From: Greg Kroah-Hartman Date: Mon, 4 May 2026 09:54:59 +0000 (+0200) Subject: 7.0-stable patches X-Git-Tag: v6.12.86~24 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6062f5e1aeb948c9529aa2e7aea35a4689695231;p=thirdparty%2Fkernel%2Fstable-queue.git 7.0-stable patches added patches: iio-frequency-admv1013-add-dev-variable.patch iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch mei-me-add-nova-lake-point-h-did.patch mei-me-use-pci_device_data-macro.patch mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch mm-various-small-mmap_prepare-cleanups.patch perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch --- diff --git a/queue-7.0/iio-frequency-admv1013-add-dev-variable.patch b/queue-7.0/iio-frequency-admv1013-add-dev-variable.patch new file mode 100644 index 0000000000..5dcb96f2b5 --- /dev/null +++ b/queue-7.0/iio-frequency-admv1013-add-dev-variable.patch @@ -0,0 +1,118 @@ +From stable+bounces-242629-greg=kroah.com@vger.kernel.org Sun May 3 02:40:18 2026 +From: Sasha Levin +Date: Sat, 2 May 2026 20:40:01 -0400 +Subject: iio: frequency: admv1013: add dev variable +To: stable@vger.kernel.org +Cc: Antoniu Miclaus , Andy Shevchenko , Jonathan Cameron , Sasha Levin +Message-ID: <20260503004002.933311-1-sashal@kernel.org> + +From: Antoniu Miclaus + +[ Upstream commit e61b5bb0e91390adee41eaddc0a1a7d55d5652b2 ] + +Introduce a local struct device pointer in functions that reference +&spi->dev for device-managed resource calls and device property reads, +improving code readability. + +Signed-off-by: Antoniu Miclaus +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Stable-dep-of: aac0a51b1670 ("iio: frequency: admv1013: fix NULL pointer dereference on str") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/frequency/admv1013.c | 29 +++++++++++++++-------------- + 1 file changed, 15 insertions(+), 14 deletions(-) + +--- a/drivers/iio/frequency/admv1013.c ++++ b/drivers/iio/frequency/admv1013.c +@@ -518,11 +518,11 @@ static int admv1013_properties_parse(str + { + int ret; + const char *str; +- struct spi_device *spi = st->spi; ++ struct device *dev = &st->spi->dev; + +- st->det_en = device_property_read_bool(&spi->dev, "adi,detector-enable"); ++ st->det_en = device_property_read_bool(dev, "adi,detector-enable"); + +- ret = device_property_read_string(&spi->dev, "adi,input-mode", &str); ++ ret = device_property_read_string(dev, "adi,input-mode", &str); + if (ret) + st->input_mode = ADMV1013_IQ_MODE; + +@@ -533,7 +533,7 @@ static int admv1013_properties_parse(str + else + return -EINVAL; + +- ret = device_property_read_string(&spi->dev, "adi,quad-se-mode", &str); ++ ret = device_property_read_string(dev, "adi,quad-se-mode", &str); + if (ret) + st->quad_se_mode = ADMV1013_SE_MODE_DIFF; + +@@ -546,11 +546,11 @@ static int admv1013_properties_parse(str + else + return -EINVAL; + +- ret = devm_regulator_bulk_get_enable(&st->spi->dev, ++ ret = devm_regulator_bulk_get_enable(dev, + ARRAY_SIZE(admv1013_vcc_regs), + admv1013_vcc_regs); + if (ret) { +- dev_err_probe(&spi->dev, ret, ++ dev_err_probe(dev, ret, + "Failed to request VCC regulators\n"); + return ret; + } +@@ -562,9 +562,10 @@ static int admv1013_probe(struct spi_dev + { + struct iio_dev *indio_dev; + struct admv1013_state *st; ++ struct device *dev = &spi->dev; + int ret, vcm_uv; + +- indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st)); ++ indio_dev = devm_iio_device_alloc(dev, sizeof(*st)); + if (!indio_dev) + return -ENOMEM; + +@@ -581,20 +582,20 @@ static int admv1013_probe(struct spi_dev + if (ret) + return ret; + +- ret = devm_regulator_get_enable_read_voltage(&spi->dev, "vcm"); ++ ret = devm_regulator_get_enable_read_voltage(dev, "vcm"); + if (ret < 0) +- return dev_err_probe(&spi->dev, ret, ++ return dev_err_probe(dev, ret, + "failed to get the common-mode voltage\n"); + + vcm_uv = ret; + +- st->clkin = devm_clk_get_enabled(&spi->dev, "lo_in"); ++ st->clkin = devm_clk_get_enabled(dev, "lo_in"); + if (IS_ERR(st->clkin)) +- return dev_err_probe(&spi->dev, PTR_ERR(st->clkin), ++ return dev_err_probe(dev, PTR_ERR(st->clkin), + "failed to get the LO input clock\n"); + + st->nb.notifier_call = admv1013_freq_change; +- ret = devm_clk_notifier_register(&spi->dev, st->clkin, &st->nb); ++ ret = devm_clk_notifier_register(dev, st->clkin, &st->nb); + if (ret) + return ret; + +@@ -606,11 +607,11 @@ static int admv1013_probe(struct spi_dev + return ret; + } + +- ret = devm_add_action_or_reset(&spi->dev, admv1013_powerdown, st); ++ ret = devm_add_action_or_reset(dev, admv1013_powerdown, st); + if (ret) + return ret; + +- return devm_iio_device_register(&spi->dev, indio_dev); ++ return devm_iio_device_register(dev, indio_dev); + } + + static const struct spi_device_id admv1013_id[] = { diff --git a/queue-7.0/iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch b/queue-7.0/iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch new file mode 100644 index 0000000000..9a3f2993e7 --- /dev/null +++ b/queue-7.0/iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch @@ -0,0 +1,133 @@ +From stable+bounces-242631-greg=kroah.com@vger.kernel.org Sun May 3 02:40:26 2026 +From: Sasha Levin +Date: Sat, 2 May 2026 20:40:02 -0400 +Subject: iio: frequency: admv1013: fix NULL pointer dereference on str +To: stable@vger.kernel.org +Cc: "Antoniu Miclaus" , "Nuno Sá" , "Andy Shevchenko" , Stable@vger.kernel.org, "Jonathan Cameron" , "Sasha Levin" +Message-ID: <20260503004002.933311-2-sashal@kernel.org> + +From: Antoniu Miclaus + +[ Upstream commit aac0a51b16700b403a55b67ba495de021db78763 ] + +When device_property_read_string() fails, str is left uninitialized +but the code falls through to strcmp(str, ...), dereferencing a garbage +pointer. Replace manual read/strcmp with +device_property_match_property_string() and consolidate the SE mode +enums into a single sequential enum, mapping to hardware register +values via a switch consistent with other bitfields in the driver. + +Several cleanup patches have been applied to this driver recently so +this will need a manual backport. + +Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013") +Reviewed-by: Nuno Sá +Signed-off-by: Antoniu Miclaus +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/frequency/admv1013.c | 67 ++++++++++++++++++++++----------------- + 1 file changed, 38 insertions(+), 29 deletions(-) + +--- a/drivers/iio/frequency/admv1013.c ++++ b/drivers/iio/frequency/admv1013.c +@@ -85,9 +85,9 @@ enum { + }; + + enum { +- ADMV1013_SE_MODE_POS = 6, +- ADMV1013_SE_MODE_NEG = 9, +- ADMV1013_SE_MODE_DIFF = 12 ++ ADMV1013_SE_MODE_POS, ++ ADMV1013_SE_MODE_NEG, ++ ADMV1013_SE_MODE_DIFF, + }; + + struct admv1013_state { +@@ -470,10 +470,23 @@ static int admv1013_init(struct admv1013 + if (ret) + return ret; + +- data = FIELD_PREP(ADMV1013_QUAD_SE_MODE_MSK, st->quad_se_mode); ++ switch (st->quad_se_mode) { ++ case ADMV1013_SE_MODE_POS: ++ data = 6; ++ break; ++ case ADMV1013_SE_MODE_NEG: ++ data = 9; ++ break; ++ case ADMV1013_SE_MODE_DIFF: ++ data = 12; ++ break; ++ default: ++ return -EINVAL; ++ } + + ret = __admv1013_spi_update_bits(st, ADMV1013_REG_QUAD, +- ADMV1013_QUAD_SE_MODE_MSK, data); ++ ADMV1013_QUAD_SE_MODE_MSK, ++ FIELD_PREP(ADMV1013_QUAD_SE_MODE_MSK, data)); + if (ret) + return ret; + +@@ -514,37 +527,33 @@ static void admv1013_powerdown(void *dat + admv1013_spi_update_bits(data, ADMV1013_REG_ENABLE, enable_reg_msk, enable_reg); + } + ++static const char * const admv1013_input_modes[] = { ++ [ADMV1013_IQ_MODE] = "iq", ++ [ADMV1013_IF_MODE] = "if", ++}; ++ ++static const char * const admv1013_quad_se_modes[] = { ++ [ADMV1013_SE_MODE_POS] = "se-pos", ++ [ADMV1013_SE_MODE_NEG] = "se-neg", ++ [ADMV1013_SE_MODE_DIFF] = "diff", ++}; ++ + static int admv1013_properties_parse(struct admv1013_state *st) + { + int ret; +- const char *str; + struct device *dev = &st->spi->dev; + + st->det_en = device_property_read_bool(dev, "adi,detector-enable"); + +- ret = device_property_read_string(dev, "adi,input-mode", &str); +- if (ret) +- st->input_mode = ADMV1013_IQ_MODE; +- +- if (!strcmp(str, "iq")) +- st->input_mode = ADMV1013_IQ_MODE; +- else if (!strcmp(str, "if")) +- st->input_mode = ADMV1013_IF_MODE; +- else +- return -EINVAL; +- +- ret = device_property_read_string(dev, "adi,quad-se-mode", &str); +- if (ret) +- st->quad_se_mode = ADMV1013_SE_MODE_DIFF; +- +- if (!strcmp(str, "diff")) +- st->quad_se_mode = ADMV1013_SE_MODE_DIFF; +- else if (!strcmp(str, "se-pos")) +- st->quad_se_mode = ADMV1013_SE_MODE_POS; +- else if (!strcmp(str, "se-neg")) +- st->quad_se_mode = ADMV1013_SE_MODE_NEG; +- else +- return -EINVAL; ++ ret = device_property_match_property_string(dev, "adi,input-mode", ++ admv1013_input_modes, ++ ARRAY_SIZE(admv1013_input_modes)); ++ st->input_mode = ret >= 0 ? ret : ADMV1013_IQ_MODE; ++ ++ ret = device_property_match_property_string(dev, "adi,quad-se-mode", ++ admv1013_quad_se_modes, ++ ARRAY_SIZE(admv1013_quad_se_modes)); ++ st->quad_se_mode = ret >= 0 ? ret : ADMV1013_SE_MODE_DIFF; + + ret = devm_regulator_bulk_get_enable(dev, + ARRAY_SIZE(admv1013_vcc_regs), diff --git a/queue-7.0/mei-me-add-nova-lake-point-h-did.patch b/queue-7.0/mei-me-add-nova-lake-point-h-did.patch new file mode 100644 index 0000000000..b76cc07a1a --- /dev/null +++ b/queue-7.0/mei-me-add-nova-lake-point-h-did.patch @@ -0,0 +1,47 @@ +From sashal@kernel.org Tue Apr 28 11:37:33 2026 +From: Sasha Levin +Date: Tue, 28 Apr 2026 05:37:29 -0400 +Subject: mei: me: add nova lake point H DID +To: stable@vger.kernel.org +Cc: Alexander Usyskin , stable , Tomas Winkler , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260428093729.2692325-2-sashal@kernel.org> + +From: Alexander Usyskin + +[ Upstream commit a5a1804332afc7035d5c5b880548262e81d796bc ] + +Add Nova Lake H device id. + +Cc: stable +Co-developed-by: Tomas Winkler +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Link: https://patch.msgid.link/20260405141758.1634556-1-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 1 + + drivers/misc/mei/pci-me.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -123,6 +123,7 @@ + #define PCI_DEVICE_ID_INTEL_MEI_WCL_P 0x4D70 /* Wildcat Lake P */ + + #define PCI_DEVICE_ID_INTEL_MEI_NVL_S 0x6E68 /* Nova Lake Point S */ ++#define PCI_DEVICE_ID_INTEL_MEI_NVL_H 0xD370 /* Nova Lake Point H */ + + /* + * MEI HW Section +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -130,6 +130,7 @@ static const struct pci_device_id mei_me + {PCI_DEVICE_DATA(INTEL, MEI_WCL_P, MEI_ME_PCH15_CFG)}, + + {PCI_DEVICE_DATA(INTEL, MEI_NVL_S, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_NVL_H, MEI_ME_PCH15_CFG)}, + + /* required last entry */ + {0, } diff --git a/queue-7.0/mei-me-use-pci_device_data-macro.patch b/queue-7.0/mei-me-use-pci_device_data-macro.patch new file mode 100644 index 0000000000..2fcd1332b1 --- /dev/null +++ b/queue-7.0/mei-me-use-pci_device_data-macro.patch @@ -0,0 +1,478 @@ +From sashal@kernel.org Tue Apr 28 11:37:32 2026 +From: Sasha Levin +Date: Tue, 28 Apr 2026 05:37:28 -0400 +Subject: mei: me: use PCI_DEVICE_DATA macro +To: stable@vger.kernel.org +Cc: Alexander Usyskin , Andy Shevchenko , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260428093729.2692325-1-sashal@kernel.org> + +From: Alexander Usyskin + +[ Upstream commit 9e7a2409ecf4d411b7cc91615b08f6a7576f0aaa ] + +Drop old local MEI_PCI_DEVICE macro and use common +PCI_DEVICE_DATA instead. +Update defines to adhere to current naming convention. + +Suggested-by: Andy Shevchenko +Reviewed-by: Andy Shevchenko +Signed-off-by: Alexander Usyskin +Link: https://patch.msgid.link/20260201094358.1440593-2-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: a5a1804332af ("mei: me: add nova lake point H DID") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/bus-fixup.c | 6 - + drivers/misc/mei/hw-me-regs.h | 162 +++++++++++++++++----------------- + drivers/misc/mei/hw-me.h | 6 - + drivers/misc/mei/pci-me.c | 200 +++++++++++++++++++++--------------------- + 4 files changed, 184 insertions(+), 190 deletions(-) + +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -303,9 +303,9 @@ static void mei_wd(struct mei_cl_device + { + struct pci_dev *pdev = to_pci_dev(cldev->dev.parent); + +- if (pdev->device == MEI_DEV_ID_WPT_LP || +- pdev->device == MEI_DEV_ID_SPT || +- pdev->device == MEI_DEV_ID_SPT_H) ++ if (pdev->device == PCI_DEVICE_ID_INTEL_MEI_WPT_LP || ++ pdev->device == PCI_DEVICE_ID_INTEL_MEI_SPT || ++ pdev->device == PCI_DEVICE_ID_INTEL_MEI_SPT_H) + cldev->me_cl->props.protocol_version = 0x2; + + cldev->do_match = 1; +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -9,120 +9,120 @@ + /* + * MEI device IDs + */ +-#define MEI_DEV_ID_82946GZ 0x2974 /* 82946GZ/GL */ +-#define MEI_DEV_ID_82G35 0x2984 /* 82G35 Express */ +-#define MEI_DEV_ID_82Q965 0x2994 /* 82Q963/Q965 */ +-#define MEI_DEV_ID_82G965 0x29A4 /* 82P965/G965 */ ++#define PCI_DEVICE_ID_INTEL_MEI_82946GZ 0x2974 /* 82946GZ/GL */ ++#define PCI_DEVICE_ID_INTEL_MEI_82G35 0x2984 /* 82G35 Express */ ++#define PCI_DEVICE_ID_INTEL_MEI_82Q965 0x2994 /* 82Q963/Q965 */ ++#define PCI_DEVICE_ID_INTEL_MEI_82G965 0x29A4 /* 82P965/G965 */ + +-#define MEI_DEV_ID_82GM965 0x2A04 /* Mobile PM965/GM965 */ +-#define MEI_DEV_ID_82GME965 0x2A14 /* Mobile GME965/GLE960 */ ++#define PCI_DEVICE_ID_INTEL_MEI_82GM965 0x2A04 /* Mobile PM965/GM965 */ ++#define PCI_DEVICE_ID_INTEL_MEI_82GME965 0x2A14 /* Mobile GME965/GLE960 */ + +-#define MEI_DEV_ID_ICH9_82Q35 0x29B4 /* 82Q35 Express */ +-#define MEI_DEV_ID_ICH9_82G33 0x29C4 /* 82G33/G31/P35/P31 Express */ +-#define MEI_DEV_ID_ICH9_82Q33 0x29D4 /* 82Q33 Express */ +-#define MEI_DEV_ID_ICH9_82X38 0x29E4 /* 82X38/X48 Express */ +-#define MEI_DEV_ID_ICH9_3200 0x29F4 /* 3200/3210 Server */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82Q35 0x29B4 /* 82Q35 Express */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82G33 0x29C4 /* 82G33/G31/P35/P31 Express */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82Q33 0x29D4 /* 82Q33 Express */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82X38 0x29E4 /* 82X38/X48 Express */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_3200 0x29F4 /* 3200/3210 Server */ + +-#define MEI_DEV_ID_ICH9_6 0x28B4 /* Bearlake */ +-#define MEI_DEV_ID_ICH9_7 0x28C4 /* Bearlake */ +-#define MEI_DEV_ID_ICH9_8 0x28D4 /* Bearlake */ +-#define MEI_DEV_ID_ICH9_9 0x28E4 /* Bearlake */ +-#define MEI_DEV_ID_ICH9_10 0x28F4 /* Bearlake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_6 0x28B4 /* Bearlake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_7 0x28C4 /* Bearlake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_8 0x28D4 /* Bearlake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_9 0x28E4 /* Bearlake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_10 0x28F4 /* Bearlake */ + +-#define MEI_DEV_ID_ICH9M_1 0x2A44 /* Cantiga */ +-#define MEI_DEV_ID_ICH9M_2 0x2A54 /* Cantiga */ +-#define MEI_DEV_ID_ICH9M_3 0x2A64 /* Cantiga */ +-#define MEI_DEV_ID_ICH9M_4 0x2A74 /* Cantiga */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_1 0x2A44 /* Cantiga */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_2 0x2A54 /* Cantiga */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_3 0x2A64 /* Cantiga */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_4 0x2A74 /* Cantiga */ + +-#define MEI_DEV_ID_ICH10_1 0x2E04 /* Eaglelake */ +-#define MEI_DEV_ID_ICH10_2 0x2E14 /* Eaglelake */ +-#define MEI_DEV_ID_ICH10_3 0x2E24 /* Eaglelake */ +-#define MEI_DEV_ID_ICH10_4 0x2E34 /* Eaglelake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_1 0x2E04 /* Eaglelake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_2 0x2E14 /* Eaglelake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_3 0x2E24 /* Eaglelake */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_4 0x2E34 /* Eaglelake */ + +-#define MEI_DEV_ID_IBXPK_1 0x3B64 /* Calpella */ +-#define MEI_DEV_ID_IBXPK_2 0x3B65 /* Calpella */ ++#define PCI_DEVICE_ID_INTEL_MEI_IBXPK_1 0x3B64 /* Calpella */ ++#define PCI_DEVICE_ID_INTEL_MEI_IBXPK_2 0x3B65 /* Calpella */ + +-#define MEI_DEV_ID_CPT_1 0x1C3A /* Couger Point */ +-#define MEI_DEV_ID_PBG_1 0x1D3A /* C600/X79 Patsburg */ ++#define PCI_DEVICE_ID_INTEL_MEI_CPT_1 0x1C3A /* Couger Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_PBG_1 0x1D3A /* C600/X79 Patsburg */ + +-#define MEI_DEV_ID_PPT_1 0x1E3A /* Panther Point */ +-#define MEI_DEV_ID_PPT_2 0x1CBA /* Panther Point */ +-#define MEI_DEV_ID_PPT_3 0x1DBA /* Panther Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_PPT_1 0x1E3A /* Panther Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_PPT_2 0x1CBA /* Panther Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_PPT_3 0x1DBA /* Panther Point */ + +-#define MEI_DEV_ID_LPT_H 0x8C3A /* Lynx Point H */ +-#define MEI_DEV_ID_LPT_W 0x8D3A /* Lynx Point - Wellsburg */ +-#define MEI_DEV_ID_LPT_LP 0x9C3A /* Lynx Point LP */ +-#define MEI_DEV_ID_LPT_HR 0x8CBA /* Lynx Point H Refresh */ ++#define PCI_DEVICE_ID_INTEL_MEI_LPT_H 0x8C3A /* Lynx Point H */ ++#define PCI_DEVICE_ID_INTEL_MEI_LPT_W 0x8D3A /* Lynx Point - Wellsburg */ ++#define PCI_DEVICE_ID_INTEL_MEI_LPT_LP 0x9C3A /* Lynx Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_LPT_HR 0x8CBA /* Lynx Point H Refresh */ + +-#define MEI_DEV_ID_WPT_LP 0x9CBA /* Wildcat Point LP */ +-#define MEI_DEV_ID_WPT_LP_2 0x9CBB /* Wildcat Point LP 2 */ ++#define PCI_DEVICE_ID_INTEL_MEI_WPT_LP 0x9CBA /* Wildcat Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_WPT_LP_2 0x9CBB /* Wildcat Point LP 2 */ + +-#define MEI_DEV_ID_SPT 0x9D3A /* Sunrise Point */ +-#define MEI_DEV_ID_SPT_2 0x9D3B /* Sunrise Point 2 */ +-#define MEI_DEV_ID_SPT_3 0x9D3E /* Sunrise Point 3 (iToutch) */ +-#define MEI_DEV_ID_SPT_H 0xA13A /* Sunrise Point H */ +-#define MEI_DEV_ID_SPT_H_2 0xA13B /* Sunrise Point H 2 */ ++#define PCI_DEVICE_ID_INTEL_MEI_SPT 0x9D3A /* Sunrise Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_SPT_2 0x9D3B /* Sunrise Point 2 */ ++#define PCI_DEVICE_ID_INTEL_MEI_SPT_3 0x9D3E /* Sunrise Point 3 (iToutch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_SPT_H 0xA13A /* Sunrise Point H */ ++#define PCI_DEVICE_ID_INTEL_MEI_SPT_H_2 0xA13B /* Sunrise Point H 2 */ + +-#define MEI_DEV_ID_LBG 0xA1BA /* Lewisburg (SPT) */ ++#define PCI_DEVICE_ID_INTEL_MEI_LBG 0xA1BA /* Lewisburg (SPT) */ + +-#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ +-#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ ++#define PCI_DEVICE_ID_INTEL_MEI_BXT_M 0x1A9A /* Broxton M */ ++#define PCI_DEVICE_ID_INTEL_MEI_APL_I 0x5A9A /* Apollo Lake I */ + +-#define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */ ++#define PCI_DEVICE_ID_INTEL_MEI_DNV_IE 0x19E5 /* Denverton IE */ + +-#define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */ ++#define PCI_DEVICE_ID_INTEL_MEI_GLK 0x319A /* Gemini Lake */ + +-#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ +-#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ +-#define MEI_DEV_ID_KBP_3 0xA2BE /* Kaby Point 3 (iTouch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_KBP 0xA2BA /* Kaby Point */ ++#define PCI_DEVICE_ID_INTEL_MEI_KBP_2 0xA2BB /* Kaby Point 2 */ ++#define PCI_DEVICE_ID_INTEL_MEI_KBP_3 0xA2BE /* Kaby Point 3 (iTouch) */ + +-#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */ +-#define MEI_DEV_ID_CNP_LP_3 0x9DE4 /* Cannon Point LP 3 (iTouch) */ +-#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */ +-#define MEI_DEV_ID_CNP_H_3 0xA364 /* Cannon Point H 3 (iTouch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_CNP_LP 0x9DE0 /* Cannon Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_CNP_LP_3 0x9DE4 /* Cannon Point LP 3 (iTouch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_CNP_H 0xA360 /* Cannon Point H */ ++#define PCI_DEVICE_ID_INTEL_MEI_CNP_H_3 0xA364 /* Cannon Point H 3 (iTouch) */ + +-#define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */ +-#define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_CMP_LP 0x02e0 /* Comet Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */ + +-#define MEI_DEV_ID_CMP_V 0xA3BA /* Comet Point Lake V */ ++#define PCI_DEVICE_ID_INTEL_MEI_CMP_V 0xA3BA /* Comet Point Lake V */ + +-#define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */ +-#define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */ ++#define PCI_DEVICE_ID_INTEL_MEI_CMP_H 0x06e0 /* Comet Lake H */ ++#define PCI_DEVICE_ID_INTEL_MEI_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */ + +-#define MEI_DEV_ID_CDF 0x18D3 /* Cedar Fork */ ++#define PCI_DEVICE_ID_INTEL_MEI_CDF 0x18D3 /* Cedar Fork */ + +-#define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */ +-#define MEI_DEV_ID_ICP_N 0x38E0 /* Ice Lake Point N */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICP_LP 0x34E0 /* Ice Lake Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_ICP_N 0x38E0 /* Ice Lake Point N */ + +-#define MEI_DEV_ID_JSP_N 0x4DE0 /* Jasper Lake Point N */ ++#define PCI_DEVICE_ID_INTEL_MEI_JSP_N 0x4DE0 /* Jasper Lake Point N */ + +-#define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */ +-#define MEI_DEV_ID_TGP_H 0x43E0 /* Tiger Lake Point H */ ++#define PCI_DEVICE_ID_INTEL_MEI_TGP_LP 0xA0E0 /* Tiger Lake Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_TGP_H 0x43E0 /* Tiger Lake Point H */ + +-#define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */ +-#define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */ ++#define PCI_DEVICE_ID_INTEL_MEI_MCC 0x4B70 /* Mule Creek Canyon (EHL) */ ++#define PCI_DEVICE_ID_INTEL_MEI_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */ + +-#define MEI_DEV_ID_EBG 0x1BE0 /* Emmitsburg WS */ ++#define PCI_DEVICE_ID_INTEL_MEI_EBG 0x1BE0 /* Emmitsburg WS */ + +-#define MEI_DEV_ID_ADP_S 0x7AE8 /* Alder Lake Point S */ +-#define MEI_DEV_ID_ADP_LP 0x7A60 /* Alder Lake Point LP */ +-#define MEI_DEV_ID_ADP_P 0x51E0 /* Alder Lake Point P */ +-#define MEI_DEV_ID_ADP_N 0x54E0 /* Alder Lake Point N */ ++#define PCI_DEVICE_ID_INTEL_MEI_ADP_S 0x7AE8 /* Alder Lake Point S */ ++#define PCI_DEVICE_ID_INTEL_MEI_ADP_LP 0x7A60 /* Alder Lake Point LP */ ++#define PCI_DEVICE_ID_INTEL_MEI_ADP_P 0x51E0 /* Alder Lake Point P */ ++#define PCI_DEVICE_ID_INTEL_MEI_ADP_N 0x54E0 /* Alder Lake Point N */ + +-#define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */ ++#define PCI_DEVICE_ID_INTEL_MEI_RPL_S 0x7A68 /* Raptor Lake Point S */ + +-#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */ +-#define MEI_DEV_ID_ARL_S 0x7F68 /* Arrow Lake Point S */ +-#define MEI_DEV_ID_ARL_H 0x7770 /* Arrow Lake Point H */ ++#define PCI_DEVICE_ID_INTEL_MEI_MTL_M 0x7E70 /* Meteor Lake Point M */ ++#define PCI_DEVICE_ID_INTEL_MEI_ARL_S 0x7F68 /* Arrow Lake Point S */ ++#define PCI_DEVICE_ID_INTEL_MEI_ARL_H 0x7770 /* Arrow Lake Point H */ + +-#define MEI_DEV_ID_LNL_M 0xA870 /* Lunar Lake Point M */ ++#define PCI_DEVICE_ID_INTEL_MEI_LNL_M 0xA870 /* Lunar Lake Point M */ + +-#define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */ +-#define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ ++#define PCI_DEVICE_ID_INTEL_MEI_PTL_H 0xE370 /* Panther Lake H */ ++#define PCI_DEVICE_ID_INTEL_MEI_PTL_P 0xE470 /* Panther Lake P */ + +-#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */ ++#define PCI_DEVICE_ID_INTEL_MEI_WCL_P 0x4D70 /* Wildcat Lake P */ + +-#define MEI_DEV_ID_NVL_S 0x6E68 /* Nova Lake Point S */ ++#define PCI_DEVICE_ID_INTEL_MEI_NVL_S 0x6E68 /* Nova Lake Point S */ + + /* + * MEI HW Section +--- a/drivers/misc/mei/hw-me.h ++++ b/drivers/misc/mei/hw-me.h +@@ -33,12 +33,6 @@ struct mei_cfg { + u32 hw_trc_supported:1; + }; + +- +-#define MEI_PCI_DEVICE(dev, cfg) \ +- .vendor = PCI_VENDOR_ID_INTEL, .device = (dev), \ +- .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \ +- .driver_data = (kernel_ulong_t)(cfg), +- + #define MEI_ME_RPM_TIMEOUT 500 /* ms */ + + /** +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -26,110 +26,110 @@ + + /* mei_pci_tbl - PCI Device ID Table */ + static const struct pci_device_id