From: Greg Kroah-Hartman Date: Mon, 7 Oct 2024 09:33:18 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.6.55~116 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6cb3b3de60e31949520c631e3547116c61109c60;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch spi-bcm63xx-fix-module-autoloading.patch --- diff --git a/queue-6.1/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch b/queue-6.1/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch new file mode 100644 index 00000000000..f7f6963121c --- /dev/null +++ b/queue-6.1/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch @@ -0,0 +1,37 @@ +From 9c3a62c20f7fb00294a4237e287254456ba8a48b Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 16 Aug 2024 15:57:21 +0200 +Subject: firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() + +From: Krzysztof Kozlowski + +commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream. + +mbox_client_to_bpmp() is not used, W=1 builds: + + drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function] + +Fixes: cdfa358b248e ("firmware: tegra: Refactor BPMP driver") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/tegra/bpmp.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/firmware/tegra/bpmp.c ++++ b/drivers/firmware/tegra/bpmp.c +@@ -25,12 +25,6 @@ + #define MSG_RING BIT(1) + #define TAG_SZ 32 + +-static inline struct tegra_bpmp * +-mbox_client_to_bpmp(struct mbox_client *client) +-{ +- return container_of(client, struct tegra_bpmp, mbox.client); +-} +- + static inline const struct tegra_bpmp_ops * + channel_to_ops(struct tegra_bpmp_channel *channel) + { diff --git a/queue-6.1/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.1/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..6221692c09e --- /dev/null +++ b/queue-6.1/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,43 @@ +From e2c85d85a05f16af2223fcc0195ff50a7938b372 Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Thu, 12 Sep 2024 11:34:59 +0800 +Subject: i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream. + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") +Signed-off-by: Jinjie Ruan +Cc: # v4.19+ +Acked-by: Mukesh Kumar Savaliya +Reviewed-by: Vladimir Zapolskiy +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qcom-geni.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -821,15 +821,13 @@ static int geni_i2c_probe(struct platfor + init_completion(&gi2c->done); + spin_lock_init(&gi2c->lock); + platform_set_drvdata(pdev, gi2c); +- ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0, ++ ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN, + dev_name(dev), gi2c); + if (ret) { + dev_err(dev, "Request_irq failed:%d: err:%d\n", + gi2c->irq, ret); + return ret; + } +- /* Disable the interrupt so that the system can enter low-power mode */ +- disable_irq(gi2c->irq); + i2c_set_adapdata(&gi2c->adap, gi2c); + gi2c->adap.dev.parent = dev; + gi2c->adap.dev.of_node = dev->of_node; diff --git a/queue-6.1/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch b/queue-6.1/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch new file mode 100644 index 00000000000..6d66a236d26 --- /dev/null +++ b/queue-6.1/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch @@ -0,0 +1,58 @@ +From 048bbbdbf85e5e00258dfb12f5e368f908801d7b Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Mon, 30 Sep 2024 21:27:41 +0200 +Subject: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume + +From: Marek Vasut + +commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream. + +In case there is any sort of clock controller attached to this I2C bus +controller, for example Versaclock or even an AIC32x4 I2C codec, then +an I2C transfer triggered from the clock controller clk_ops .prepare +callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex. + +This is because the clock controller first grabs the prepare_lock mutex +and then performs the prepare operation, including its I2C access. The +I2C access resumes this I2C bus controller via .runtime_resume callback, +which calls clk_prepare_enable(), which attempts to grab the prepare_lock +mutex again and deadlocks. + +Since the clock are already prepared since probe() and unprepared in +remove(), use simple clk_enable()/clk_disable() calls to enable and +disable the clock on runtime suspend and resume, to avoid hitting the +prepare_lock mutex. + +Acked-by: Alain Volmat +Signed-off-by: Marek Vasut +Fixes: 4e7bca6fc07b ("i2c: i2c-stm32f7: add PM Runtime support") +Cc: # v5.0+ +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32f7.