--- /dev/null
+From 3fe1e15cb12957ef340dfcf662146f6f76d457cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 15:59:39 +0100
+Subject: i2c: i801: Fix block process call transactions
+
+From: Jean Delvare <jdelvare@suse.de>
+
+[ Upstream commit c1c9d0f6f7f1dbf29db996bd8e166242843a5f21 ]
+
+According to the Intel datasheets, software must reset the block
+buffer index twice for block process call transactions: once before
+writing the outgoing data to the buffer, and once again before
+reading the incoming data from the buffer.
+
+The driver is currently missing the second reset, causing the wrong
+portion of the block buffer to be read.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Reported-by: Piotr Zakowski <piotr.zakowski@intel.com>
+Closes: https://lore.kernel.org/linux-i2c/20240213120553.7b0ab120@endymion.delvare/
+Fixes: 315cd67c9453 ("i2c: i801: Add Block Write-Block Read Process Call support")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 8ecba1ca9236..87c2c7c84736 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -522,11 +522,10 @@ static int i801_block_transaction_by_block(struct i801_priv *priv,
+ /* Set block buffer mode */
+ outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv));
+
+- inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+-
+ if (read_write == I2C_SMBUS_WRITE) {
+ len = data->block[0];
+ outb_p(len, SMBHSTDAT0(priv));
++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+ for (i = 0; i < len; i++)
+ outb_p(data->block[i+1], SMBBLKDAT(priv));
+ }
+@@ -542,6 +541,7 @@ static int i801_block_transaction_by_block(struct i801_priv *priv,
+ return -EPROTO;
+
+ data->block[0] = len;
++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+ for (i = 0; i < len; i++)
+ data->block[i + 1] = inb_p(SMBBLKDAT(priv));
+ }
+--
+2.43.0
+
--- /dev/null
+From 2b02824a5df4ba695251b2f5769ac4b7239ce057 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 23:58:17 +0100
+Subject: i2c: i801: Remove i801_set_block_buffer_mode
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 1e1d6582f483a4dba4ea03445e6f2f05d9de5bcf ]
+
+If FEATURE_BLOCK_BUFFER is set then bit SMBAUXCTL_E32B is supported
+and there's no benefit in reading it back. Origin of this check
+seems to be 14 yrs ago when people were not completely sure which
+chip versions support the block buffer mode.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Tested-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: c1c9d0f6f7f1 ("i2c: i801: Fix block process call transactions")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 30b725d11178..8ecba1ca9236 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -519,9 +519,11 @@ static int i801_block_transaction_by_block(struct i801_priv *priv,
+ return -EOPNOTSUPP;
+ }
+
++ /* Set block buffer mode */
++ outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv));
++
+ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+
+- /* Use 32-byte buffer to process this transaction */
+ if (read_write == I2C_SMBUS_WRITE) {
+ len = data->block[0];
+ outb_p(len, SMBHSTDAT0(priv));
+@@ -747,14 +749,6 @@ static int i801_block_transaction_byte_by_byte(struct i801_priv *priv,
+ return i801_check_post(priv, status);
+ }
+
+-static int i801_set_block_buffer_mode(struct i801_priv *priv)
+-{
+- outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv));
+- if ((inb_p(SMBAUXCTL(priv)) & SMBAUXCTL_E32B) == 0)
+- return -EIO;
+- return 0;
+-}
+-
+ /* Block transaction function */
+ static int i801_block_transaction(struct i801_priv *priv, union i2c_smbus_data *data,
+ char read_write, int command)
+@@ -783,9 +777,8 @@ static int i801_block_transaction(struct i801_priv *priv, union i2c_smbus_data *
+ /* Experience has shown that the block buffer can only be used for
+ SMBus (not I2C) block transactions, even though the datasheet
+ doesn't mention this limitation. */
+- if ((priv->features & FEATURE_BLOCK_BUFFER)
+- && command != I2C_SMBUS_I2C_BLOCK_DATA
+- && i801_set_block_buffer_mode(priv) == 0)
++ if ((priv->features & FEATURE_BLOCK_BUFFER) &&
++ command != I2C_SMBUS_I2C_BLOCK_DATA)
+ result = i801_block_transaction_by_block(priv, data,
+ read_write,
+ command);
+--
+2.43.0
+
--- /dev/null
+From eeb2ef0b150ab686a91f55f17ee29729b775ef70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 09:14:19 +0100
+Subject: media: ir_toy: fix a memleak in irtoy_tx
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit dc9ceb90c4b42c6e5c6757df1d6257110433788e ]
+
+When irtoy_command fails, buf should be freed since it is allocated by
+irtoy_tx, or there is a memleak.