mei_me_pci_tbl[] = { +- {MEI_PCI_DEVICE(MEI_DEV_ID_82946GZ, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_82G35, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_82Q965, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_82G965, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_82GM965, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_82GME965, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82Q35, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82G33, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82Q33, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82X38, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_3200, MEI_ME_ICH_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_6, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_7, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_8, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_9, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_10, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_1, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_2, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_3, MEI_ME_ICH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_4, MEI_ME_ICH_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_1, MEI_ME_ICH10_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_2, MEI_ME_ICH10_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_3, MEI_ME_ICH10_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_4, MEI_ME_ICH10_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH6_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH6_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_4_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_4_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP_2, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_3, MEI_ME_PCH8_ITOUCH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_4_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_4_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_3, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_SPS_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH12_SPS_ITOUCH_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_N, MEI_ME_PCH12_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_H, MEI_ME_PCH15_SPS_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_JSP_N, MEI_ME_PCH15_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_CDF, MEI_ME_PCH8_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_EBG, MEI_ME_PCH15_SPS_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_S, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_LP, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)}, +- +- {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_H, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82946GZ, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82G35, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82Q965, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82G965, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82GM965, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_82GME965, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82Q35, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82G33, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82Q33, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82X38, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_3200, MEI_ME_ICH_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_6, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_7, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_8, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_9, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_10, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_1, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_2, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_3, MEI_ME_ICH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_4, MEI_ME_ICH_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_1, MEI_ME_ICH10_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_2, MEI_ME_ICH10_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_3, MEI_ME_ICH10_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_4, MEI_ME_ICH10_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_IBXPK_1, MEI_ME_PCH6_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_IBXPK_2, MEI_ME_PCH6_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_1, MEI_ME_PCH7_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_2, MEI_ME_PCH7_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_3, MEI_ME_PCH7_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_H, MEI_ME_PCH8_SPS_4_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_W, MEI_ME_PCH8_SPS_4_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_LP, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_WPT_LP, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_WPT_LP_2, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_SPT, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_2, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_3, MEI_ME_PCH8_ITOUCH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_H, MEI_ME_PCH8_SPS_4_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LBG, MEI_ME_PCH12_SPS_4_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_BXT_M, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_APL_I, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_DNV_IE, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_GLK, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_KBP, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_KBP_2, MEI_ME_PCH8_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_KBP_3, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_LP, MEI_ME_PCH12_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_H, MEI_ME_PCH12_SPS_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_H_3, MEI_ME_PCH12_SPS_ITOUCH_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_LP, MEI_ME_PCH12_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_V, MEI_ME_PCH12_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_H, MEI_ME_PCH12_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_ICP_LP, MEI_ME_PCH12_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ICP_N, MEI_ME_PCH12_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_TGP_LP, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_TGP_H, MEI_ME_PCH15_SPS_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_JSP_N, MEI_ME_PCH15_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_MCC, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_MCC_4, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_CDF, MEI_ME_PCH8_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_EBG, MEI_ME_PCH15_SPS_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_S, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_LP, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_P, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_N, MEI_ME_PCH15_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_RPL_S, MEI_ME_PCH15_SPS_CFG)}, ++ ++ {PCI_DEVICE_DATA(INTEL, MEI_MTL_M, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ARL_S, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_ARL_H, MEI_ME_PCH15_CFG)}, + +- {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_LNL_M, MEI_ME_PCH15_CFG)}, + +- {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PTL_H, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_PTL_P, MEI_ME_PCH15_CFG)}, + +- {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_WCL_P, MEI_ME_PCH15_CFG)}, + +- {MEI_PCI_DEVICE(MEI_DEV_ID_NVL_S, MEI_ME_PCH15_CFG)}, ++ {PCI_DEVICE_DATA(INTEL, MEI_NVL_S, MEI_ME_PCH15_CFG)}, + + /* required last entry */ + {0, } diff --git a/queue-7.0/mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch b/queue-7.0/mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch new file mode 100644 index 0000000000..fd8766634b --- /dev/null +++ b/queue-7.0/mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch @@ -0,0 +1,148 @@ +From stable+bounces-241820-greg=kroah.com@vger.kernel.org Wed Apr 29 07:36:33 2026 +From: Sasha Levin +Date: Wed, 29 Apr 2026 01:36:20 -0400 +Subject: mm: avoid deadlock when holding rmap on mmap_prepare error +To: stable@vger.kernel.org +Cc: "Lorenzo Stoakes (Oracle)" , "Vlastimil Babka (SUSE)" , Alexander Shishkin , Alexandre Torgue , Al Viro , Arnd Bergmann , Bodo Stroesser , Christian Brauner , Clemens Ladisch , David Hildenbrand , David Howells , Dexuan Cui , Greg Kroah-Hartman , Haiyang Zhang , Jan Kara , Jann Horn , Jonathan Corbet , "K. Y. Srinivasan" , Liam Howlett , Long Li , Marc Dionne , "Martin K. Petersen" , Maxime Coquelin , Michal Hocko , Mike Rapoport , Miquel Raynal , Pedro Falcato , Richard Weinberger , Ryan Roberts , Suren Baghdasaryan , Vignesh Raghavendra , Wei Liu , Andrew Morton , Sasha Levin +Message-ID: <20260429053620.3394030-2-sashal@kernel.org> + +From: "Lorenzo Stoakes (Oracle)" + +[ Upstream commit f96e1d5f15b7c854a6a9ec1225d68a12fe7dcda6 ] + +Commit ac0a3fc9c07d ("mm: add ability to take further action in +vm_area_desc") added the ability for drivers to instruct mm to take actions +after the .mmap_prepare callback is complete. + +To make life simpler and safer, this is done before the VMA/mmap write lock +is dropped but when the VMA is completely established. + +So on error, we simply munmap() the VMA. + +As part of this implementation, unfortunately a horrible hack had to be +implemented to support some questionable behaviour hugetlb relies upon - +that is that the file rmap lock is held until the operation is complete. + +The implementation, for