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -2353,7 +2353,7 @@ static int __maybe_unused stm32f7_i2c_ru + struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev); + + if (!stm32f7_i2c_is_slave_registered(i2c_dev)) +- clk_disable_unprepare(i2c_dev->clk); ++ clk_disable(i2c_dev->clk); + + return 0; + } +@@ -2364,9 +2364,9 @@ static int __maybe_unused stm32f7_i2c_ru + int ret; + + if (!stm32f7_i2c_is_slave_registered(i2c_dev)) { +- ret = clk_prepare_enable(i2c_dev->clk); ++ ret = clk_enable(i2c_dev->clk); + if (ret) { +- dev_err(dev, "failed to prepare_enable clock\n"); ++ dev_err(dev, "failed to enable clock\n"); + return ret; + } + } diff --git a/queue-6.1/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch b/queue-6.1/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch new file mode 100644 index 00000000000..fa50dd2721e --- /dev/null +++ b/queue-6.1/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch @@ -0,0 +1,75 @@ +From 521da1e9225450bd323db5fa5bca942b1dc485b7 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 21 Nov 2023 18:11:16 +0000 +Subject: i2c: xiic: Wait for TX empty to avoid missed TX NAKs + +From: Robert Hancock + +commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream. + +Frequently an I2C write will be followed by a read, such as a register +address write followed by a read of the register value. In this driver, +when the TX FIFO half empty interrupt was raised and it was determined +that there was enough space in the TX FIFO to send the following read +command, it would do so without waiting for the TX FIFO to actually +empty. + +Unfortunately it appears that in some cases this can result in a NAK +that was raised by the target device on the write, such as due to an +unsupported register address, being ignored and the subsequent read +being done anyway. This can potentially put the I2C bus into an +invalid state and/or result in invalid read data being processed. + +To avoid this, once a message has been fully written to the TX FIFO, +wait for the TX FIFO empty interrupt before moving on to the next +message, to ensure NAKs are handled properly. + +Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface") +Signed-off-by: Robert Hancock +Cc: # v2.6.34+ +Reviewed-by: Manikanta Guntupalli +Acked-by: Michal Simek +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-xiic.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -482,14 +482,17 @@ static irqreturn_t xiic_process(int irq, + goto out; + } + +- xiic_fill_tx_fifo(i2c); +- +- /* current message sent and there is space in the fifo */ +- if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) { ++ if (xiic_tx_space(i2c)) { ++ xiic_fill_tx_fifo(i2c); ++ } else { ++ /* current message fully written */ + dev_dbg(i2c->adap.dev.parent, + "%s end of message sent, nmsgs: %d\n", + __func__, i2c->nmsgs); +- if (i2c->nmsgs > 1) { ++ /* Don't move onto the next message until the TX FIFO empties, ++ * to ensure that a NAK is not missed. ++ */ ++ if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) { + i2c->nmsgs--; + i2c->tx_msg++; + xfer_more = 1; +@@ -500,11 +503,7 @@ static irqreturn_t xiic_process(int irq, + "%s Got TX IRQ but no more to do...\n", + __func__); + } +- } else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1)) +- /* current frame is sent and is last, +- * make sure to disable tx half +- */ +- xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK); ++ } + } + + if (pend & XIIC_INTR_BNB_MASK) { diff --git a/queue-6.1/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch b/queue-6.1/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch new file mode 100644 index 00000000000..fe7e0935cb1 --- /dev/null +++ b/queue-6.1/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch @@ -0,0 +1,74 @@ +From bee1aed819a8cda47927436685d216906ed17f62 Mon Sep 17 00:00:00 2001 +From: Alexander Shiyan +Date: Thu, 29 Aug 2024 08:48:49 +0300 +Subject: media: i2c: ar0521: Use cansleep version of gpiod_set_value() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Shiyan + +commit bee1aed819a8cda47927436685d216906ed17f62 upstream. + +If we use GPIO reset from I2C port expander, we must use *_cansleep() +variant of GPIO functions. +This was not done in ar0521_power_on()/ar0521_power_off() functions. +Let's