--- /dev/null
+From 00a39d8652ff9088de07a6fe6e9e1893452fe0dd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= <mat.jonczyk@o2.pl>
+Date: Sat, 7 Jun 2025 23:06:08 +0200
+Subject: rtc: cmos: use spin_lock_irqsave in cmos_interrupt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mateusz Jończyk <mat.jonczyk@o2.pl>
+
+commit 00a39d8652ff9088de07a6fe6e9e1893452fe0dd upstream.
+
+cmos_interrupt() can be called in a non-interrupt context, such as in
+an ACPI event handler (which runs in an interrupt thread). Therefore,
+usage of spin_lock(&rtc_lock) is insecure. Use spin_lock_irqsave() /
+spin_unlock_irqrestore() instead.
+
+Before a misguided
+commit 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ")
+the cmos_interrupt() function used spin_lock_irqsave(). That commit
+changed it to spin_lock() and broke locking, which was partially fixed in
+commit 13be2efc390a ("rtc: cmos: Disable irq around direct invocation of cmos_interrupt()")
+
+That second commit did not take account of the ACPI fixed event handler
+pathway, however. It introduced local_irq_disable() workarounds in
+cmos_check_wkalrm(), which can cause problems on PREEMPT_RT kernels
+and are now unnecessary.
+
+Add an explicit comment so that this change will not be reverted by
+mistake.
+
+Cc: stable@vger.kernel.org
+Fixes: 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ")
+Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Tested-by: Chris Bainbridge <chris.bainbridge@gmail.com>
+Reported-by: Chris Bainbridge <chris.bainbridge@gmail.com>
+Closes: https://lore.kernel.org/all/aDtJ92foPUYmGheF@debian.local/
+Link: https://lore.kernel.org/r/20250607210608.14835-1-mat.jonczyk@o2.pl
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-cmos.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -692,8 +692,12 @@ static irqreturn_t cmos_interrupt(int ir
+ {
+ u8 irqstat;
+ u8 rtc_control;
++ unsigned long flags;
+
+- spin_lock(&rtc_lock);
++ /* We cannot use spin_lock() here, as cmos_interrupt() is also called
++ * in a non-irq context.
++ */
++ spin_lock_irqsave(&rtc_lock, flags);
+
+ /* When the HPET interrupt handler calls us, the interrupt
+ * status is passed as arg1 instead of the irq number. But
+@@ -727,7 +731,7 @@ static irqreturn_t cmos_interrupt(int ir
+ hpet_mask_rtc_irq_bit(RTC_AIE);
+ CMOS_READ(RTC_INTR_FLAGS);
+ }
+- spin_unlock(&rtc_lock);
++ spin_unlock_irqrestore(&rtc_lock, flags);
+
+ if (is_intr(irqstat)) {
+ rtc_update_irq(p, 1, irqstat);
+@@ -1295,9 +1299,7 @@ static void cmos_check_wkalrm(struct dev
+ * ACK the rtc irq here
+ */
+ if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) {
+- local_irq_disable();
+ cmos_interrupt(0, (void *)cmos->rtc);
+- local_irq_enable();
+ return;
+ }
+
--- /dev/null
+From 08d82d0cad51c2b1d454fe41ea1ff96ade676961 Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Thu, 29 May 2025 16:29:22 -0400
+Subject: rtc: pcf2127: add missing semicolon after statement
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit 08d82d0cad51c2b1d454fe41ea1ff96ade676961 upstream.
+
+Replace comma with semicolon at the end of the statement when setting
+config.max_register.
+
+Fixes: fd28ceb4603f ("rtc: pcf2127: add variant-specific configuration structure")
+Cc: stable@vger.kernel.org
+Cc: Elena Popa <elena.popa@nxp.com>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://lore.kernel.org/r/20250529202923.1552560-1-hugo@hugovil.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -1538,7 +1538,7 @@ static int pcf2127_spi_probe(struct spi_
+ variant = &pcf21xx_cfg[type];
+ }
+
+- config.max_register = variant->max_register,
++ config.max_register = variant->max_register;
+
+ regmap = devm_regmap_init_spi(spi, &config);
+ if (IS_ERR(regmap)) {
--- /dev/null
+From fa78e9b606a472495ef5b6b3d8b45c37f7727f9d Mon Sep 17 00:00:00 2001
+From: Elena Popa <elena.popa@nxp.com>
+Date: Fri, 30 May 2025 13:40:00 +0300
+Subject: rtc: pcf2127: fix SPI command byte for PCF2131
+
+From: Elena Popa <elena.popa@nxp.com>
+
+commit fa78e9b606a472495ef5b6b3d8b45c37f7727f9d upstream.
