From: Sasha Levin Date: Mon, 19 Feb 2024 12:56:34 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v4.19.307~126 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2cf6cba6b4862781d88940ec9939aeaffa65a1c9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/cifs-fix-underflow-in-parse_server_interfaces.patch b/queue-6.6/cifs-fix-underflow-in-parse_server_interfaces.patch new file mode 100644 index 00000000000..8aca1c58883 --- /dev/null +++ b/queue-6.6/cifs-fix-underflow-in-parse_server_interfaces.patch @@ -0,0 +1,41 @@ +From ffd3956d5cc3576c0d9cd0a907a842a3c50aa12f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 13:18:46 +0300 +Subject: cifs: fix underflow in parse_server_interfaces() + +From: Dan Carpenter + +[ Upstream commit cffe487026be13eaf37ea28b783d9638ab147204 ] + +In this loop, we step through the buffer and after each item we check +if the size_left is greater than the minimum size we need. However, +the problem is that "bytes_left" is type ssize_t while sizeof() is type +size_t. That means that because of type promotion, the comparison is +done as an unsigned and if we have negative bytes left the loop +continues instead of ending. + +Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries") +Signed-off-by: Dan Carpenter +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index e33ed0fbc318..5850f861e7e1 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -619,7 +619,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + goto out; + } + +- while (bytes_left >= sizeof(*p)) { ++ while (bytes_left >= (ssize_t)sizeof(*p)) { + memset(&tmp_iface, 0, sizeof(tmp_iface)); + tmp_iface.speed = le64_to_cpu(p->LinkSpeed); + tmp_iface.rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0; +-- +2.43.0 + diff --git a/queue-6.6/driver-core-fw_devlink-improve-detection-of-overlapp.patch b/queue-6.6/driver-core-fw_devlink-improve-detection-of-overlapp.patch new file mode 100644 index 00000000000..92d94d434b4 --- /dev/null +++ b/queue-6.6/driver-core-fw_devlink-improve-detection-of-overlapp.patch @@ -0,0 +1,102 @@ +From 38ba97a322ec2854e6be64bc6ed645ad7f1262a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 01:56:34 -0800 +Subject: driver core: fw_devlink: Improve detection of overlapping cycles + +From: Saravana Kannan + +[ Upstream commit 6442d79d880cf7a2fff18779265d657fef0cce4c ] + +fw_devlink can detect most overlapping/intersecting cycles. However it was +missing a few corner cases because of an incorrect optimization logic that +tries to avoid repeating cycle detection for devices that are already +marked as part of a cycle. + +Here's an example provided by Xu Yang (edited for clarity): + + usb + +-----+ + tcpc | | + +-----+ | +--| + | |----------->|EP| + |--+ | | +--| + |EP|<-----------| | + |--+ | | B | + | | +-----+ + | A | | + +-----+ | + ^ +-----+ | + | | | | + +-----| C |<--+ + | | + +-----+ + usb-phy + +Node A (tcpc) will be populated as device 1-0050. +Node B (usb) will be populated as device 38100000.usb. +Node C (usb-phy) will be populated as device 381f0040.usb-phy. + +The description below uses the notation: +consumer --> supplier +child ==> parent + +1. Node C is populated as device C. No cycles detected because cycle + detection is only run when a fwnode link is converted to a device link. + +2. Node B is populated as device B. As we convert B --> C into a device + link we run cycle detection and find and mark the device link/fwnode + link cycle: + C--> A --> B.EP ==> B --> C + +3. Node A is populated as device A. As we convert C --> A into a device + link, we see it's already part of a cycle (from step 2) and don't run + cycle detection. Thus we miss detecting the cycle: + A --> B.EP ==> B --> A.EP ==> A + +Looking at it another way, A depends on B in one way: +A --> B.EP ==> B + +But B depends on A in two ways and we only detect the first: +B --> C --> A +B --> A.EP ==> A + +To detect both of these, we remove the incorrect optimization attempt in +step 3 and run cycle detection even if the fwnode link from which the +device link is being created has already been marked as part of a cycle. + +Reported-by: Xu Yang +Closes: https://lore.kernel.org/lkml/DU2PR04MB8822693748725F85DC0CB86C8C792@DU2PR04MB8822.eurprd04.prod.outlook.com/ +Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") +Signed-off-by: Saravana Kannan +Tested-by: Xu Yang +Link: https://lore.kernel.org/r/20240202095636.868578-3-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index a81bc8844a8f..2cc0ab854168 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -2059,9 +2059,14 @@ static int fw_devlink_create_devlink(struct device *con, + + /* + * SYNC_STATE_ONLY device links don't block probing and supports cycles. +- * So cycle detection isn't necessary and shouldn't be done. ++ * So, one might expect that cycle detection isn't necessary for them. ++ * However, if the device link was marked as SYNC_STATE_ONLY because ++ * it's part of a cycle, then we still need to do cycle detection. This ++ * is because the consumer and supplier might be part of multiple cycles ++ * and we need to detect all those cycles. + */ +- if (!(flags & DL_FLAG_SYNC_STATE_ONLY)) { ++ if (!device_link_flag_is_sync_state_only(flags) || ++ flags & DL_FLAG_CYCLE) { + device_links_write_lock(); + if (__fw_devlink_relax_cycles(con, sup_handle)) { + __fwnode_link_cycle(link); +-- +2.43.0 + diff --git a/queue-6.6/i2c-i801-fix-block-process-call-transactions.patch b/queue-6.6/i2c-i801-fix-block-process-call-transactions.patch new file mode 100644 index 00000000000..4c612bd496a --- /dev/null +++ b/queue-6.6/i2c-i801-fix-block-process-call-transactions.patch @@ -0,0 +1,56 @@ +From 4466df2a51269dfb44e34e3a5940b8cd080a017f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 15:59:39 +0100 +Subject: i2c: i801: Fix block process call transactions + +From: Jean Delvare + +[ Upstream commit c1c9d0f6f7f1dbf29db996bd8e166242843a5f21 ] + +According to the Intel datasheets, software must reset the block +buffer index twice for block process call transactions: once before +writing the outgoing data to the buffer, and once again before +reading the incoming data from the buffer. + +The driver is currently missing the second reset, causing the wrong +portion of the block buffer to be read. + +Signed-off-by: Jean Delvare +Reported-by: Piotr Zakowski +Closes: https://lore.kernel.org/linux-i2c/20240213120553.7b0ab120@endymion.delvare/ +Fixes: 315cd67c9453 ("i2c: i801: Add Block Write-Block Read Process Call support") +Reviewed-by: Alexander Sverdlin +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-i801.