convenience, did this in mmap_action_finish() so +both the VMA and mmap_prepare compatibility layer paths would have this +correctly handled. + +However, it turns out there is a mistake here - the rmap lock cannot be +held on munmap, as free_pgtables() -> unlink_file_vma_batch_add() -> +unlink_file_vma_batch_process() takes the file rmap lock. + +We therefore currently have a deadlock issue that might arise. + +Resolve this by leaving it to callers to handle the unmap. + +The compatibility layer does not support this rmap behaviour, so we simply +have it unmap on error after calling mmap_action_complete(). + +In the VMA implementation, we only perform the unmap after the rmap lock is +dropped. + +This resolves the issue by ensuring the rmap lock is always dropped when +the unmap occurs. + +Link: https://lkml.kernel.org/r/d44248be9da68258b07c2c59d4e73485ee0ca943.1774045440.git.ljs@kernel.org +Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") +Signed-off-by: Lorenzo Stoakes (Oracle) +Acked-by: Vlastimil Babka (SUSE) +Cc: Alexander Shishkin +Cc: Alexandre Torgue +Cc: Al Viro +Cc: Arnd Bergmann +Cc: Bodo Stroesser +Cc: Christian Brauner +Cc: Clemens Ladisch +Cc: David Hildenbrand +Cc: David Howells +Cc: Dexuan Cui +Cc: Greg Kroah-Hartman +Cc: Haiyang Zhang +Cc: Jan Kara +Cc: Jann Horn +Cc: Jonathan Corbet +Cc: K. Y. Srinivasan +Cc: Liam Howlett +Cc: Long Li +Cc: Marc Dionne +Cc: "Martin K. Petersen" +Cc: Maxime Coquelin +Cc: Michal Hocko +Cc: Mike Rapoport +Cc: Miquel Raynal +Cc: Pedro Falcato +Cc: Richard Weinberger +Cc: Ryan Roberts +Cc: Suren Baghdasaryan +Cc: Vignesh Raghavendra +Cc: Vlastimil Babka (SUSE) +Cc: Wei Liu +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/util.c | 12 +++++++----- + mm/vma.c | 13 ++++++++++--- + 2 files changed, 17 insertions(+), 8 deletions(-) + +--- a/mm/util.c ++++ b/mm/util.c +@@ -1186,7 +1186,13 @@ int compat_vma_mmap(struct file *file, s + return err; + + set_vma_from_desc(vma, &desc); +- return mmap_action_complete(vma, &desc.action); ++ err = mmap_action_complete(vma, &desc.action); ++ if (err) { ++ const size_t len = vma_pages(vma) << PAGE_SHIFT; ++ ++ do_munmap(current->mm, vma->vm_start, len, NULL); ++ } ++ return err; + } + EXPORT_SYMBOL(compat_vma_mmap); + +@@ -1279,10 +1285,6 @@ static int mmap_action_finish(struct vm_ + * invoked if we do NOT merge, so we only clean up the VMA we created. + */ + if (err) { +- const size_t len = vma_pages(vma) << PAGE_SHIFT; +- +- do_munmap(current->mm, vma->vm_start, len, NULL); +- + if (action->error_hook) { + /* We may want to filter the error. */ + err = action->error_hook(err); +--- a/mm/vma.c ++++ b/mm/vma.c +@@ -2706,9 +2706,9 @@ static int call_action_complete(struct m + struct mmap_action *action, + struct vm_area_struct *vma) + { +- int ret; ++ int err; + +- ret = mmap_action_complete(vma, action); ++ err = mmap_action_complete(vma, action); + + /* If we held the file rmap we need to release it. */ + if (map->hold_file_rmap_lock) { +@@ -2716,7 +2716,14 @@ static int call_action_complete(struct m + + i_mmap_unlock_write(file->f_mapping); + } +- return ret; ++ ++ if (err) { ++ const size_t len = vma_pages(vma) << PAGE_SHIFT; ++ ++ do_munmap(current->mm, vma->vm_start, len, NULL); ++ } ++ ++ return err; + } + + static unsigned long __mmap_region(struct file *file, unsigned long addr, diff --git a/queue-7.0/mm-various-small-mmap_prepare-cleanups.patch b/queue-7.0/mm-various-small-mmap_prepare-cleanups.patch new file mode 100644 index 0000000000..1a844162cb --- /dev/null +++ b/queue-7.0/mm-various-small-mmap_prepare-cleanups.patch @@ -0,0 +1,570 @@ +From stable+bounces-241819-greg=kroah.com@vger.kernel.org Wed Apr 29 07:36:29 2026 +From: Sasha Levin +Date: Wed, 29 Apr 2026 01:36:19 -0400 +Subject: mm: various small mmap_prepare cleanups +To: stable@vger.kernel.org +Cc: "Lorenzo Stoakes (Oracle)" , "Vlastimil Babka (SUSE)" , Alexander Shishkin , Alexandre Torgue , Al Viro , Arnd Bergmann , Bodo Stroesser , Christian Brauner , Clemens Ladisch , David Hildenbrand , David Howells , Dexuan Cui , Greg Kroah-Hartman , Haiyang Zhang , Jan Kara , Jann Horn , Jonathan Corbet , "K. Y. Srinivasan" , Liam Howlett , Long Li , Marc Dionne , "Martin K. Petersen" , Maxime Coquelin , Michal Hocko , Mike Rapoport , Miquel Raynal , Pedro Falcato , Richard Weinberger , Ryan Roberts , Suren Baghdasaryan , Vignesh Raghavendra , Wei Liu , Andrew Morton , Sasha Levin +Message-ID: <20260429053620.3394030-1-sashal@kernel.org> + +From: "Lorenzo Stoakes (Oracle)" + +[ Upstream commit 3e4bb2706817710d9461394da8b75be79981586b ] + +Patch series "mm: expand mmap_prepare functionality and usage", v4. + +This series expands the mmap_prepare functionality, which is intended to +replace the deprecated f_op->mmap hook which has been the source of bugs +and security issues for some time. + +This series starts with some cleanup of existing mmap_prepare logic, then +adds documentation for the mmap_prepare call to make it easier for +filesystem and driver writers to understand how it works. + +It then importantly adds a vm_ops->mapped hook, a key feature that was +missing from mmap_prepare previously - this is invoked when a driver which +specifies mmap_prepare has successfully been mapped but not merged with +another VMA. + +mmap_prepare is invoked prior to a merge being attempted, so you cannot +manipulate state such as reference counts as if it were a new mapping. + +The vm_ops->mapped hook allows a driver to perform tasks required at this +stage, and provides symmetry against subsequent vm_ops->open,close calls. + +The series uses this to correct the afs implementation which wrongly +manipulated reference count at mmap_prepare time. + +It then adds an mmap_prepare equivalent of vm_iomap_memory() - +mmap_action_simple_ioremap(), then uses this to update a number of drivers. + +It then splits out the mmap_prepare compatibility layer (which allows for +invocation of mmap_prepare hooks in an mmap() hook) in such a way as to +allow for more incremental implementation of mmap_prepare hooks. + +It then uses this to extend mmap_prepare usage in drivers. + +Finally it adds an mmap_prepare equivalent of vm_map_pages(), which lays +the foundation for future work which will extend mmap_prepare to DMA +coherent mappings. + +This patch (of 21): + +Rather than passing arbitrary fields, pass a vm_area_desc pointer to mmap +prepare functions to mmap prepare, and an action and vma pointer to mmap +complete in order to put all the action-specific logic in the function +actually doing the work. + +Additionally, allow mmap prepare functions to return an error so we can +error out as soon as possible if there is something logically incorrect in +the input. + +Update remap_pfn_range_prepare() to properly check the input range for the +CoW case. + +Also remove io_remap_pfn_range_complete(), as we can simply set up the +fields correctly in io_remap_pfn_range_prepare() and use +remap_pfn_range_complete() for this. + +While we're here, make remap_pfn_range_prepare_vma() a little neater, and +pass mmap_action directly to call_action_complete(). + +Then, update compat_vma_mmap() to perform its logic directly, as +__compat_vma_map() is not used by anything so we don't need to export it. + +Also update compat_vma_mmap() to use vfs_mmap_prepare() rather than +calling the mmap_prepare op directly. + +Finally, update the VMA userland tests to reflect the changes. + +Link: https://lkml.kernel.org/r/cover.1774045440.git.ljs@kernel.org +Link: https://lkml.kernel.org/r/99f408e4694f44ab12bdc55fe0bd9685d3bd1117.1774045440.git.ljs@kernel.org +Signed-off-by: Lorenzo Stoakes (Oracle) +Acked-by: Vlastimil Babka (SUSE) +Cc: Alexander Shishkin +Cc: Alexandre Torgue +Cc: Al Viro +Cc: Arnd Bergmann +Cc: Bodo Stroesser +Cc: Christian Brauner +Cc: Clemens Ladisch +Cc: David Hildenbrand +Cc: David Howells +Cc: Dexuan Cui +Cc: Greg Kroah-Hartman +Cc: Haiyang Zhang +Cc: Jan Kara +Cc: Jann Horn +Cc: Jonathan Corbet +Cc: K. Y. Srinivasan +Cc: Liam Howlett +Cc: Long Li +Cc: Marc Dionne +Cc: "Martin K. Petersen" +Cc: Maxime Coquelin +Cc: Michal Hocko +Cc: Mike Rapoport +Cc: Miquel Raynal +Cc: Pedro Falcato +Cc: Richard Weinberger +Cc: Ryan Roberts +Cc: Suren Baghdasaryan +Cc: Vignesh Raghavendra +Cc: Wei Liu +Signed-off-by: Andrew Morton +Stable-dep-of: f96e1d5f15b7 ("mm: avoid deadlock when holding rmap on mmap_prepare error") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/fs.h | 2 + include/linux/mm.h | 7 -- + mm/internal.h | 34 +++++----- + mm/memory.c | 45 +++++++++----- + mm/util.c | 121 ++++++++++++++++---------------------- + mm/vma.c | 24 ++++--- + tools/testing/vma/include/dup.h | 7 +- + tools/testing/vma/include/stubs.h | 8 +- + 8 files changed, 127 insertions(+), 121 deletions(-) + +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2058,8 +2058,6 @@ static inline bool can_mmap_file(struct + return true; + } + +-int __compat_vma_mmap(const struct file_operations *f_op, +- struct file *file, struct vm_area_struct *vma); + int compat_vma_mmap(struct file *file, struct vm_area_struct *vma); + + static inline int vfs_mmap(struct file *file, struct vm_area_struct *vma) +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -4078,10 +4078,9 @@ static inline void mmap_action_ioremap_f + mmap_action_ioremap(desc, desc->start, start_pfn, vma_desc_size(desc)); + } + +-void mmap_action_prepare(struct mmap_action *action, +- struct vm_area_desc *desc); +-int mmap_action_complete(struct mmap_action *action, +- struct vm_area_struct *vma); ++int mmap_action_prepare(struct vm_area_desc *desc); ++int mmap_action_complete(struct vm_area_struct *vma, ++ struct mmap_action *action); + + /* Look up the first VMA which exactly match the interval vm_start ... vm_end */ + static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -1757,26 +1757,28 @@ int walk_page_range_debug(struct mm_stru + void dup_mm_exe_file(struct mm_struct *mm, struct mm_struct *oldmm); + int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm); + +-void remap_pfn_range_prepare(struct vm_area_desc *desc, unsigned long pfn); +-int remap_pfn_range_complete(struct vm_area_struct *vma, unsigned long addr, +- unsigned long pfn, unsigned long size, pgprot_t pgprot); ++int remap_pfn_range_prepare(struct vm_area_desc *desc); ++int remap_pfn_range_complete(struct vm_area_struct *vma, ++ struct mmap_action *action); + +-static inline void io_remap_pfn_range_prepare(struct vm_area_desc *desc, +- unsigned long orig_pfn, unsigned long size) ++static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc) + { ++ struct mmap_action *action = &desc->action; ++ const unsigned long orig_pfn = action->remap.start_pfn; ++ const pgprot_t orig_pgprot = action->remap.pgprot; ++ const unsigned long size = action->remap.size; + const unsigned long pfn = io_remap_pfn_range_pfn(orig_pfn, size); ++ int err; + +- return remap_pfn_range_prepare(desc, pfn); +-} +- +-static inline int io_remap_pfn_range_complete(struct vm_area_struct *vma, +- unsigned long addr, unsigned long orig_pfn, unsigned long size, +- pgprot_t orig_prot) +-{ +- const unsigned long pfn = io_remap_pfn_range_pfn(orig_pfn, size); +- const pgprot_t prot = pgprot_decrypted(orig_prot); +- +- return remap_pfn_range_complete(vma, addr, pfn, size, prot); ++ action->remap.start_pfn = pfn; ++ action->remap.pgprot = pgprot_decrypted(orig_pgprot); ++ err = remap_pfn_range_prepare(desc); ++ if (err) ++ return err; ++ ++ /* Remap does the actual work. */ ++ action->type = MMAP_REMAP_PFN; ++ return 0; + } + + #endif /* __MM_INTERNAL_H */ +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3105,26 +3105,34 @@ static int do_remap_pfn_range(struct vm_ + } + #endif + +-void remap_pfn_range_prepare(struct vm_area_desc *desc, unsigned long pfn) ++int remap_pfn_range_prepare(struct vm_area_desc *desc) + { +- /* +- * We set addr=VMA start, end=VMA end here, so this won't fail, but we +- * check it again on complete and will fail there if specified addr is +- * invalid. +- */ +- get_remap_pgoff(vma_desc_is_cow_mapping(desc), desc->start, desc->end, +- desc->start, desc->end, pfn, &desc->pgoff); ++ const struct mmap_action *action = &desc->action; ++ const unsigned long start = action->remap.start; ++ const unsigned long end = start + action->remap.size; ++ const unsigned long pfn = action->remap.start_pfn; ++ const bool is_cow = vma_desc_is_cow_mapping(desc); ++ int err; ++ ++ err = get_remap_pgoff(is_cow, start, end, desc->start, desc->end, pfn, ++ &desc->pgoff); ++ if (err) ++ return err; ++ + vma_desc_set_flags_mask(desc, VMA_REMAP_FLAGS); ++ return 0; + } + +-static int remap_pfn_range_prepare_vma(struct vm_area_struct *vma, unsigned long addr, +- unsigned long pfn, unsigned long size) ++static int remap_pfn_range_prepare_vma(struct vm_area_struct *vma, ++ unsigned long addr, unsigned long pfn, ++ unsigned long size) + { +- unsigned long end = addr + PAGE_ALIGN(size); ++ const unsigned long end = addr + PAGE_ALIGN(size); ++ const bool is_cow = is_cow_mapping(vma->vm_flags); + int err; + +- err = get_remap_pgoff(is_cow_mapping(vma->vm_flags), addr, end, +- vma->vm_start, vma->vm_end, pfn, &vma->vm_pgoff); ++ err = get_remap_pgoff(is_cow, addr, end, vma->vm_start, vma->vm_end, ++ pfn, &vma->vm_pgoff); + if (err) + return err; + +@@ -3157,10 +3165,15 @@ int remap_pfn_range(struct vm_area_struc + } + EXPORT_SYMBOL(remap_pfn_range); + +-int remap_pfn_range_complete(struct vm_area_struct *vma, unsigned long addr, +- unsigned long pfn, unsigned long size, pgprot_t prot) ++int remap_pfn_range_complete(struct vm_area_struct *vma, ++ struct mmap_action *action) + { +- return do_remap_pfn_range(vma, addr, pfn, size, prot); ++ const unsigned long start = action->remap.start; ++ const unsigned long pfn = action->remap.start_pfn; ++ const unsigned long size = action->remap.size; ++ const pgprot_t prot = action->remap.pgprot; ++ ++ return do_remap_pfn_range(vma, start, pfn, size, prot); + } + + /** +--- a/mm/util.c ++++ b/mm/util.c +@@ -1135,43 +1135,6 @@ EXPORT_SYMBOL(flush_dcache_folio); + #endif + + /** +- * __compat_vma_mmap() - See description for compat_vma_mmap() +- * for details. This is the same operation, only with a specific file operations +- * struct which may or may not be the same as vma->vm_file->f_op. +- * @f_op: The file operations whose .mmap_prepare() hook is specified. +- * @file: The file which backs or will back the mapping. +- * @vma: The VMA to apply the .mmap_prepare() hook to. +- * Returns: 0 on success or error. +- */ +-int __compat_vma_mmap(const struct file_operations *f_op, +- struct file *file, struct vm_area_struct *vma) +-{ +- struct vm_area_desc desc = { +- .mm = vma->vm_mm, +- .file = file, +- .start = vma->vm_start, +- .end = vma->vm_end, +- +- .pgoff = vma->vm_pgoff, +- .vm_file = vma->vm_file, +- .vma_flags = vma->flags, +- .page_prot = vma->vm_page_prot, +- +- .action.type = MMAP_NOTHING, /* Default */ +- }; +- int err; +- +- err = f_op->mmap_prepare(&desc); +- if (err) +- return err; +- +- mmap_action_prepare(&desc.action, &desc); +- set_vma_from_desc(vma, &desc); +- return mmap_action_complete(&desc.action, vma); +-} +-EXPORT_SYMBOL(__compat_vma_mmap); +- +-/** + * compat_vma_mmap() - Apply the file's .mmap_prepare() hook to an + * existing VMA and execute any requested actions. + * @file: The file which possesss an f_op->mmap_prepare() hook. +@@ -1199,7 +1162,31 @@ EXPORT_SYMBOL(__compat_vma_mmap); + */ + int compat_vma_mmap(struct file *file, struct vm_area_struct *vma) + { +- return __compat_vma_mmap(file->f_op, file, vma); ++ struct vm_area_desc desc = { ++ .mm = vma->vm_mm, ++ .file = file, ++ .start = vma->vm_start, ++ .end = vma->vm_end, ++ ++ .pgoff = vma->vm_pgoff, ++ .vm_file = vma->vm_file, ++ .vma_flags = vma->flags, ++ .page_prot = vma->vm_page_prot, ++ ++ .action.type = MMAP_NOTHING, /* Default */ ++ }; ++ int err; ++ ++ err = vfs_mmap_prepare(file, &desc); ++ if (err) ++ return err; ++ ++ err = mmap_action_prepare(&desc); ++ if (err) ++ return err; ++ ++ set_vma_from_desc(vma, &desc); ++ return mmap_action_complete(vma, &desc.action); + } + EXPORT_SYMBOL(compat_vma_mmap); + +@@ -1283,8 +1270,8 @@ again: + } + } + +-static int mmap_action_finish(struct mmap_action *action, +- const struct vm_area_struct *vma, int err) ++static int mmap_action_finish(struct vm_area_struct *vma, ++ struct mmap_action *action, int err) + { + /* + * If an error occurs, unmap the VMA altogether and return an error. We +@@ -1316,37 +1303,38 @@ static int mmap_action_finish(struct mma + /** + * mmap_action_prepare - Perform preparatory setup for an VMA descriptor + * action which need to be performed. +- * @desc: The VMA descriptor to prepare for @action. +- * @action: The action to perform. ++ * @desc: The VMA descriptor to