+
+Fixes: 4114978dcd24 ("media: ir_toy: prevent device from hanging during transmit")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/ir_toy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
+index 53ae19fa103a..658d27d29048 100644
+--- a/drivers/media/rc/ir_toy.c
++++ b/drivers/media/rc/ir_toy.c
+@@ -324,6 +324,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
+ sizeof(COMMAND_SMODE_EXIT), STATE_RESET);
+ if (err) {
+ dev_err(irtoy->dev, "exit sample mode: %d\n", err);
++ kfree(buf);
+ return err;
+ }
+
+@@ -331,6 +332,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
+ sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND);
+ if (err) {
+ dev_err(irtoy->dev, "enter sample mode: %d\n", err);
++ kfree(buf);
+ return err;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 74aa9b5ced9d28e0159f38f44fd983368896fb79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:14:07 +0100
+Subject: modpost: trim leading spaces when processing source files list
+
+From: Radek Krejci <radek.krejci@oracle.com>
+
+[ Upstream commit 5d9a16b2a4d9e8fa028892ded43f6501bc2969e5 ]
+
+get_line() does not trim the leading spaces, but the
+parse_source_files() expects to get lines with source files paths where
+the first space occurs after the file path.
+
+Fixes: 70f30cfe5b89 ("modpost: use read_text_file() and get_line() for reading text files")
+Signed-off-by: Radek Krejci <radek.krejci@oracle.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/sumversion.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
+index 905c0ec291e1..e6962678032e 100644
+--- a/scripts/mod/sumversion.c
++++ b/scripts/mod/sumversion.c
+@@ -328,7 +328,12 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
+
+ /* Sum all files in the same dir or subdirs. */
+ while ((line = get_line(&pos))) {
+- char* p = line;
++ char* p;
++
++ /* trim the leading spaces away */
++ while (isspace(*line))
++ line++;
++ p = line;
+
+ if (strncmp(line, "source_", sizeof("source_")-1) == 0) {
+ p = strrchr(line, ' ');
+--
+2.43.0
+
--- /dev/null
+From f8b3cbb2b94fee115afddb75897d25edc8bd6c30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 11:38:38 +0100
+Subject: powerpc/6xx: set High BAT Enable flag on G2_LE cores
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit a038a3ff8c6582404834852c043dadc73a5b68b4 ]
+
+MMU_FTR_USE_HIGH_BATS is set for G2_LE cores and derivatives like e300cX,
+but the high BATs need to be enabled in HID2 to work. Add register
+definitions and add the needed setup to __setup_cpu_603.
+
+This fixes boot on CPUs like the MPC5200B with STRICT_KERNEL_RWX enabled
+on systems where the flag has not been set by the bootloader already.