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index a87e3c15e5fc..f1c82b2016f3 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -500,11 +500,10 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, + /* Set block buffer mode */ + outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv)); + +- inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ +- + if (read_write == I2C_SMBUS_WRITE) { + len = data->block[0]; + outb_p(len, SMBHSTDAT0(priv)); ++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ + for (i = 0; i < len; i++) + outb_p(data->block[i+1], SMBBLKDAT(priv)); + } +@@ -522,6 +521,7 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, + } + + data->block[0] = len; ++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ + for (i = 0; i < len; i++) + data->block[i + 1] = inb_p(SMBBLKDAT(priv)); + } +-- +2.43.0 + diff --git a/queue-6.6/i2c-pasemi-split-driver-into-two-separate-modules.patch b/queue-6.6/i2c-pasemi-split-driver-into-two-separate-modules.patch new file mode 100644 index 00000000000..f25b7fd51d3 --- /dev/null +++ b/queue-6.6/i2c-pasemi-split-driver-into-two-separate-modules.patch @@ -0,0 +1,69 @@ +From 7c3e37d4c2e4206bf26c1916cb91129baaaa3283 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 12:19:04 +0100 +Subject: i2c: pasemi: split driver into two separate modules + +From: Arnd Bergmann + +[ Upstream commit f44bff19268517ee98e80e944cad0f04f1db72e3 ] + +On powerpc, it is possible to compile test both the new apple (arm) and +old pasemi (powerpc) drivers for the i2c hardware at the same time, +which leads to a warning about linking the same object file twice: + +scripts/Makefile.build:244: drivers/i2c/busses/Makefile: i2c-pasemi-core.o is added to multiple modules: i2c-apple i2c-pasemi + +Rework the driver to have an explicit helper module, letting Kbuild +take care of whether this should be built-in or a loadable driver. + +Fixes: 9bc5f4f660ff ("i2c: pasemi: Split pci driver to its own file") +Signed-off-by: Arnd Bergmann +Reviewed-by: Sven Peter +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/Makefile | 6 ++---- + drivers/i2c/busses/i2c-pasemi-core.c | 6 ++++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile +index af56fe2c75c0..9be9fdb07f3d 100644 +--- a/drivers/i2c/busses/Makefile ++++ b/drivers/i2c/busses/Makefile +@@ -90,10 +90,8 @@ obj-$(CONFIG_I2C_NPCM) += i2c-npcm7xx.o + obj-$(CONFIG_I2C_OCORES) += i2c-ocores.o + obj-$(CONFIG_I2C_OMAP) += i2c-omap.o + obj-$(CONFIG_I2C_OWL) += i2c-owl.o +-i2c-pasemi-objs := i2c-pasemi-core.o i2c-pasemi-pci.o +-obj-$(CONFIG_I2C_PASEMI) += i2c-pasemi.o +-i2c-apple-objs := i2c-pasemi-core.o i2c-pasemi-platform.o +-obj-$(CONFIG_I2C_APPLE) += i2c-apple.o ++obj-$(CONFIG_I2C_PASEMI) += i2c-pasemi-core.o i2c-pasemi-pci.o ++obj-$(CONFIG_I2C_APPLE) += i2c-pasemi-core.o i2c-pasemi-platform.o + obj-$(CONFIG_I2C_PCA_PLATFORM) += i2c-pca-platform.o + obj-$(CONFIG_I2C_PNX) += i2c-pnx.o + obj-$(CONFIG_I2C_PXA) += i2c-pxa.o +diff --git a/drivers/i2c/busses/i2c-pasemi-core.c b/drivers/i2c/busses/i2c-pasemi-core.c +index 7d54a9f34c74..bd8becbdeeb2 100644 +--- a/drivers/i2c/busses/i2c-pasemi-core.c ++++ b/drivers/i2c/busses/i2c-pasemi-core.c +@@ -369,6 +369,7 @@ int pasemi_i2c_common_probe(struct pasemi_smbus *smbus) + + return 0; + } ++EXPORT_SYMBOL_GPL(pasemi_i2c_common_probe); + + irqreturn_t pasemi_irq_handler(int irq, void *dev_id) + { +@@ -378,3 +379,8 @@ irqreturn_t pasemi_irq_handler(int irq, void *dev_id) + complete(&smbus->irq_completion); + return IRQ_HANDLED; + } ++EXPORT_SYMBOL_GPL(pasemi_irq_handler); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Olof Johansson "); ++MODULE_DESCRIPTION("PA Semi PWRficient SMBus driver"); +-- +2.43.0 + diff --git a/queue-6.6/i2c-qcom-geni-correct-i2c-tre-sequence.patch b/queue-6.6/i2c-qcom-geni-correct-i2c-tre-sequence.patch new file mode 100644 index 00000000000..e2b36b865b8 --- /dev/null +++ b/queue-6.6/i2c-qcom-geni-correct-i2c-tre-sequence.patch @@ -0,0 +1,96 @@ +From ac678bba0ce75d9e0a6d0fc263aa784949461bde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 18:22:39 +0530 +Subject: i2c: qcom-geni: Correct I2C TRE sequence + +From: Viken Dadhaniya + +[ Upstream commit 83ef106fa732aea8558253641cd98e8a895604d7 ] + +For i2c read operation in GSI mode, we are getting timeout +due to malformed TRE basically incorrect TRE sequence +in gpi(drivers/dma/qcom/gpi.c) driver. + +I2C driver has geni_i2c_gpi(I2C_WRITE) function which generates GO TRE and +geni_i2c_gpi(I2C_READ)generates DMA TRE. Hence to generate GO TRE before +DMA TRE, we should move geni_i2c_gpi(I2C_WRITE) before +geni_i2c_gpi(I2C_READ) inside the I2C GSI mode transfer function +i.e. geni_i2c_gpi_xfer(). + +TRE stands for Transfer Ring Element - which is basically an element with +size of 4 words. It contains all information like slave address, +clk divider, dma address value data size etc). + +Mainly we have 3 TREs(Config, GO and DMA tre). +- CONFIG TRE : consists of internal register configuration which is + required before start of the transfer. +- DMA TRE : contains DDR/Memory address, called as DMA descriptor. +- GO TRE : contains Transfer directions, slave ID, Delay flags, Length + of the transfer. + +I2c driver calls GPI driver API to config each TRE depending on the +protocol. + +For read operation tre sequence will be as below which is not aligned +to hardware programming guide. + +- CONFIG tre +- DMA tre +- GO tre + +As per Qualcomm's internal Hardware Programming Guide, we should configure +TREs in below sequence for any RX only transfer. + +- CONFIG tre +- GO tre +- DMA tre + +Fixes: d8703554f4de ("i2c: qcom-geni: Add support for GPI DMA") +Reviewed-by: Andi Shyti +Reviewed-by: Bryan O'Donoghue +Tested-by: Bryan O'Donoghue # qrb5165-rb5 +Co-developed-by: Mukesh Kumar Savaliya +Signed-off-by: Mukesh Kumar Savaliya +Signed-off-by: Viken Dadhaniya +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-qcom-geni.