fix that. + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c +Modules linked in: +CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 +Hardware name: Diasom DS-RK3568-SOM-EVB (DT) +Workqueue: events_unbound deferred_probe_work_func +pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : gpiod_set_value+0x74/0x7c +lr : ar0521_power_on+0xcc/0x290 +sp : ffffff8001d7ab70 +x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000 +x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088 +x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088 +x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80 +x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000 +x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930 +x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 +x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 +x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001 +Call trace: + gpiod_set_value+0x74/0x7c + ar0521_power_on+0xcc/0x290 +... + +Signed-off-by: Alexander Shiyan +Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver") +Cc: stable@vger.kernel.org +Acked-by: Krzysztof Hałasa +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ar0521.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ar0521.c ++++ b/drivers/media/i2c/ar0521.c +@@ -718,7 +718,8 @@ static int ar0521_power_off(struct devic + clk_disable_unprepare(sensor->extclk); + + if (sensor->reset_gpio) +- gpiod_set_value(sensor->reset_gpio, 1); /* assert RESET signal */ ++ /* assert RESET signal */ ++ gpiod_set_value_cansleep(sensor->reset_gpio, 1); + + for (i = ARRAY_SIZE(ar0521_supply_names) - 1; i >= 0; i--) { + if (sensor->supplies[i]) +@@ -752,7 +753,7 @@ static int ar0521_power_on(struct device + + if (sensor->reset_gpio) + /* deassert RESET signal */ +- gpiod_set_value(sensor->reset_gpio, 0); ++ gpiod_set_value_cansleep(sensor->reset_gpio, 0); + usleep_range(4500, 5000); /* min 45000 clocks */ + + for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) { diff --git a/queue-6.1/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch b/queue-6.1/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch new file mode 100644 index 00000000000..a996a813157 --- /dev/null +++ b/queue-6.1/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch @@ -0,0 +1,122 @@ +From 7d59ac07ccb58f8f604f8057db63b8efcebeb3de Mon Sep 17 00:00:00 2001 +From: Zach Wade +Date: Mon, 23 Sep 2024 22:45:08 +0800 +Subject: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug + +From: Zach Wade + +commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream. + +Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". +kasan report: +[ 19.411889] ================================================================== +[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 +[ 19.417368] +[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 +[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 +[ 19.422687] Call Trace: +[ 19.424091] +[ 19.425448] dump_stack_lvl+0x5d/0x80 +[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.428694] print_report+0x19d/0x52e +[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 +[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.433539] kasan_report+0xf0/0x170 +[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 +[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] +[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] +[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 +[ 19.444797] cpuhp_invoke_callback+0x221/0xec0 +[ 19.446337] cpuhp_thread_fun+0x21b/0x610 +[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 +[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 +[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 +[ 19.452405] kthread+0x29c/0x350 +[ 19.453817] ? __pfx_kthread+0x10/0x10 +[ 19.455253] ret_from_fork+0x31/0x70 +[ 19.456685] ? __pfx_kthread+0x10/0x10 +[ 19.458114] ret_from_fork_asm+0x1a/0x30 +[ 19.459573] +[ 19.460853] +[ 19.462055] Allocated by task 1198: +[ 19.463410] kasan_save_stack+0x30/0x50 +[ 19.464788] kasan_save_track+0x14/0x30 +[ 19.466139] __kasan_kmalloc+0xaa/0xb0 +[ 19.467465] __kmalloc+0x1cd/0x470 +[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] +[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] +[ 19.471670] do_one_initcall+0xa4/0x380 +[ 19.472903] do_init_module+0x238/0x760 +[ 19.474105] load_module+0x5239/0x6f00 +[ 19.475285] init_module_from_file+0xd1/0x130 +[ 19.476506] idempotent_init_module+0x23b/0x650 +[ 19.477725] __x64_sys_finit_module+0xbe/0x130 +[ 19.476506] idempotent_init_module+0x23b/0x650 +[ 19.477725] __x64_sys_finit_module+0xbe/0x130 +[ 19.478920] do_syscall_64+0x82/0x160 +[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 19.481292] +[ 19.482205] The buggy address belongs to the object at ffff888829e65000 + which belongs to the cache kmalloc-512 of size 512 +[ 19.484818] The buggy address is located 0 bytes to the right of + allocated 512-byte region [ffff888829e65000, ffff888829e65200) +[ 19.487447] +[ 19.488328] The buggy address belongs to the physical page: +[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 +[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) +[ 19.493914] page_type: 0xffffffff() +[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 +[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 +[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 +[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 +[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff +[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 +[ 19.503784] page dumped because: kasan: bad access detected +[ 19.505058] +[ 19.505970] Memory state around the buggy address: +[ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.510014] ^ +[ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.515367] ================================================================== + +The reason for this error is physical_package_ids assigned by VMware VMM +are not continuous and have gaps. This will cause value returned by +topology_physical_package_id() to be more than topology_max_packages(). + +Here the allocation uses topology_max_packages(). The call to +topology_max_packages() returns maximum logical package ID not physical +ID. Hence use topology_logical_package_id() instead of +topology_physical_package_id(). + +Fixes: 9a1aac8a96dc ("platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering") +Cc: stable@vger.kernel.org +Acked-by: Srinivas Pandruvada +Signed-off-by: Zach Wade +Link: https://lore.kernel.org/r/20240923144508.1764-1-zachwade.k@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c ++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c +@@ -306,7 +306,9 @@ static struct pci_dev *_isst_if_get_pci_ + cpu >= nr_cpu_ids || cpu >= num_possible_cpus()) + return NULL; + +- pkg_id = topology_physical_package_id(cpu); ++ pkg_id = topology_logical_package_id(cpu); ++ if (pkg_id >= topology_max_packages()) ++ return NULL; + + bus_number = isst_cpu_info[cpu].bus_info[bus_no]; + if (bus_number < 0) diff --git a/queue-6.1/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch b/queue-6.1/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch new file mode 100644 index 00000000000..41cbc66ec7b --- /dev/null +++ b/queue-6.1/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch @@ -0,0 +1,41 @@ +From e50a57d16f897e45de1112eb6478577b197fab52 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 8 Sep 2024 20:53:37 +0200 +Subject: power: supply: hwmon: Fix missing temp1_max_alarm attribute + +From: Hans de Goede + +commit e50a57d16f897e45de1112eb6478577b197fab52 upstream. + +Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for +power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX +property. + +HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for +temp channel 0, causing the hwmon temp1_max_alarm attribute to be +missing from such power_supply devices. + +Add this to power_supply_hwmon_info to fix this. + +Fixes: f1d33ae806ec ("power: supply: remove duplicated argument in power_supply_hwmon_info") +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240908185337.103696-2-hdegoede@redhat.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/power_supply_hwmon.