_V2_EIBRS_LFENCE: ++ case SPECTRE_V2_EIBRS_RETPOLINE: + if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { +- setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); + pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n"); ++ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); + } + return; + +- case SPECTRE_V2_EIBRS_RETPOLINE: + case SPECTRE_V2_RETPOLINE: + case SPECTRE_V2_LFENCE: + case SPECTRE_V2_IBRS: +- setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT); + pr_info("Spectre v2 / SpectreRSB : Filling RSB on VMEXIT\n"); ++ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT); + return; + } + +-- +2.39.5 + diff --git a/queue-5.4/x86-kconfig-make-config_pci_cnb20le_quirk-depend-on-.patch b/queue-5.4/x86-kconfig-make-config_pci_cnb20le_quirk-depend-on-.patch new file mode 100644 index 0000000000..6fcefcc244 --- /dev/null +++ b/queue-5.4/x86-kconfig-make-config_pci_cnb20le_quirk-depend-on-.patch @@ -0,0 +1,97 @@ +From e5c38789e5375232651a9fc4372ba3b4ccc61d0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 21:48:48 +0100 +Subject: x86/Kconfig: Make CONFIG_PCI_CNB20LE_QUIRK depend on X86_32 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mateusz Jończyk + +[ Upstream commit d9f87802676bb23b9425aea8ad95c76ad9b50c6e ] + +I was unable to find a good description of the ServerWorks CNB20LE +chipset. However, it was probably exclusively used with the Pentium III +processor (this CPU model was used in all references to it that I +found where the CPU model was provided: dmesgs in [1] and [2]; +[3] page 2; [4]-[7]). + +As is widely known, the Pentium III processor did not support the 64-bit +mode, support for which was introduced by Intel a couple of years later. +So it is safe to assume that no systems with the CNB20LE chipset have +amd64 and the CONFIG_PCI_CNB20LE_QUIRK may now depend on X86_32. + +Additionally, I have determined that most computers with the CNB20LE +chipset did have ACPI support and this driver was inactive on them. +I have submitted a patch to remove this driver, but it was met with +resistance [8]. + +[1] Jim Studt, Re: Problem with ServerWorks CNB20LE and lost interrupts + Linux Kernel Mailing List, https://lkml.org/lkml/2002/1/11/111 + +[2] RedHat Bug 665109 - e100 problems on old Compaq Proliant DL320 + https://bugzilla.redhat.com/show_bug.cgi?id=665109 + +[3] R. Hughes-Jones, S. Dallison, G. Fairey, Performance Measurements on + Gigabit Ethernet NICs and Server Quality Motherboards, + http://datatag.web.cern.ch/papers/pfldnet2003-rhj.doc + +[4] "Hardware for Linux", + Probe #d6b5151873 of Intel STL2-bd A28808-302 Desktop Computer (STL2) + https://linux-hardware.org/?probe=d6b5151873 + +[5] "Hardware for Linux", Probe #0b5d843f10 of Compaq ProLiant DL380 + https://linux-hardware.org/?probe=0b5d843f10 + +[6] Ubuntu Forums, Dell Poweredge 2400 - Adaptec SCSI Bus AIC-7880 + https://ubuntuforums.org/showthread.php?t=1689552 + +[7] Ira W. Snyder, "BISECTED: 2.6.35 (and -git) fail to boot: APIC problems" + https://lkml.org/lkml/2010/8/13/220 + +[8] Bjorn Helgaas, "Re: [PATCH] x86/pci: drop ServerWorks / Broadcom + CNB20LE PCI host bridge driver" + https://lore.kernel.org/lkml/20220318165535.GA840063@bhelgaas/T/ + +Signed-off-by: Mateusz Jończyk +Signed-off-by: David Heideberg +Signed-off-by: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250321-x86_x2apic-v3-6-b0cbaa6fa338@ixit.cz +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index e92b5eb57acd7..75e72d407b9b4 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2743,13 +2743,21 @@ config MMCONF_FAM10H + depends on X86_64 && PCI_MMCONFIG && ACPI + + config PCI_CNB20LE_QUIRK +- bool "Read CNB20LE Host Bridge Windows" if EXPERT +- depends on PCI ++ bool "Read PCI host bridge windows from the CNB20LE chipset" if EXPERT ++ depends on X86_32 && PCI + help + Read the PCI windows out of the CNB20LE host bridge. This allows + PCI hotplug to work on systems with the CNB20LE chipset which do + not have ACPI. + ++ The ServerWorks (later Broadcom) CNB20LE was a chipset designed ++ most probably only for Pentium III. ++ ++ To find out if you have such a chipset, search for a PCI device with ++ 1166:0009 PCI IDs, for example by executing ++ lspci -nn | grep '1166:0009' ++ The code is inactive if there is none. ++ + There's no public spec for this chipset, and this functionality + is known to be incomplete. + +-- +2.39.5 + -- 2.47.3