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index 0a9d389df301..5cc32a465f12 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -613,20 +613,20 @@ static int geni_i2c_gpi_xfer(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], i + + peripheral.addr = msgs[i].addr; + ++ ret = geni_i2c_gpi(gi2c, &msgs[i], &config, ++ &tx_addr, &tx_buf, I2C_WRITE, gi2c->tx_c); ++ if (ret) ++ goto err; ++ + if (msgs[i].flags & I2C_M_RD) { + ret = geni_i2c_gpi(gi2c, &msgs[i], &config, + &rx_addr, &rx_buf, I2C_READ, gi2c->rx_c); + if (ret) + goto err; +- } +- +- ret = geni_i2c_gpi(gi2c, &msgs[i], &config, +- &tx_addr, &tx_buf, I2C_WRITE, gi2c->tx_c); +- if (ret) +- goto err; + +- if (msgs[i].flags & I2C_M_RD) + dma_async_issue_pending(gi2c->rx_c); ++ } ++ + dma_async_issue_pending(gi2c->tx_c); + + timeout = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); +-- +2.43.0 + diff --git a/queue-6.6/iio-adc-ad4130-only-set-gpio_ctrl-if-pin-is-unused.patch b/queue-6.6/iio-adc-ad4130-only-set-gpio_ctrl-if-pin-is-unused.patch new file mode 100644 index 00000000000..3986516217d --- /dev/null +++ b/queue-6.6/iio-adc-ad4130-only-set-gpio_ctrl-if-pin-is-unused.patch @@ -0,0 +1,53 @@ +From 63d767b69aa7279f9de202f8b7c3fd75eb9ce341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 15:20:06 +0200 +Subject: iio: adc: ad4130: only set GPIO_CTRL if pin is unused + +From: Cosmin Tanislav + +[ Upstream commit 78367c32bebfe833cd30c855755d863a4ff3fdee ] + +Currently, GPIO_CTRL bits are set even if the pins are used for +measurements. + +GPIO_CTRL bits should only be set if the pin is not used for +other functionality. + +Fix this by only setting the GPIO_CTRL bits if the pin has no +other function. + +Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver") +Signed-off-by: Cosmin Tanislav +Reviewed-by: Nuno Sa +Link: https://lore.kernel.org/r/20240207132007.253768-2-demonsingur@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad4130.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c +index bbdae66d1f1d..e650ebd167b0 100644 +--- a/drivers/iio/adc/ad4130.c ++++ b/drivers/iio/adc/ad4130.c +@@ -1900,10 +1900,14 @@ static int ad4130_setup(struct iio_dev *indio_dev) + return ret; + + /* +- * Configure all GPIOs for output. If configured, the interrupt function +- * of P2 takes priority over the GPIO out function. ++ * Configure unused GPIOs for output. If configured, the interrupt ++ * function of P2 takes priority over the GPIO out function. + */ +- val = AD4130_IO_CONTROL_GPIO_CTRL_MASK; ++ val = 0; ++ for (i = 0; i < AD4130_MAX_GPIOS; i++) ++ if (st->pins_fn[i + AD4130_AIN2_P1] == AD4130_PIN_FN_NONE) ++ val |= FIELD_PREP(AD4130_IO_CONTROL_GPIO_CTRL_MASK, BIT(i)); ++ + val |= FIELD_PREP(AD4130_IO_CONTROL_INT_PIN_SEL_MASK, st->int_pin_sel); + + ret = regmap_write(st->regmap, AD4130_IO_CONTROL_REG, val); +-- +2.43.0 + diff --git a/queue-6.6/iio-adc-ad4130-zero-initialize-clock-init-data.patch b/queue-6.6/iio-adc-ad4130-zero-initialize-clock-init-data.patch new file mode 100644 index 00000000000..637668da1ad --- /dev/null +++ b/queue-6.6/iio-adc-ad4130-zero-initialize-clock-init-data.patch @@ -0,0 +1,41 @@ +From e653d8b6e4ba4319fb1bd8ad673941552d4cbbff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 15:20:05 +0200 +Subject: iio: adc: ad4130: zero-initialize clock init data + +From: Cosmin Tanislav + +[ Upstream commit a22b0a2be69a36511cb5b37d948b651ddf7debf3 ] + +The clk_init_data struct does not have all its members +initialized, causing issues when trying to expose the internal +clock on the CLK pin. + +Fix this by zero-initializing the clk_init_data struct. + +Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver") +Signed-off-by: Cosmin Tanislav +Reviewed-by: Nuno Sa +Link: https://lore.kernel.org/r/20240207132007.253768-1-demonsingur@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad4130.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c +index 5a5dd5e87ffc..bbdae66d1f1d 100644 +--- a/drivers/iio/adc/ad4130.c ++++ b/drivers/iio/adc/ad4130.c +@@ -1826,7 +1826,7 @@ static int ad4130_setup_int_clk(struct ad4130_state *st) + { + struct device *dev = &st->spi->dev; + struct device_node *of_node = dev_of_node(dev); +- struct clk_init_data init; ++ struct clk_init_data init = {}; + const char *clk_name; + struct clk *clk; + int ret; +-- +2.43.0 + diff --git a/queue-6.6/interconnect-qcom-sc8180x-mark-co0-bcm-keepalive.patch b/queue-6.6/interconnect-qcom-sc8180x-mark-co0-bcm-keepalive.patch new file mode 100644 index 00000000000..4697f4c7c28 --- /dev/null +++ b/queue-6.6/interconnect-qcom-sc8180x-mark-co0-bcm-keepalive.patch @@ -0,0 +1,40 @@ +From 7652063ccb0be1a497cca9335cabf66c0601a06a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 15:16:26 +0200 +Subject: interconnect: qcom: sc8180x: Mark CO0 BCM keepalive + +From: Konrad Dybcio + +[ Upstream commit 85e985a4f46e462a37f1875cb74ed380e7c0c2e0 ] + +The CO0 BCM needs to be up at all times, otherwise some hardware (like +the UFS controller) loses its connection to the rest of the SoC, +resulting in a hang of the platform, accompanied by a spectacular +logspam. + +Mark it as keepalive to prevent such cases. + +Fixes: 9c8c6bac1ae8 ("interconnect: qcom: Add SC8180x providers") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231214-topic-sc8180_fixes-v1-1-421904863006@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sc8180x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sc8180x.c b/drivers/interconnect/qcom/sc8180x.c +index bdd3471d4ac8..a741badaa966 100644 +--- a/drivers/interconnect/qcom/sc8180x.c ++++ b/drivers/interconnect/qcom/sc8180x.c +@@ -1372,6 +1372,7 @@ static struct qcom_icc_bcm bcm_mm0 = { + + static struct qcom_icc_bcm bcm_co0 = { + .name = "CO0", ++ .keepalive = true, + .num_nodes = 1, + .nodes = { &slv_qns_cdsp_mem_noc } + }; +-- +2.43.0 + diff --git a/queue-6.6/interconnect-qcom-sm8550-enable-sync_state.patch b/queue-6.6/interconnect-qcom-sm8550-enable-sync_state.patch new file mode 100644 index 00000000000..6fc80818c30 --- /dev/null +++ b/queue-6.6/interconnect-qcom-sm8550-enable-sync_state.patch @@ -0,0 +1,37 @@ +From fd4cca86ff147095c91ec173bb4322d57be5a8b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 15:16:46 +0200 +Subject: interconnect: qcom: sm8550: Enable sync_state + +From: Konrad Dybcio + +[ Upstream commit 24406f6794aa631516241deb9e19de333d6a0600 ] + +To ensure the interconnect votes are actually meaningful and in order to +prevent holding all buses at FMAX, introduce the sync state callback. + +Fixes: e6f0d6a30f73 ("interconnect: qcom: Add SM8550 interconnect provider driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-2-ce1272d77540@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sm8550.