+
+PCF2131 was not responding to read/write operations using SPI. PCF2131
+has a different command byte definition, compared to PCF2127/29. Added
+the new command byte definition when PCF2131 is detected.
+
+Fixes: afc505bf9039 ("rtc: pcf2127: add support for PCF2131 RTC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Elena Popa <elena.popa@nxp.com>
+Acked-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://lore.kernel.org/r/20250530104001.957977-1-elena.popa@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -1465,6 +1465,11 @@ static int pcf2127_i2c_probe(struct i2c_
+ variant = &pcf21xx_cfg[type];
+ }
+
++ if (variant->type == PCF2131) {
++ config.read_flag_mask = 0x0;
++ config.write_flag_mask = 0x0;
++ }
++
+ config.max_register = variant->max_register,
+
+ regmap = devm_regmap_init(&client->dev, &pcf2127_i2c_regmap,
--- /dev/null
+rtc-pcf2127-add-missing-semicolon-after-statement.patch
+rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch
+rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch
+virtio-net-xsk-rx-fix-the-frame-s-length-check.patch
--- /dev/null
+From 5177373c31318c3c6a190383bfd232e6cf565c36 Mon Sep 17 00:00:00 2001
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+Date: Mon, 30 Jun 2025 22:13:14 +0700
+Subject: virtio-net: xsk: rx: fix the frame's length check
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+commit 5177373c31318c3c6a190383bfd232e6cf565c36 upstream.
+
+When calling buf_to_xdp, the len argument is the frame data's length
+without virtio header's length (vi->hdr_len). We check that len with
+
+ xsk_pool_get_rx_frame_size() + vi->hdr_len
+
+to ensure the provided len does not larger than the allocated chunk
+size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk,
+we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost
+to start placing data from
+
+ hard_start + XDP_PACKET_HEADROOM - vi->hdr_len
+not
+ hard_start + XDP_PACKET_HEADROOM
+
+But the first buffer has virtio_header, so the maximum frame's length in
+the first buffer can only be
+
+ xsk_pool_get_rx_frame_size()
+not
+ xsk_pool_get_rx_frame_size() + vi->hdr_len
+
+like in the current check.
+
+This commit adds an additional argument to buf_to_xdp differentiate
+between the first buffer and other ones to correctly calculate the maximum
+frame's length.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Fixes: a4e7ba702701 ("virtio_net: xsk: rx: support recv small mode")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Link: https://patch.msgid.link/20250630151315.86722-2-minhquangbui99@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index ecd3f46deb5d..50ff9a309ddc 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1147,15 +1147,29 @@ static void check_sq_full_and_disable(struct virtnet_info *vi,
+ }
+ }
+
++/* Note that @len is the length of received data without virtio header */
+ static struct xdp_buff *buf_to_xdp(struct virtnet_info *vi,
+- struct receive_queue *rq, void *buf, u32 len)
++ struct receive_queue *rq, void *buf,
++ u32 len, bool first_buf)
+ {
+ struct xdp_buff *xdp;
+ u32 bufsize;
+
+ xdp = (struct xdp_buff *)buf;
+
+- bufsize = xsk_pool_get_rx_frame_size(rq->xsk_pool) + vi->hdr_len;
++ /* In virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for
++ * virtio header and ask the vhost to fill data from
++ * hard_start + XDP_PACKET_HEADROOM - vi->hdr_len
++ * The first buffer has virtio header so the remaining region for frame
++ * data is
++ * xsk_pool_get_rx_frame_size()
++ * While other buffers than the first one do not have virtio header, so
++ * the maximum frame data's length can be
++ * xsk_pool_get_rx_frame_size() + vi->hdr_len
++ */
++ bufsize = xsk_pool_get_rx_frame_size(rq->xsk_pool);
++ if (!first_buf)
++ bufsize += vi->hdr_len;
+
+ if (unlikely(len > bufsize)) {
+ pr_debug("%s: rx error: len %u exceeds truesize %u\n",
+@@ -1280,7 +1294,7 @@ static int xsk_append_merge_buffer(struct virtnet_info *vi,
+
+ u64_stats_add(&stats->bytes, len);
+
+- xdp = buf_to_xdp(vi, rq, buf, len);
++ xdp = buf_to_xdp(vi, rq, buf, len, false);
+ if (!xdp)
+ goto err;
+
+@@ -1378,7 +1392,7 @@ static void virtnet_receive_xsk_buf(struct virtnet_info *vi, struct receive_queu
+
+ u64_stats_add(&stats->bytes, len);
+
+- xdp = buf_to_xdp(vi, rq, buf, len);
++ xdp = buf_to_xdp(vi, rq, buf, len, true);
+ if (!xdp)
+ return;
+
+--
+2.50.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