prepare for its @desc->action. ++ * ++ * Returns: %0 on success, otherwise error. + */ +-void mmap_action_prepare(struct mmap_action *action, +- struct vm_area_desc *desc) ++int mmap_action_prepare(struct vm_area_desc *desc) + { +- switch (action->type) { ++ switch (desc->action.type) { + case MMAP_NOTHING: +- break; ++ return 0; + case MMAP_REMAP_PFN: +- remap_pfn_range_prepare(desc, action->remap.start_pfn); +- break; ++ return remap_pfn_range_prepare(desc); + case MMAP_IO_REMAP_PFN: +- io_remap_pfn_range_prepare(desc, action->remap.start_pfn, +- action->remap.size); +- break; ++ return io_remap_pfn_range_prepare(desc); + } ++ ++ WARN_ON_ONCE(1); ++ return -EINVAL; + } + EXPORT_SYMBOL(mmap_action_prepare); + + /** + * mmap_action_complete - Execute VMA descriptor action. +- * @action: The action to perform. + * @vma: The VMA to perform the action upon. ++ * @action: The action to perform. + * + * Similar to mmap_action_prepare(). + * + * Return: 0 on success, or error, at which point the VMA will be unmapped. + */ +-int mmap_action_complete(struct mmap_action *action, +- struct vm_area_struct *vma) ++int mmap_action_complete(struct vm_area_struct *vma, ++ struct mmap_action *action) ++ + { + int err = 0; + +@@ -1354,25 +1342,22 @@ int mmap_action_complete(struct mmap_act + case MMAP_NOTHING: + break; + case MMAP_REMAP_PFN: +- err = remap_pfn_range_complete(vma, action->remap.start, +- action->remap.start_pfn, action->remap.size, +- action->remap.pgprot); ++ err = remap_pfn_range_complete(vma, action); + break; + case MMAP_IO_REMAP_PFN: +- err = io_remap_pfn_range_complete(vma, action->remap.start, +- action->remap.start_pfn, action->remap.size, +- action->remap.pgprot); ++ /* Should have been delegated. */ ++ WARN_ON_ONCE(1); ++ err = -EINVAL; + break; + } + +- return mmap_action_finish(action, vma, err); ++ return mmap_action_finish(vma, action, err); + } + EXPORT_SYMBOL(mmap_action_complete); + #else +-void mmap_action_prepare(struct mmap_action *action, +- struct vm_area_desc *desc) ++int mmap_action_prepare(struct vm_area_desc *desc) + { +- switch (action->type) { ++ switch (desc->action.type) { + case MMAP_NOTHING: + break; + case MMAP_REMAP_PFN: +@@ -1380,11 +1365,13 @@ void mmap_action_prepare(struct mmap_act + WARN_ON_ONCE(1); /* nommu cannot handle these. */ + break; + } ++ ++ return 0; + } + EXPORT_SYMBOL(mmap_action_prepare); + +-int mmap_action_complete(struct mmap_action *action, +- struct vm_area_struct *vma) ++int mmap_action_complete(struct vm_area_struct *vma, ++ struct mmap_action *action) + { + int err = 0; + +@@ -1399,7 +1386,7 @@ int mmap_action_complete(struct mmap_act + break; + } + +- return mmap_action_finish(action, vma, err); ++ return mmap_action_finish(vma, action, err); + } + EXPORT_SYMBOL(mmap_action_complete); + #endif +--- a/mm/vma.c ++++ b/mm/vma.c +@@ -2611,15 +2611,18 @@ static void __mmap_complete(struct mmap_ + vma_set_page_prot(vma); + } + +-static void call_action_prepare(struct mmap_state *map, +- struct vm_area_desc *desc) ++static int call_action_prepare(struct mmap_state *map, ++ struct vm_area_desc *desc) + { +- struct mmap_action *action = &desc->action; ++ int err; + +- mmap_action_prepare(action, desc); ++ err = mmap_action_prepare(desc); ++ if (err) ++ return err; + +- if (action->hide_from_rmap_until_complete) ++ if (desc->action.hide_from_rmap_until_complete) + map->hold_file_rmap_lock = true; ++ return 0; + } + + /* +@@ -2643,7 +2646,9 @@ static int call_mmap_prepare(struct mmap + if (err) + return err; + +- call_action_prepare(map, desc); ++ err = call_action_prepare(map, desc); ++ if (err) ++ return err; + + /* Update fields permitted to be changed. */ + map->pgoff = desc->pgoff; +@@ -2698,13 +2703,12 @@ static bool can_set_ksm_flags_early(stru + } + + static int call_action_complete(struct mmap_state *map, +- struct vm_area_desc *desc, ++ struct mmap_action *action, + struct vm_area_struct *vma) + { +- struct mmap_action *action = &desc->action; + int ret; + +- ret = mmap_action_complete(action, vma); ++ ret = mmap_action_complete(vma, action); + + /* If we held the file rmap we need to release it. */ + if (map->hold_file_rmap_lock) { +@@ -2766,7 +2770,7 @@ static unsigned long __mmap_region(struc + __mmap_complete(&map, vma); + + if (have_mmap_prepare && allocated_new) { +- error = call_action_complete(&map, &desc, vma); ++ error = call_action_complete(&map, &desc.action, vma); + + if (error) + return error; +--- a/tools/testing/vma/include/dup.h ++++ b/tools/testing/vma/include/dup.h +@@ -1093,9 +1093,12 @@ static inline int __compat_vma_mmap(cons + if (err) + return err; + +- mmap_action_prepare(&desc.action, &desc); ++ err = mmap_action_prepare(&desc); ++ if (err) ++ return err; ++ + set_vma_from_desc(vma, &desc); +- return mmap_action_complete(&desc.action, vma); ++ return mmap_action_complete(vma, &desc.action); + } + + static inline int compat_vma_mmap(struct file *file, +--- a/tools/testing/vma/include/stubs.h ++++ b/tools/testing/vma/include/stubs.h +@@ -81,13 +81,13 @@ static inline void free_anon_vma_name(st + { + } + +-static inline void mmap_action_prepare(struct mmap_action *action, +- struct vm_area_desc *desc) ++static inline int mmap_action_prepare(struct vm_area_desc *desc) + { ++ return 0; + } + +-static inline int mmap_action_complete(struct mmap_action *action, +- struct vm_area_struct *vma) ++static inline int mmap_action_complete(struct vm_area_struct *vma, ++ struct mmap_action *action) + { + return 0; + } diff --git a/queue-7.0/perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch b/queue-7.0/perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch new file mode 100644 index 0000000000..55f0c32d26 --- /dev/null +++ b/queue-7.0/perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch @@ -0,0 +1,30 @@ +From 841dbf4871c57ce2da18c4ea7ffac5487d0eda16 Mon Sep 17 00:00:00 2001 +From: WANG Rui +Date: Tue, 14 Apr 2026 08:51:52 +0800 +Subject: perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND + +From: WANG Rui + +commit 841dbf4871c57ce2da18c4ea7ffac5487d0eda16 upstream. + +Building perf for LoongArch fails when CONFIG_LIBDW_DWARF_UNWIND is +enabled because unwind-libdw.o is still referenced in +arch/loongarch/util/Build. + +Fixes: e62fae9d9e8 ("perf unwind-libdw: Fix a cross-arch unwinding bug") +Signed-off-by: WANG Rui +Acked-by: Huacai Chen +Signed-off-by: Namhyung Kim +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/loongarch/util/Build | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/perf/arch/loongarch/util/Build ++++ b/tools/perf/arch/loongarch/util/Build +@@ -1,4 +1,3 @@ + perf-util-y += header.o + + perf-util-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o +-perf-util-$(CONFIG_LIBDW_DWARF_UNWIND) += unwind-libdw.o diff --git a/queue-7.0/selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch b/queue-7.0/selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch new file mode 100644 index 0000000000..dc8dae3b32 --- /dev/null +++ b/queue-7.0/selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch @@ -0,0 +1,100 @@ +From stable+bounces-242598-greg=kroah.com@vger.kernel.org Sat May 2 14:27:10 2026 +From: Sasha Levin +Date: Sat, 2 May 2026 08:27:02 -0400 +Subject: selftests/landlock: Fix socket file descriptor leaks in audit helpers +To: stable@vger.kernel.org +Cc: "Mickaël Salaün" , "Günther Noack" , "Günther Noack" , "Sasha Levin" +Message-ID: <20260502122702.517486-1-sashal@kernel.org> + +From: Mickaël Salaün + +[ Upstream commit 9143d790337a0d066c2d632c802f69b981e6c23a ] + +audit_init() opens a netlink socket and configures it, but leaks the +file descriptor if audit_set_status() or setsockopt() fails. Fix this +by jumping to an error path that closes the socket before returning. + +Apply the same fix to audit_init_with_exe_filter(), which leaks the file +descriptor from audit_init() if audit_init_filter_exe() or +audit_filter_exe() fails, and to audit_cleanup(), which leaks it if +audit_init_filter_exe() fails in FIXTURE_TEARDOWN_PARENT(). + +Cc: Günther Noack +Cc: stable@vger.kernel.org +Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20260402192608.1458252-3-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/landlock/audit.h | 26 +++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/landlock/audit.h b/tools/testing/selftests/landlock/audit.h +index 44eb433e96661..0007c247cd335 100644 +--- a/tools/testing/selftests/landlock/audit.h ++++ b/tools/testing/selftests/landlock/audit.h +@@ -379,19 +379,25 @@ static int audit_init(void) + + err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1); + if (err) +- return err; ++ goto err_close; + + err = audit_set_status(fd, AUDIT_STATUS_PID, getpid()); + if (err) +- return err; ++ goto err_close; + + /* Sets a timeout for negative tests. */ + err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default, + sizeof(audit_tv_default)); +- if (err) +- return -errno; ++ if (err) { ++ err = -errno; ++ goto err_close; ++ } + + return fd; ++ ++err_close: ++ close(fd); ++ return err; + } + + static int audit_init_filter_exe(struct audit_filter *filter, const char *path) +@@ -441,8 +447,10 @@ static int audit_cleanup(int audit_fd, struct audit_filter *filter) + + filter = &new_filter; + err = audit_init_filter_exe(filter, NULL); +- if (err) ++ if (err) { ++ close(audit_fd); + return err; ++ } + } + + /* Filters might not be in place. */ +@@ -468,11 +476,15 @@ static int audit_init_with_exe_filter(struct audit_filter *filter) + + err = audit_init_filter_exe(filter, NULL); + if (err) +- return err; ++ goto err_close; + + err = audit_filter_exe(fd, filter, AUDIT_ADD_RULE); + if (err) +- return err; ++ goto err_close; + + return fd; ++ ++err_close: ++ close(fd); ++ return err; + } +-- +2.53.0 + diff --git a/queue-7.0/series b/queue-7.0/series index 2a7948dc7a..ec95322458 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -282,3 +282,13 @@ rxgk-fix-potential-integer-overflow-in-length-check.patch sched_ext-documentation-clarify-ops.dispatch-role-in-task-lifecycle.patch scsi-sd-fix-missing-put_disk-when-device_add-disk_dev-fails.patch seg6-fix-seg6-lwtunnel-output-redirect-for-l2-reduced-encap-mode.patch +perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch +iio-frequency-admv1013-add-dev-variable.patch +iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch +wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch +wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch +mm-various-small-mmap_prepare-cleanups.patch +mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch +mei-me-use-pci_device_data-macro.patch +mei-me-add-nova-lake-point-h-did.patch +selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch diff --git a/queue-7.0/wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch b/queue-7.0/wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch new file mode 100644 index 0000000000..f562295f14 --- /dev/null +++ b/queue-7.0/wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch @@ -0,0 +1,95 @@ +From stable+bounces-242154-greg=kroah.com@vger.kernel.org Thu Apr 30 18:15:29 2026 +From: Sasha Levin +Date: Thu, 30 Apr 2026 12:07:21 -0400 +Subject: wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor +To: stable@vger.kernel.org +Cc: Sean Wang , Felix Fietkau , Sasha Levin +Message-ID: <20260430160722.1784926-1-sashal@kernel.org> + +From: Sean Wang + +[ Upstream commit e6f48512c1ceebcd1ce6bb83df3b3d56a261507d ] + +Prepare mt792xu_wfsys_reset() for chips that share the same USB WFSYS +reset flow but use different register definitions. + +This is a pure refactor of the current mt7921u path and keeps the reset +sequence unchanged. + +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20260311002825.15502-1-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Stable-dep-of: 56154fef47d1 ("wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 40 +++++++++++++++++++----- + 1 file changed, 32 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c +@@ -206,6 +206,24 @@ static void mt792xu_epctl_rst_opt(struct + mt792xu_uhw_wr(&dev->mt76, MT_SSUSB_EPCTL_CSR_EP_RST_OPT, val); + } + ++struct mt792xu_wfsys_desc { ++ u32 rst_reg; ++ u32 done_reg; ++ u32 done_mask; ++ u32 done_val; ++ u32 delay_ms; ++ bool need_status_sel; ++}; ++ ++static const struct mt792xu_wfsys_desc mt7921_wfsys_desc = { ++ .rst_reg = MT_CBTOP_RGU_WF_SUBSYS_RST, ++ .done_reg = MT_UDMA_CONN_INFRA_STATUS, ++ .done_mask = MT_UDMA_CONN_WFSYS_INIT_DONE, ++ .done_val = MT_UDMA_CONN_WFSYS_INIT_DONE, ++ .delay_ms = 0, ++ .need_status_sel = true, ++}; ++ + int mt792xu_dma_init(struct mt792x_dev *dev, bool resume) + { + int err; +@@ -236,25 +254,31 @@ EXPORT_SYMBOL_GPL(mt792xu_dma_init); + + int mt792xu_wfsys_reset(struct mt792x_dev *dev) + { ++ const struct mt792xu_wfsys_desc *desc = &mt7921_wfsys_desc; + u32 val; + int i; + + mt792xu_epctl_rst_opt(dev, false); + +- val = mt792xu_uhw_rr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST); ++ val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg); + val |= MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH; +- mt792xu_uhw_wr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST, val); ++ mt792xu_uhw_wr(&dev->mt76, desc->rst_reg, val); + +- usleep_range(10, 20); ++ if (desc->delay_ms) ++ msleep(desc->delay_ms); ++ else ++ usleep_range(10, 20); + +- val = mt792xu_uhw_rr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST); ++ val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg); + val &= ~MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH; +- mt792xu_uhw_wr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST, val); ++ mt792xu_uhw_wr(&dev->mt76, desc->rst_reg, val); ++ ++ if (desc->need_status_sel) ++ mt792xu_uhw_wr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS_SEL, 0); + +- mt792xu_uhw_wr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS_SEL, 0); + for (i = 0; i < MT792x_WFSYS_INIT_RETRY_COUNT; i++) { +- val = mt792xu_uhw_rr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS); +- if (val & MT_UDMA_CONN_WFSYS_INIT_DONE) ++ val = mt792xu_uhw_rr(&dev->mt76, desc->done_reg); ++ if ((val & desc->done_mask) == desc->done_val) + break; + + msleep(100); diff --git a/queue-7.0/wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch b/queue-7.0/wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch new file mode 100644 index 0000000000..6c72860a1a --- /dev/null +++ b/queue-7.0/wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch @@ -0,0 +1,73 @@ +From stable+bounces-242155-greg=kroah.com@vger.kernel.org Thu Apr 30 18:07:36 2026 +From: Sasha Levin +Date: Thu, 30 Apr 2026 12:07:22 -0400 +Subject: wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling +To: stable@vger.kernel.org +Cc: Sean Wang , Felix Fietkau , Sasha Levin +Message-ID: <20260430160722.1784926-2-sashal@kernel.org> + +From: Sean Wang + +[ Upstream commit 56154fef47d104effa9f29ed3db4f805cbc0d640 ] + +mt7925u uses different reset/status registers from mt7921u. Reusing the +mt7921u register set causes the WFSYS reset to fail. + +Add a chip-specific descriptor in mt792xu_wfsys_reset() to select the +correct registers and fix mt7925u failing to initialize after a warm +reboot. + +Fixes: d28e1a48952e ("wifi: mt76: mt792x: introduce mt792x-usb module") +Cc: stable@vger.kernel.org +Signed-off-by: Sean Wang +Link: https://patch.msgid.link/20260311002825.15502-2-sean.wang@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 ++++ + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 13 ++++++++++++- + 2 files changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h +@@ -390,6 +390,10 @@ + #define MT_CBTOP_RGU_WF_SUBSYS_RST MT_CBTOP_RGU(0x600) + #define MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH BIT(0) + ++#define MT7925_CBTOP_RGU_WF_SUBSYS_RST 0x70028600 ++#define MT7925_WFSYS_INIT_DONE_ADDR 0x184c1604 ++#define MT7925_WFSYS_INIT_DONE 0x00001d1e ++ + #define MT_HW_BOUND 0x70010020 + #define MT_HW_CHIPID 0x70010200 + #define MT_HW_REV 0x70010204 +--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c +@@ -224,6 +224,15 @@ static const struct mt792xu_wfsys_desc m + .need_status_sel = true, + }; + ++static const struct mt792xu_wfsys_desc mt7925_wfsys_desc = { ++ .rst_reg = MT7925_CBTOP_RGU_WF_SUBSYS_RST, ++ .done_reg = MT7925_WFSYS_INIT_DONE_ADDR, ++ .done_mask = U32_MAX, ++ .done_val = MT7925_WFSYS_INIT_DONE, ++ .delay_ms = 20, ++ .need_status_sel = false, ++}; ++ + int mt792xu_dma_init(struct mt792x_dev *dev, bool resume) + { + int err; +@@ -254,7 +263,9 @@ EXPORT_SYMBOL_GPL(mt792xu_dma_init); + + int mt792xu_wfsys_reset(struct mt792x_dev *dev) + { +- const struct mt792xu_wfsys_desc *desc = &mt7921_wfsys_desc; ++ const struct mt792xu_wfsys_desc *desc = is_mt7925(&dev->mt76) ? ++ &mt7925_wfsys_desc : ++ &mt7921_wfsys_desc; + u32 val; + int i; +