+
+Fixes: e4d6654ebe6e ("powerpc/mm/32s: rework mmu_mapin_ram()")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240124103838.43675-1-matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/reg.h | 2 ++
+ arch/powerpc/kernel/cpu_setup_6xx.S | 20 +++++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index e9d27265253b..6a982aee50c8 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -611,6 +611,8 @@
+ #endif
+ #define SPRN_HID2 0x3F8 /* Hardware Implementation Register 2 */
+ #define SPRN_HID2_GEKKO 0x398 /* Gekko HID2 Register */
++#define SPRN_HID2_G2_LE 0x3F3 /* G2_LE HID2 Register */
++#define HID2_G2_LE_HBE (1<<18) /* High BAT Enable (G2_LE) */
+ #define SPRN_IABR 0x3F2 /* Instruction Address Breakpoint Register */
+ #define SPRN_IABR2 0x3FA /* 83xx */
+ #define SPRN_IBCR 0x135 /* 83xx Insn Breakpoint Control Reg */
+diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
+index f8b5ff64b604..6cbad50c71f6 100644
+--- a/arch/powerpc/kernel/cpu_setup_6xx.S
++++ b/arch/powerpc/kernel/cpu_setup_6xx.S
+@@ -24,6 +24,15 @@ BEGIN_FTR_SECTION
+ bl __init_fpu_registers
+ END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
+ bl setup_common_caches
++
++ /*
++ * This assumes that all cores using __setup_cpu_603 with
++ * MMU_FTR_USE_HIGH_BATS are G2_LE compatible
++ */
++BEGIN_MMU_FTR_SECTION
++ bl setup_g2_le_hid2
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ mtlr r5
+ blr
+ _GLOBAL(__setup_cpu_604)
+@@ -111,6 +120,16 @@ setup_604_hid0:
+ isync
+ blr
+
++/* Enable high BATs for G2_LE and derivatives like e300cX */
++SYM_FUNC_START_LOCAL(setup_g2_le_hid2)
++ mfspr r11,SPRN_HID2_G2_LE
++ oris r11,r11,HID2_G2_LE_HBE@h
++ mtspr SPRN_HID2_G2_LE,r11
++ sync
++ isync
++ blr
++SYM_FUNC_END(setup_g2_le_hid2)
++
+ /* 7400 <= rev 2.7 and 7410 rev = 1.0 suffer from some
+ * erratas we work around here.
+ * Moto MPC710CE.pdf describes them, those are errata
+@@ -485,4 +504,3 @@ _GLOBAL(__restore_cpu_setup)
+ mtcr r7
+ blr
+ _ASM_NOKPROBE_SYMBOL(__restore_cpu_setup)
+-
+--
+2.43.0
+
--- /dev/null
+From 45aceecbf0df3a4e4aa6885985bb55b85ea8cebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 09:45:59 +0800
+Subject: powerpc/kasan: Fix addr error caused by page alignment
+
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+
+[ Upstream commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 ]
+
+In kasan_init_region, when k_start is not page aligned, at the begin of
+for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then
+`va = block + k_cur - k_start` is less than block, the addr va is invalid,
+because the memory address space from va to block is not alloced by
+memblock_alloc, which will not be reserved by memblock_reserve later, it
+will be used by other places.
+
+As a result, memory overwriting occurs.
+
+for example:
+int __init __weak kasan_init_region(void *start, size_t size)
+{
+[...]
+ /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */
+ block = memblock_alloc(k_end - k_start, PAGE_SIZE);
+ [...]
+ for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) {
+ /* at the begin of for loop
+ * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)
+ * va(dcd96c00) is less than block(dcd97000), va is invalid
+ */
+ void *va = block + k_cur - k_start;
+ [...]
+ }
+[...]
+}
+
+Therefore, page alignment is performed on k_start before
+memblock_alloc() to ensure the validity of the VA address.
+
+Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.")
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/kasan/kasan_init_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c
+index f3e4d069e0ba..643fc525897d 100644
+--- a/arch/powerpc/mm/kasan/kasan_init_32.c
++++ b/arch/powerpc/mm/kasan/kasan_init_32.c
+@@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size)
+ if (ret)
+ return ret;
+
++ k_start = k_start & PAGE_MASK;
+ block = memblock_alloc(k_end - k_start, PAGE_SIZE);
+ if (!block)
+ return -ENOMEM;
+--
+2.43.0
+
usb-hub-check-for-alternate-port-before-enabling-a_alt_hnp_support.patch
usb-f_mass_storage-forbid-async-queue-when-shutdown-happen.patch
usb-dwc3-gadget-fix-null-pointer-dereference-in-dwc3_gadget_suspend.patch
+media-ir_toy-fix-a-memleak-in-irtoy_tx.patch
+powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch
+powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch
+i2c-i801-remove-i801_set_block_buffer_mode.patch
+i2c-i801-fix-block-process-call-transactions.patch
+modpost-trim-leading-spaces-when-processing-source-f.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