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sm8550.c b/drivers/interconnect/qcom/sm8550.c +index a10c8b6549ee..16b2dfd794b4 100644 +--- a/drivers/interconnect/qcom/sm8550.c ++++ b/drivers/interconnect/qcom/sm8550.c +@@ -2223,6 +2223,7 @@ static struct platform_driver qnoc_driver = { + .driver = { + .name = "qnoc-sm8550", + .of_match_table = qnoc_of_match, ++ .sync_state = icc_sync_state, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.6/irqchip-gic-v3-its-handle-non-coherent-gicv4-redistr.patch b/queue-6.6/irqchip-gic-v3-its-handle-non-coherent-gicv4-redistr.patch new file mode 100644 index 00000000000..e073568be5f --- /dev/null +++ b/queue-6.6/irqchip-gic-v3-its-handle-non-coherent-gicv4-redistr.patch @@ -0,0 +1,124 @@ +From a97b58ff81fb34d375a25cb61428dd37e02ccf83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:12:04 +0000 +Subject: irqchip/gic-v3-its: Handle non-coherent GICv4 redistributors + +From: Marc Zyngier + +[ Upstream commit 846297e11e8ae428f8b00156a0cfe2db58100702 ] + +Although the GICv3 code base has gained some handling of systems failing to +handle the shareability attributes, the GICv4 side of things has been +firmly ignored. + +This is unfortunate, as the new recent addition of the "dma-noncoherent" is +supposed to apply to all of the GICR tables, and not just the ones that are +common to v3 and v4. + +Add some checks to handle the VPROPBASE/VPENDBASE shareability and +cacheability attributes in the same way we deal with the other GICR_BASE +registers, wrapping the flag check in a helper for improved readability. + +Note that this has been found by inspection only, as I don't have access to +HW that suffers from this particular issue. + +Fixes: 3a0fff0fb6a3 ("irqchip/gic-v3: Enable non-coherent redistributors/ITSes DT probing") +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Reviewed-by: Lorenzo Pieralisi +Link: https://lore.kernel.org/r/20240213101206.2137483-2-maz@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-its.c | 37 +++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 9a7a74239eab..bdc2c8330479 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -207,6 +207,11 @@ static bool require_its_list_vmovp(struct its_vm *vm, struct its_node *its) + return (gic_rdists->has_rvpeid || vm->vlpi_count[its->list_nr]); + } + ++static bool rdists_support_shareable(void) ++{ ++ return !(gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE); ++} ++ + static u16 get_its_list(struct its_vm *vm) + { + struct its_node *its; +@@ -2710,10 +2715,12 @@ static u64 inherit_vpe_l1_table_from_its(void) + break; + } + val |= FIELD_PREP(GICR_VPROPBASER_4_1_ADDR, addr >> 12); +- val |= FIELD_PREP(GICR_VPROPBASER_SHAREABILITY_MASK, +- FIELD_GET(GITS_BASER_SHAREABILITY_MASK, baser)); +- val |= FIELD_PREP(GICR_VPROPBASER_INNER_CACHEABILITY_MASK, +- FIELD_GET(GITS_BASER_INNER_CACHEABILITY_MASK, baser)); ++ if (rdists_support_shareable()) { ++ val |= FIELD_PREP(GICR_VPROPBASER_SHAREABILITY_MASK, ++ FIELD_GET(GITS_BASER_SHAREABILITY_MASK, baser)); ++ val |= FIELD_PREP(GICR_VPROPBASER_INNER_CACHEABILITY_MASK, ++ FIELD_GET(GITS_BASER_INNER_CACHEABILITY_MASK, baser)); ++ } + val |= FIELD_PREP(GICR_VPROPBASER_4_1_SIZE, GITS_BASER_NR_PAGES(baser) - 1); + + return val; +@@ -2936,8 +2943,10 @@ static int allocate_vpe_l1_table(void) + WARN_ON(!IS_ALIGNED(pa, psz)); + + val |= FIELD_PREP(GICR_VPROPBASER_4_1_ADDR, pa >> 12); +- val |= GICR_VPROPBASER_RaWb; +- val |= GICR_VPROPBASER_InnerShareable; ++ if (rdists_support_shareable()) { ++ val |= GICR_VPROPBASER_RaWb; ++ val |= GICR_VPROPBASER_InnerShareable; ++ } + val |= GICR_VPROPBASER_4_1_Z; + val |= GICR_VPROPBASER_4_1_VALID; + +@@ -3126,7 +3135,7 @@ static void its_cpu_init_lpis(void) + gicr_write_propbaser(val, rbase + GICR_PROPBASER); + tmp = gicr_read_propbaser(rbase + GICR_PROPBASER); + +- if (gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE) ++ if (!rdists_support_shareable()) + tmp &= ~GICR_PROPBASER_SHAREABILITY_MASK; + + if ((tmp ^ val) & GICR_PROPBASER_SHAREABILITY_MASK) { +@@ -3153,7 +3162,7 @@ static void its_cpu_init_lpis(void) + gicr_write_pendbaser(val, rbase + GICR_PENDBASER); + tmp = gicr_read_pendbaser(rbase + GICR_PENDBASER); + +- if (gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE) ++ if (!rdists_support_shareable()) + tmp &= ~GICR_PENDBASER_SHAREABILITY_MASK; + + if (!(tmp & GICR_PENDBASER_SHAREABILITY_MASK)) { +@@ -3880,14 +3889,18 @@ static void its_vpe_schedule(struct its_vpe *vpe) + val = virt_to_phys(page_address(vpe->its_vm->vprop_page)) & + GENMASK_ULL(51, 12); + val |= (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK; +- val |= GICR_VPROPBASER_RaWb; +- val |= GICR_VPROPBASER_InnerShareable; ++ if (rdists_support_shareable()) { ++ val |= GICR_VPROPBASER_RaWb; ++ val |= GICR_VPROPBASER_InnerShareable; ++ } + gicr_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER); + + val = virt_to_phys(page_address(vpe->vpt_page)) & + GENMASK_ULL(51, 16); +- val |= GICR_VPENDBASER_RaWaWb; +- val |= GICR_VPENDBASER_InnerShareable; ++ if (rdists_support_shareable()) { ++ val |= GICR_VPENDBASER_RaWaWb; ++ val |= GICR_VPENDBASER_InnerShareable; ++ } + /* + * There is no good way of finding out if the pending table is + * empty as we can race against the doorbell interrupt very +-- +2.43.0 + diff --git a/queue-6.6/irqchip-loongson-eiointc-use-correct-struct-type-in-.patch b/queue-6.6/irqchip-loongson-eiointc-use-correct-struct-type-in-.patch new file mode 100644 index 00000000000..58774af3337 --- /dev/null +++ b/queue-6.6/irqchip-loongson-eiointc-use-correct-struct-type-in-.patch @@ -0,0 +1,46 @@ +From d592798d60bb09be715e9c3cebceb480551b583a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 16:27:20 +0800 +Subject: irqchip/loongson-eiointc: Use correct struct type in + eiointc_domain_alloc() + +From: Bibo Mao + +[ Upstream commit f1c2765c6afcd1f71f76ed8c9bf94acedab4cecb ] + +eiointc_domain_alloc() uses struct eiointc, which is not defined, for a +pointer. Older compilers treat that as a forward declaration and due to +assignment of a void pointer there is no warning emitted. As the variable +is then handed in as a void pointer argument to irq_domain_set_info() the +code is functional. + +Use struct eiointc_priv instead. + +[ tglx: Rewrote changelog ] + +Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support") +Signed-off-by: Bibo Mao +Signed-off-by: Thomas Gleixner +Acked-by: Huacai Chen +Link: https://lore.kernel.org/r/20240130082722.2912576-2-maobibo@loongson.cn +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-loongson-eiointc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c +index 1623cd779175..b3736bdd4b9f 100644 +--- a/drivers/irqchip/irq-loongson-eiointc.c ++++ b/drivers/irqchip/irq-loongson-eiointc.c +@@ -241,7 +241,7 @@ static int eiointc_domain_alloc(struct irq_domain *domain, unsigned int virq, + int ret; + unsigned int i, type; + unsigned long hwirq = 0; +- struct eiointc *priv = domain->host_data; ++ struct eiointc_priv *priv = domain->host_data; + + ret = irq_domain_translate_onecell(domain, arg, &hwirq, &type); + if (ret) +-- +2.43.0 + diff --git a/queue-6.6/kallsyms-ignore-armv4-thunks-along-with-others.patch b/queue-6.6/kallsyms-ignore-armv4-thunks-along-with-others.patch new file mode 100644 index 00000000000..e5b7772327c --- /dev/null +++ b/queue-6.6/kallsyms-ignore-armv4-thunks-along-with-others.patch @@ -0,0 +1,58 @@ +From 29ee2b2c4a990a2d62ae1b412c34daac4ce77530 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 09:32:08 +0100 +Subject: kallsyms: ignore ARMv4 thunks along with others + +From: Arnd Bergmann + +[ Upstream commit a951884d82886d8453d489f84f20ac168d062b38 ] + +lld is now able to build ARMv4 and ARMv4T kernels, which means it can +generate thunks for those (__ARMv4PILongThunk_*, __ARMv4PILongBXThunk_*) +that can interfere with kallsyms table generation since they do not get +ignore like the corresponding ARMv5+ ones are: + +Inconsistent kallsyms data +Try "make KALLSYMS_EXTRA_PASS=1" as a workaround + +Replace the hardcoded list of thunk symbols with a more general regex that +covers this one along with future symbols that follow the same pattern. + +Fixes: 5eb6e280432d ("ARM: 9289/1: Allow pre-ARMv5 builds with ld.lld 16.0.0 and newer") +Fixes: efe6e3068067 ("kallsyms: fix nonconverging kallsyms table with lld") +Suggested-by: Masahiro Yamada +Signed-off-by: Arnd Bergmann +Reviewed-by: Ard Biesheuvel +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mksysmap | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/scripts/mksysmap b/scripts/mksysmap +index 9ba1c9da0a40..57ff5656d566 100755 +--- a/scripts/mksysmap ++++ b/scripts/mksysmap +@@ -48,17 +48,8 @@ ${NM} -n ${1} | sed >${2} -e " + / __kvm_nvhe_\\$/d + / __kvm_nvhe_\.L/d + +-# arm64 lld +-/ __AArch64ADRPThunk_/d +- +-# arm lld +-/ __ARMV5PILongThunk_/d +-/ __ARMV7PILongThunk_/d +-/ __ThumbV7PILongThunk_/d +- +-# mips lld +-/ __LA25Thunk_/d +-/ __microLA25Thunk_/d ++# lld arm/aarch64/mips thunks ++/ __[[:alnum:]]*Thunk_/d + + # CFI type identifiers + / __kcfi_typeid_/d +-- +2.43.0 + diff --git a/queue-6.6/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch b/queue-6.6/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch new file mode 100644 index 00000000000..87e33611456 --- /dev/null +++ b/queue-6.6/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch @@ -0,0 +1,44 @@ +From a7d823f50dfa7209e945e632fddd5e4f027bc2bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 09:14:19 +0100 +Subject: media: ir_toy: fix a memleak in irtoy_tx + +From: Zhipeng Lu + +[ Upstream commit dc9ceb90c4b42c6e5c6757df1d6257110433788e ] + +When irtoy_command fails, buf should be freed since it is allocated by +irtoy_tx, or there is a memleak. + +Fixes: 4114978dcd24 ("media: ir_toy: prevent device from hanging during transmit") +Signed-off-by: Zhipeng Lu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ir_toy.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c +index 196806709259..69e630d85262 100644 +--- a/drivers/media/rc/ir_toy.c ++++ b/drivers/media/rc/ir_toy.c +@@ -332,6 +332,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) + sizeof(COMMAND_SMODE_EXIT), STATE_COMMAND_NO_RESP); + if (err) { + dev_err(irtoy->dev, "exit sample mode: %d\n", err); ++ kfree(buf); + return err; + } + +@@ -339,6 +340,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) + sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND); + if (err) { + dev_err(irtoy->dev, "enter sample mode: %d\n", err); ++ kfree(buf); + return err; + } + +-- +2.43.0 + diff --git a/queue-6.6/modpost-trim-leading-spaces-when-processing-source-f.patch b/queue-6.6/modpost-trim-leading-spaces-when-processing-source-f.patch new file mode 100644 index 00000000000..f82c19e4615 --- /dev/null +++ b/queue-6.6/modpost-trim-leading-spaces-when-processing-source-f.patch @@ -0,0 +1,42 @@ +From f5f0ff7e77a9e97786e17a498a2cbce3602aea2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:14:07 +0100 +Subject: modpost: trim leading spaces when processing source files list + +From: Radek Krejci + +[ Upstream commit 5d9a16b2a4d9e8fa028892ded43f6501bc2969e5 ] + +get_line() does not trim the leading spaces, but the +parse_source_files() expects to get lines with source files paths where +the first space occurs after the file path. + +Fixes: 70f30cfe5b89 ("modpost: use read_text_file() and get_line() for reading text files") +Signed-off-by: Radek Krejci +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/sumversion.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c +index 31066bfdba04..dc4878502276 100644 +--- a/scripts/mod/sumversion.c ++++ b/scripts/mod/sumversion.c +@@ -326,7 +326,12 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md) + + /* Sum all files in the same dir or subdirs. */ + while ((line = get_line(&pos))) { +- char* p = line; ++ char* p; ++ ++ /* trim the leading spaces away */ ++ while (isspace(*line)) ++ line++; ++ p = line; + + if (strncmp(line, "source_", sizeof("source_")-1) == 0) { + p = strrchr(line, ' '); +-- +2.43.0 + diff --git a/queue-6.6/pci-fix-active-state-requirement-in-pme-polling.patch b/queue-6.6/pci-fix-active-state-requirement-in-pme-polling.patch new file mode 100644 index 00000000000..a1ee45ef10d --- /dev/null +++ b/queue-6.6/pci-fix-active-state-requirement-in-pme-polling.patch @@ -0,0 +1,102 @@ +From b1a86f1dcf68fc3fa015b77a1b3ebc1f0ae1ae60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 11:55:31 -0700 +Subject: PCI: Fix active state requirement in PME polling + +From: Alex Williamson + +[ Upstream commit 41044d5360685e78a869d40a168491a70cdb7e73 ] + +The commit noted in fixes added a bogus requirement that runtime PM managed +devices need to be in the RPM_ACTIVE state for PME polling. In fact, only +devices in low power states should be polled. + +However there's still a requirement that the device config space must be +accessible, which has implications for both the current state of the polled +device and the parent bridge, when present. It's not sufficient to assume +the bridge remains in D0 and cases have been observed where the bridge +passes the D0 test, but the PM state indicates RPM_SUSPENDING and config +space of the polled device becomes inaccessible during pci_pme_wakeup(). + +Therefore, since the bridge is already effectively required to be in the +RPM_ACTIVE state, formalize this in the code and elevate the PM usage count +to maintain the state while polling the subordinate device. + +This resolves a regression reported in the bugzilla below where a +Thunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint +downstream of a bridge in a D3hot power state. + +Link: https://lore.kernel.org/r/20240123185548.1040096-1-alex.williamson@redhat.com +Fixes: d3fcd7360338 ("PCI: Fix runtime PM race with PME polling") +Reported-by: Sanath S +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218360 +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Tested-by: Sanath S +Reviewed-by: Rafael J. Wysocki +Cc: Lukas Wunner +Cc: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 37 ++++++++++++++++++++++--------------- + 1 file changed, 22 insertions(+), 15 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 59d6cb1a3a9d..06fc6f532d6c 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2434,29 +2434,36 @@ static void pci_pme_list_scan(struct work_struct *work) + if (pdev->pme_poll) { + struct pci_dev *bridge = pdev->bus->self; + struct device *dev = &pdev->dev; +- int pm_status; ++ struct device *bdev = bridge ? &bridge->dev : NULL; ++ int bref = 0; + + /* +- * If bridge is in low power state, the +- * configuration space of subordinate devices +- * may be not accessible ++ * If we have a bridge, it should be in an active/D0 ++ * state or the configuration space of subordinate ++ * devices may not be accessible or stable over the ++ * course of the call. + */ +- if (bridge && bridge->current_state != PCI_D0) +- continue; ++ if (bdev) { ++ bref = pm_runtime_get_if_active(bdev, true); ++ if (!bref) ++ continue; ++ ++ if (bridge->current_state != PCI_D0) ++ goto put_bridge; ++ } + + /* +- * If the device is in a low power state it +- * should not be polled either. ++ * The device itself should be suspended but config ++ * space must be accessible, therefore it cannot be in ++ * D3cold. + */ +- pm_status = pm_runtime_get_if_active(dev, true); +- if (!pm_status) +- continue; +- +- if (pdev->current_state != PCI_D3cold) ++ if (pm_runtime_suspended(dev) && ++ pdev->current_state != PCI_D3cold) + pci_pme_wakeup(pdev, NULL); + +- if (pm_status > 0) +- pm_runtime_put(dev); ++put_bridge: ++ if (bref > 0) ++ pm_runtime_put(bdev); + } else { + list_del(&pme_dev->list); + kfree(pme_dev); +-- +2.43.0 + diff --git a/queue-6.6/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch b/queue-6.6/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch new file mode 100644 index 00000000000..a71f331b1b4 --- /dev/null +++ b/queue-6.6/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch @@ -0,0 +1,85 @@ +From ed78b4a4d36b2f5b9ccca16012141e1b85230046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 11:38:38 +0100 +Subject: powerpc/6xx: set High BAT Enable flag on G2_LE cores + +From: Matthias Schiffer + +[ Upstream commit a038a3ff8c6582404834852c043dadc73a5b68b4 ] + +MMU_FTR_USE_HIGH_BATS is set for G2_LE cores and derivatives like e300cX, +but the high BATs need to be enabled in HID2 to work. Add register +definitions and add the needed setup to __setup_cpu_603. + +This fixes boot on CPUs like the MPC5200B with STRICT_KERNEL_RWX enabled +on systems where the flag has not been set by the bootloader already. + +Fixes: e4d6654ebe6e ("powerpc/mm/32s: rework mmu_mapin_ram()") +Signed-off-by: Matthias Schiffer +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240124103838.43675-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg.h | 2 ++ + arch/powerpc/kernel/cpu_setup_6xx.S | 20 +++++++++++++++++++- + 2 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 4ae4ab9090a2..ade5f094dbd2 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -617,6 +617,8 @@ + #endif + #define SPRN_HID2 0x3F8 /* Hardware Implementation Register 2 */ + #define SPRN_HID2_GEKKO 0x398 /* Gekko HID2 Register */ ++#define SPRN_HID2_G2_LE 0x3F3 /* G2_LE HID2 Register */ ++#define HID2_G2_LE_HBE (1<<18) /* High BAT Enable (G2_LE) */ + #define SPRN_IABR 0x3F2 /* Instruction Address Breakpoint Register */ + #define SPRN_IABR2 0x3FA /* 83xx */ + #define SPRN_IBCR 0x135 /* 83xx Insn Breakpoint Control Reg */ +diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S +index f29ce3dd6140..bfd3f442e5eb 100644 +--- a/arch/powerpc/kernel/cpu_setup_6xx.S ++++ b/arch/powerpc/kernel/cpu_setup_6xx.S +@@ -26,6 +26,15 @@ BEGIN_FTR_SECTION + bl __init_fpu_registers + END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE) + bl setup_common_caches ++ ++ /* ++ * This assumes that all cores using __setup_cpu_603 with ++ * MMU_FTR_USE_HIGH_BATS are G2_LE compatible ++ */ ++BEGIN_MMU_FTR_SECTION ++ bl setup_g2_le_hid2 ++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) ++ + mtlr r5 + blr + _GLOBAL(__setup_cpu_604) +@@ -115,6 +124,16 @@ SYM_FUNC_START_LOCAL(setup_604_hid0) + blr + SYM_FUNC_END(setup_604_hid0) + ++/* Enable high BATs for G2_LE and derivatives like e300cX */ ++SYM_FUNC_START_LOCAL(setup_g2_le_hid2) ++ mfspr r11,SPRN_HID2_G2_LE ++ oris r11,r11,HID2_G2_LE_HBE@h ++ mtspr SPRN_HID2_G2_LE,r11 ++ sync ++ isync ++ blr ++SYM_FUNC_END(setup_g2_le_hid2) ++ + /* 7400 <= rev 2.7 and 7410 rev = 1.0 suffer from some + * erratas we work around here. + * Moto MPC710CE.pdf describes them, those are errata +@@ -495,4 +514,3 @@ _GLOBAL(__restore_cpu_setup) + mtcr r7 + blr + _ASM_NOKPROBE_SYMBOL(__restore_cpu_setup) +- +-- +2.43.0 + diff --git a/queue-6.6/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch b/queue-6.6/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch new file mode 100644 index 00000000000..c743b68f183 --- /dev/null +++ b/queue-6.6/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch @@ -0,0 +1,63 @@ +From 01b22d1edacbebd413ff3293faf96102f542bfbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 09:45:59 +0800 +Subject: powerpc/kasan: Fix addr error caused by page alignment + +From: Jiangfeng Xiao + +[ Upstream commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 ] + +In kasan_init_region, when k_start is not page aligned, at the begin of +for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then +`va = block + k_cur - k_start` is less than block, the addr va is invalid, +because the memory address space from va to block is not alloced by +memblock_alloc, which will not be reserved by memblock_reserve later, it +will be used by other places. + +As a result, memory overwriting occurs. + +for example: +int __init __weak kasan_init_region(void *start, size_t size) +{ +[...] + /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ + block = memblock_alloc(k_end - k_start, PAGE_SIZE); + [...] + for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { + /* at the begin of for loop + * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) + * va(dcd96c00) is less than block(dcd97000), va is invalid + */ + void *va = block + k_cur - k_start; + [...] + } +[...] +} + +Therefore, page alignment is performed on k_start before +memblock_alloc() to ensure the validity of the VA address. + +Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") +Signed-off-by: Jiangfeng Xiao +Signed-off-by: Michael Ellerman +Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/kasan/init_32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/mm/kasan/init_32.c b/arch/powerpc/mm/kasan/init_32.c +index a70828a6d935..aa9aa11927b2 100644 +--- a/arch/powerpc/mm/kasan/init_32.c ++++ b/arch/powerpc/mm/kasan/init_32.c +@@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) + if (ret) + return ret; + ++ k_start = k_start & PAGE_MASK; + block = memblock_alloc(k_end - k_start, PAGE_SIZE); + if (!block) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/powerpc-kasan-limit-kasan-thread-size-increase-to-32.patch b/queue-6.6/powerpc-kasan-limit-kasan-thread-size-increase-to-32.patch new file mode 100644 index 00000000000..b4cb951e50d --- /dev/null +++ b/queue-6.6/powerpc-kasan-limit-kasan-thread-size-increase-to-32.patch @@ -0,0 +1,54 @@ +From b34bc3cbd03c000a1654eedfb0bc2655eccc9c5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 17:42:44 +1100 +Subject: powerpc/kasan: Limit KASAN thread size increase to 32KB + +From: Michael Ellerman + +[ Upstream commit f1acb109505d983779bbb7e20a1ee6244d2b5736 ] + +KASAN is seen to increase stack usage, to the point that it was reported +to lead to stack overflow on some 32-bit machines (see link). + +To avoid overflows the stack size was doubled for KASAN builds in +commit 3e8635fb2e07 ("powerpc/kasan: Force thread size increase with +KASAN"). + +However with a 32KB stack size to begin with, the doubling leads to a +64KB stack, which causes build errors: + arch/powerpc/kernel/switch.S:249: Error: operand out of range (0x000000000000fe50 is not between 0xffffffffffff8000 and 0x0000000000007fff) + +Although the asm could be reworked, in practice a 32KB stack seems +sufficient even for KASAN builds - the additional usage seems to be in +the 2-3KB range for a 64-bit KASAN build. + +So only increase the stack for KASAN if the stack size is < 32KB. + +Fixes: 18f14afe2816 ("powerpc/64s: Increase default stack size to 32KB") +Reported-by: Spoorthy +Reported-by: Benjamin Gray +Reviewed-by: Benjamin Gray +Link: https://lore.kernel.org/linuxppc-dev/bug-207129-206035@https.bugzilla.kernel.org%2F/ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240212064244.3924505-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/thread_info.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h +index bf5dde1a4114..15c5691dd218 100644 +--- a/arch/powerpc/include/asm/thread_info.h ++++ b/arch/powerpc/include/asm/thread_info.h +@@ -14,7 +14,7 @@ + + #ifdef __KERNEL__ + +-#ifdef CONFIG_KASAN ++#if defined(CONFIG_KASAN) && CONFIG_THREAD_SHIFT < 15 + #define MIN_THREAD_SHIFT (CONFIG_THREAD_SHIFT + 1) + #else + #define MIN_THREAD_SHIFT CONFIG_THREAD_SHIFT +-- +2.43.0 + diff --git a/queue-6.6/powerpc-pseries-iommu-fix-iommu-initialisation-durin.patch b/queue-6.6/powerpc-pseries-iommu-fix-iommu-initialisation-durin.patch new file mode 100644 index 00000000000..b416219c795 --- /dev/null +++ b/queue-6.6/powerpc-pseries-iommu-fix-iommu-initialisation-durin.patch @@ -0,0 +1,155 @@ +From 4dd8aa8da0f38ce395feb16cf3f1223c27f1b9f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 16:24:07 -0600 +Subject: powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add + +From: Gaurav Batra + +[ Upstream commit ed8b94f6e0acd652ce69bd69d678a0c769172df8 ] + +When a PCI device is dynamically added, the kernel oopses with a NULL +pointer dereference: + + BUG: Kernel NULL pointer dereference on read at 0x00000030 + Faulting instruction address: 0xc0000000006bbe5c + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries + Modules linked in: rpadlpar_io rpaphp rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs xsk_diag bonding nft_compat nf_tables nfnetlink rfkill binfmt_misc dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_umad ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_ib ib_uverbs ib_core pseries_rng drm drm_panel_orientation_quirks xfs libcrc32c mlx5_core mlxfw sd_mod t10_pi sg tls ibmvscsi ibmveth scsi_transport_srp vmx_crypto pseries_wdt psample dm_mirror dm_region_hash dm_log dm_mod fuse + CPU: 17 PID: 2685 Comm: drmgr Not tainted 6.7.0-203405+ #66 + Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries + NIP: c0000000006bbe5c LR: c000000000a13e68 CTR: c0000000000579f8 + REGS: c00000009924f240 TRAP: 0300 Not tainted (6.7.0-203405+) + MSR: 8000000000009033 CR: 24002220 XER: 20040006 + CFAR: c000000000a13e64 DAR: 0000000000000030 DSISR: 40000000 IRQMASK: 0 + ... + NIP sysfs_add_link_to_group+0x34/0x94 + LR iommu_device_link+0x5c/0x118 + Call Trace: + iommu_init_device+0x26c/0x318 (unreliable) + iommu_device_link+0x5c/0x118 + iommu_init_device+0xa8/0x318 + iommu_probe_device+0xc0/0x134 + iommu_bus_notifier+0x44/0x104 + notifier_call_chain+0xb8/0x19c + blocking_notifier_call_chain+0x64/0x98 + bus_notify+0x50/0x7c + device_add+0x640/0x918 + pci_device_add+0x23c/0x298 + of_create_pci_dev+0x400/0x884 + of_scan_pci_dev+0x124/0x1b0 + __of_scan_bus+0x78/0x18c + pcibios_scan_phb+0x2a4/0x3b0 + init_phb_dynamic+0xb8/0x110 + dlpar_add_slot+0x170/0x3b8 [rpadlpar_io] + add_slot_store.part.0+0xb4/0x130 [rpadlpar_io] + kobj_attr_store+0x2c/0x48 + sysfs_kf_write+0x64/0x78 + kernfs_fop_write_iter+0x1b0/0x290 + vfs_write+0x350/0x4a0 + ksys_write+0x84/0x140 + system_call_exception+0x124/0x330 + system_call_vectored_common+0x15c/0x2ec + +Commit a940904443e4 ("powerpc/iommu: Add iommu_ops to report capabilities +and allow blocking domains") broke DLPAR add of PCI devices. + +The above added iommu_device structure to pci_controller. During +system boot, PCI devices are discovered and this newly added iommu_device +structure is initialized by a call to iommu_device_register(). + +During DLPAR add of a PCI device, a new pci_controller structure is +allocated but there are no calls made to iommu_device_register() +interface. + +Fix is to register the iommu device during DLPAR add as well. + +Fixes: a940904443e4 ("powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains") +Signed-off-by: Gaurav Batra +[mpe: Trim oops and tweak some change log wording] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240122222407.39603-1-gbatra@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ppc-pci.h | 3 +++ + arch/powerpc/kernel/iommu.c | 21 ++++++++++++++++----- + arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++ + 3 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/ppc-pci.h b/arch/powerpc/include/asm/ppc-pci.h +index d9fcff575027..e500a7b9d1b5 100644 +--- a/arch/powerpc/include/asm/ppc-pci.h ++++ b/arch/powerpc/include/asm/ppc-pci.h +@@ -29,6 +29,9 @@ void *pci_traverse_device_nodes(struct device_node *start, + void *(*fn)(struct device_node *, void *), + void *data); + extern void pci_devs_phb_init_dynamic(struct pci_controller *phb); ++extern void ppc_iommu_register_device(struct pci_controller *phb); ++extern void ppc_iommu_unregister_device(struct pci_controller *phb); ++ + + /* From rtas_pci.h */ + extern void init_pci_config_tokens (void); +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index 14251bc5219e..7e23cc03c06c 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -1393,6 +1393,21 @@ static const struct attribute_group *spapr_tce_iommu_groups[] = { + NULL, + }; + ++void ppc_iommu_register_device(struct pci_controller *phb) ++{ ++ iommu_device_sysfs_add(&phb->iommu, phb->parent, ++ spapr_tce_iommu_groups, "iommu-phb%04x", ++ phb->global_number); ++ iommu_device_register(&phb->iommu, &spapr_tce_iommu_ops, ++ phb->parent); ++} ++ ++void ppc_iommu_unregister_device(struct pci_controller *phb) ++{ ++ iommu_device_unregister(&phb->iommu); ++ iommu_device_sysfs_remove(&phb->iommu); ++} ++ + /* + * This registers IOMMU devices of PHBs. This needs to happen + * after core_initcall(iommu_init) + postcore_initcall(pci_driver_init) and +@@ -1403,11 +1418,7 @@ static int __init spapr_tce_setup_phb_iommus_initcall(void) + struct pci_controller *hose; + + list_for_each_entry(hose, &hose_list, list_node) { +- iommu_device_sysfs_add(&hose->iommu, hose->parent, +- spapr_tce_iommu_groups, "iommu-phb%04x", +- hose->global_number); +- iommu_device_register(&hose->iommu, &spapr_tce_iommu_ops, +- hose->parent); ++ ppc_iommu_register_device(hose); + } + return 0; + } +diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c +index 4ba824568119..4448386268d9 100644 +--- a/arch/powerpc/platforms/pseries/pci_dlpar.c ++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c +@@ -35,6 +35,8 @@ struct pci_controller *init_phb_dynamic(struct device_node *dn) + + pseries_msi_allocate_domains(phb); + ++ ppc_iommu_register_device(phb); ++ + /* Create EEH devices for the PHB */ + eeh_phb_pe_create(phb); + +@@ -76,6 +78,8 @@ int remove_phb_dynamic(struct pci_controller *phb) + } + } + ++ ppc_iommu_unregister_device(phb); ++ + pseries_msi_free_domains(phb); + + /* Keep a reference so phb isn't freed yet */ +-- +2.43.0 + diff --git a/queue-6.6/revert-kobject-remove-redundant-checks-for-whether-k.patch b/queue-6.6/revert-kobject-remove-redundant-checks-for-whether-k.patch new file mode 100644 index 00000000000..bcb9a934edf --- /dev/null +++ b/queue-6.6/revert-kobject-remove-redundant-checks-for-whether-k.patch @@ -0,0 +1,94 @@ +From c1845b876f233db30930e93dc0d9e43d3d3a95b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 16:02:50 +0000 +Subject: Revert "kobject: Remove redundant checks for whether ktype is NULL" + +From: Greg Kroah-Hartman + +[ Upstream commit 3ca8fbabcceb8bfe44f7f50640092fd8f1de375c ] + +This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31. + +It is reported to cause problems, so revert it for now until the root +cause can be found. + +Reported-by: kernel test robot +Fixes: 1b28cb81dab7 ("kobject: Remove redundant checks for whether ktype is NULL") +Cc: Zhen Lei +Closes: https://lore.kernel.org/oe-lkp/202402071403.e302e33a-oliver.sang@intel.com +Link: https://lore.kernel.org/r/2024020849-consensus-length-6264@gregkh +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/kobject.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/lib/kobject.c b/lib/kobject.c +index 59dbcbdb1c91..72fa20f405f1 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -74,10 +74,12 @@ static int create_dir(struct kobject *kobj) + if (error) + return error; + +- error = sysfs_create_groups(kobj, ktype->default_groups); +- if (error) { +- sysfs_remove_dir(kobj); +- return error; ++ if (ktype) { ++ error = sysfs_create_groups(kobj, ktype->default_groups); ++ if (error) { ++ sysfs_remove_dir(kobj); ++ return error; ++ } + } + + /* +@@ -589,7 +591,8 @@ static void __kobject_del(struct kobject *kobj) + sd = kobj->sd; + ktype = get_ktype(kobj); + +- sysfs_remove_groups(kobj, ktype->default_groups); ++ if (ktype) ++ sysfs_remove_groups(kobj, ktype->default_groups); + + /* send "remove" if the caller did not do it but sent "add" */ + if (kobj->state_add_uevent_sent && !kobj->state_remove_uevent_sent) { +@@ -666,6 +669,10 @@ static void kobject_cleanup(struct kobject *kobj) + pr_debug("'%s' (%p): %s, parent %p\n", + kobject_name(kobj), kobj, __func__, kobj->parent); + ++ if (t && !t->release) ++ pr_debug("'%s' (%p): does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst.\n", ++ kobject_name(kobj), kobj); ++ + /* remove from sysfs if the caller did not do it */ + if (kobj->state_in_sysfs) { + pr_debug("'%s' (%p): auto cleanup kobject_del\n", +@@ -676,13 +683,10 @@ static void kobject_cleanup(struct kobject *kobj) + parent = NULL; + } + +- if (t->release) { ++ if (t && t->release) { + pr_debug("'%s' (%p): calling ktype release\n", + kobject_name(kobj), kobj); + t->release(kobj); +- } else { +- pr_debug("'%s' (%p): does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst.\n", +- kobject_name(kobj), kobj); + } + + /* free name if we allocated it */ +@@ -1056,7 +1060,7 @@ const struct kobj_ns_type_operations *kobj_child_ns_ops(const struct kobject *pa + { + const struct kobj_ns_type_operations *ops = NULL; + +- if (parent && parent->ktype->child_ns_type) ++ if (parent && parent->ktype && parent->ktype->child_ns_type) + ops = parent->ktype->child_ns_type(parent); + + return ops; +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 1a42a58a5ba..a923d3c99cf 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -82,3 +82,23 @@ usb-f_mass_storage-forbid-async-queue-when-shutdown-happen.patch usb-chipidea-core-handle-power-lost-in-workqueue.patch usb-core-prevent-null-pointer-dereference-in-update_port_device_state.patch usb-dwc3-gadget-fix-null-pointer-dereference-in-dwc3_gadget_suspend.patch +interconnect-qcom-sc8180x-mark-co0-bcm-keepalive.patch +interconnect-qcom-sm8550-enable-sync_state.patch +media-ir_toy-fix-a-memleak-in-irtoy_tx.patch +driver-core-fw_devlink-improve-detection-of-overlapp.patch +powerpc-pseries-iommu-fix-iommu-initialisation-durin.patch +powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch +powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch +revert-kobject-remove-redundant-checks-for-whether-k.patch +pci-fix-active-state-requirement-in-pme-polling.patch +iio-adc-ad4130-zero-initialize-clock-init-data.patch +iio-adc-ad4130-only-set-gpio_ctrl-if-pin-is-unused.patch +cifs-fix-underflow-in-parse_server_interfaces.patch +i2c-qcom-geni-correct-i2c-tre-sequence.patch +irqchip-loongson-eiointc-use-correct-struct-type-in-.patch +irqchip-gic-v3-its-handle-non-coherent-gicv4-redistr.patch +powerpc-kasan-limit-kasan-thread-size-increase-to-32.patch +i2c-pasemi-split-driver-into-two-separate-modules.patch +i2c-i801-fix-block-process-call-transactions.patch +modpost-trim-leading-spaces-when-processing-source-f.patch +kallsyms-ignore-armv4-thunks-along-with-others.patch