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/power_supply_hwmon.c ++++ b/drivers/power/supply/power_supply_hwmon.c +@@ -299,7 +299,8 @@ static const struct hwmon_channel_info * + HWMON_T_INPUT | + HWMON_T_MAX | + HWMON_T_MIN | +- HWMON_T_MIN_ALARM, ++ HWMON_T_MIN_ALARM | ++ HWMON_T_MAX_ALARM, + + HWMON_T_LABEL | + HWMON_T_INPUT | diff --git a/queue-6.1/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch b/queue-6.1/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch new file mode 100644 index 00000000000..718dce3b649 --- /dev/null +++ b/queue-6.1/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch @@ -0,0 +1,74 @@ +From 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 2 Oct 2024 17:59:39 +0200 +Subject: Revert "ALSA: hda: Conditionally use snooping for AMD HDMI" + +From: Takashi Iwai + +commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream. + +This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4. + +The fix seems leading to regressions for other systems. +Also, the way to check the presence of IOMMU via get_dma_ops() isn't +reliable and it's no longer applicable for 6.12. After all, it's no +right fix, so let's revert it at first. + +To be noted, the PCM buffer allocation has been changed to try the +continuous pages at first since 6.12, so the problem could be already +addressed without this hackish workaround. + +Reported-by: Salvatore Bonaccorso +Closes: https://lore.kernel.org/ZvgCdYfKgwHpJXGE@eldamar.lan +Link: https://patch.msgid.link/20241002155948.4859-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_controller.h | 2 +- + sound/pci/hda/hda_intel.c | 10 +--------- + 2 files changed, 2 insertions(+), 10 deletions(-) + +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -28,7 +28,7 @@ + #else + #define AZX_DCAPS_I915_COMPONENT 0 /* NOP */ + #endif +-#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14) /* AMD allocation workaround */ ++/* 14 unused */ + #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */ + #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */ + #define AZX_DCAPS_AMD_WORKAROUND (1 << 17) /* AMD-specific workaround */ +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -40,7 +40,6 @@ + + #ifdef CONFIG_X86 + /* for snoop control */ +-#include + #include + #include + #endif +@@ -301,7 +300,7 @@ enum { + + /* quirks for ATI HDMI with snoop off */ + #define AZX_DCAPS_PRESET_ATI_HDMI_NS \ +- (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX) ++ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF) + + /* quirks for AMD SB */ + #define AZX_DCAPS_PRESET_AMD_SB \ +@@ -1719,13 +1718,6 @@ static void azx_check_snoop_available(st + if (chip->driver_caps & AZX_DCAPS_SNOOP_OFF) + snoop = false; + +-#ifdef CONFIG_X86 +- /* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */ +- if ((chip->driver_caps & AZX_DCAPS_AMD_ALLOC_FIX) && +- !get_dma_ops(chip->card->dev)) +- snoop = false; +-#endif +- + chip->snoop = snoop; + if (!snoop) { + dev_info(chip->card->dev, "Force to non-snoop mode\n"); diff --git a/queue-6.1/series b/queue-6.1/series index 9feec4c00cf..b5170ca2234 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -523,3 +523,12 @@ selftests-mm-fix-charge_reserved_hugetlb.sh-test.patch powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch selftests-vdso-fix-vdso_config-for-s390.patch +revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch +platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch +i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch +i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch +i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch +media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch +firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch +spi-bcm63xx-fix-module-autoloading.patch +power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch diff --git a/queue-6.1/spi-bcm63xx-fix-module-autoloading.patch b/queue-6.1/spi-bcm63xx-fix-module-autoloading.patch new file mode 100644 index 00000000000..b9faa57ab8a --- /dev/null +++ b/queue-6.1/spi-bcm63xx-fix-module-autoloading.patch @@ -0,0 +1,33 @@ +From 909f34f2462a99bf876f64c5c61c653213e32fce Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Mon, 19 Aug 2024 20:33:48 +0800 +Subject: spi: bcm63xx: Fix module autoloading + +From: Jinjie Ruan + +commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream. + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded +based on the alias from platform_device_id table. + +Fixes: 44d8fb30941d ("spi/bcm63xx: move register definitions into the driver") +Cc: stable@vger.kernel.org +Signed-off-by: Jinjie Ruan +Reviewed-by: Jonas Gorski +Link: https://patch.msgid.link/20240819123349.4020472-2-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -476,6 +476,7 @@ static const struct platform_device_id b + { + }, + }; ++MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match); + + static const struct of_device_id bcm63xx_spi_of_match[] = { + { .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },