From: Sasha Levin Date: Sun, 5 Jul 2026 13:51:28 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e746a1dea2b5590c1abb843bf6bd2f25ed771920;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/dma-buf-remove-unused-dma-fence-unwrap.c-stable-linu.patch b/queue-5.15/dma-buf-remove-unused-dma-fence-unwrap.c-stable-linu.patch new file mode 100644 index 0000000000..c613f5e109 --- /dev/null +++ b/queue-5.15/dma-buf-remove-unused-dma-fence-unwrap.c-stable-linu.patch @@ -0,0 +1,215 @@ +From 99806b60f5b3fa495bdcff55227e46f68b386cf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2026 14:28:01 +0000 +Subject: dma-buf: remove unused dma-fence-unwrap.c (stable/linux-5.15.y only) + +From: Tudor Ambarus + +The file drivers/dma-buf/dma-fence-unwrap.c was incorrectly added to +the 5.15.y stable branch in commit 4e82b9c11d3c ("dma-buf: add +dma_fence_timestamp helper") as a new file, but it was never enabled in +the Makefile, and its header include/linux/dma-fence-unwrap.h was not +present, making it uncompilable. + +A full revert of commit 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp +helper") is not desirable because that commit also introduced the valid +dma_fence_timestamp() helper and fixed legitimate timestamp race +windows in drivers/dma-buf/sync_file.c and +drivers/gpu/drm/scheduler/sched_main.c. + +Since there are no users of dma-fence-unwrap in the 5.15.y branch, +remove the unused file to clean up the tree and avoid confusion. + +Fixes: 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp helper") +Signed-off-by: Tudor Ambarus +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-fence-unwrap.c | 176 ----------------------------- + 1 file changed, 176 deletions(-) + delete mode 100644 drivers/dma-buf/dma-fence-unwrap.c + +diff --git a/drivers/dma-buf/dma-fence-unwrap.c b/drivers/dma-buf/dma-fence-unwrap.c +deleted file mode 100644 +index 628af51c81af3d..00000000000000 +--- a/drivers/dma-buf/dma-fence-unwrap.c ++++ /dev/null +@@ -1,176 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * dma-fence-util: misc functions for dma_fence objects +- * +- * Copyright (C) 2022 Advanced Micro Devices, Inc. +- * Authors: +- * Christian König +- */ +- +-#include +-#include +-#include +-#include +-#include +- +-/* Internal helper to start new array iteration, don't use directly */ +-static struct dma_fence * +-__dma_fence_unwrap_array(struct dma_fence_unwrap *cursor) +-{ +- cursor->array = dma_fence_chain_contained(cursor->chain); +- cursor->index = 0; +- return dma_fence_array_first(cursor->array); +-} +- +-/** +- * dma_fence_unwrap_first - return the first fence from fence containers +- * @head: the entrypoint into the containers +- * @cursor: current position inside the containers +- * +- * Unwraps potential dma_fence_chain/dma_fence_array containers and return the +- * first fence. +- */ +-struct dma_fence *dma_fence_unwrap_first(struct dma_fence *head, +- struct dma_fence_unwrap *cursor) +-{ +- cursor->chain = dma_fence_get(head); +- return __dma_fence_unwrap_array(cursor); +-} +-EXPORT_SYMBOL_GPL(dma_fence_unwrap_first); +- +-/** +- * dma_fence_unwrap_next - return the next fence from a fence containers +- * @cursor: current position inside the containers +- * +- * Continue unwrapping the dma_fence_chain/dma_fence_array containers and return +- * the next fence from them. +- */ +-struct dma_fence *dma_fence_unwrap_next(struct dma_fence_unwrap *cursor) +-{ +- struct dma_fence *tmp; +- +- ++cursor->index; +- tmp = dma_fence_array_next(cursor->array, cursor->index); +- if (tmp) +- return tmp; +- +- cursor->chain = dma_fence_chain_walk(cursor->chain); +- return __dma_fence_unwrap_array(cursor); +-} +-EXPORT_SYMBOL_GPL(dma_fence_unwrap_next); +- +-/* Implementation for the dma_fence_merge() marco, don't use directly */ +-struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences, +- struct dma_fence **fences, +- struct dma_fence_unwrap *iter) +-{ +- struct dma_fence_array *result; +- struct dma_fence *tmp, **array; +- ktime_t timestamp; +- unsigned int i; +- size_t count; +- +- count = 0; +- timestamp = ns_to_ktime(0); +- for (i = 0; i < num_fences; ++i) { +- dma_fence_unwrap_for_each(tmp, &iter[i], fences[i]) { +- if (!dma_fence_is_signaled(tmp)) { +- ++count; +- } else { +- ktime_t t = dma_fence_timestamp(tmp); +- +- if (ktime_after(t, timestamp)) +- timestamp = t; +- } +- } +- } +- +- /* +- * If we couldn't find a pending fence just return a private signaled +- * fence with the timestamp of the last signaled one. +- */ +- if (count == 0) +- return dma_fence_allocate_private_stub(timestamp); +- +- array = kmalloc_array(count, sizeof(*array), GFP_KERNEL); +- if (!array) +- return NULL; +- +- /* +- * This trashes the input fence array and uses it as position for the +- * following merge loop. This works because the dma_fence_merge() +- * wrapper macro is creating this temporary array on the stack together +- * with the iterators. +- */ +- for (i = 0; i < num_fences; ++i) +- fences[i] = dma_fence_unwrap_first(fences[i], &iter[i]); +- +- count = 0; +- do { +- unsigned int sel; +- +-restart: +- tmp = NULL; +- for (i = 0; i < num_fences; ++i) { +- struct dma_fence *next; +- +- while (fences[i] && dma_fence_is_signaled(fences[i])) +- fences[i] = dma_fence_unwrap_next(&iter[i]); +- +- next = fences[i]; +- if (!next) +- continue; +- +- /* +- * We can't guarantee that inpute fences are ordered by +- * context, but it is still quite likely when this +- * function is used multiple times. So attempt to order +- * the fences by context as we pass over them and merge +- * fences with the same context. +- */ +- if (!tmp || tmp->context > next->context) { +- tmp = next; +- sel = i; +- +- } else if (tmp->context < next->context) { +- continue; +- +- } else if (dma_fence_is_later(tmp, next)) { +- fences[i] = dma_fence_unwrap_next(&iter[i]); +- goto restart; +- } else { +- fences[sel] = dma_fence_unwrap_next(&iter[sel]); +- goto restart; +- } +- } +- +- if (tmp) { +- array[count++] = dma_fence_get(tmp); +- fences[sel] = dma_fence_unwrap_next(&iter[sel]); +- } +- } while (tmp); +- +- if (count == 0) { +- tmp = dma_fence_allocate_private_stub(ktime_get()); +- goto return_tmp; +- } +- +- if (count == 1) { +- tmp = array[0]; +- goto return_tmp; +- } +- +- result = dma_fence_array_create(count, array, +- dma_fence_context_alloc(1), +- 1, false); +- if (!result) { +- tmp = NULL; +- goto return_tmp; +- } +- return &result->base; +- +-return_tmp: +- kfree(array); +- return tmp; +-} +-EXPORT_SYMBOL_GPL(__dma_fence_unwrap_merge); +-- +2.53.0 + diff --git a/queue-5.15/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch b/queue-5.15/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch new file mode 100644 index 0000000000..2c4ddc10fa --- /dev/null +++ b/queue-5.15/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch @@ -0,0 +1,52 @@ +From db44424031c349a0fccab9c5bd00f81621d7d08f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 18:25:13 -0300 +Subject: net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys + +From: Pedro Tammela + +[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ] + +Transform two checks in the 'ex' key parsing into netlink policies +removing extra if checks. + +Signed-off-by: Pedro Tammela +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index efcbca97bf2eda..a987f60d202826 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + }; + + static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = { +- [TCA_PEDIT_KEY_EX_HTYPE] = { .type = NLA_U16 }, +- [TCA_PEDIT_KEY_EX_CMD] = { .type = NLA_U16 }, ++ [TCA_PEDIT_KEY_EX_HTYPE] = ++ NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX), ++ [TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX), + }; + + static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla, +@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla, + k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]); + k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]); + +- if (k->htype > TCA_PEDIT_HDR_TYPE_MAX || +- k->cmd > TCA_PEDIT_CMD_MAX) { +- err = -EINVAL; +- goto err_out; +- } +- + k++; + } + +-- +2.53.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 78a5123e8a..9c069ffbd9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -4,3 +4,10 @@ nfsd-release-layout-stid-on-setlease-failure.patch nfsd-reset-write-verifier-on-deferred-writeback-erro.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch clk-imx-add-check-for-kcalloc.patch +net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch +dma-buf-remove-unused-dma-fence-unwrap.c-stable-linu.patch +slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch +slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch +slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch +slimbus-convert-to-platform-remove-callback-returnin.patch +slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch diff --git a/queue-5.15/slimbus-convert-to-platform-remove-callback-returnin.patch b/queue-5.15/slimbus-convert-to-platform-remove-callback-returnin.patch new file mode 100644 index 0000000000..6439bb8f55 --- /dev/null +++ b/queue-5.15/slimbus-convert-to-platform-remove-callback-returnin.patch @@ -0,0 +1,121 @@ +From fff8a842d756e185c2f62355deccc97ab4a8d50c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:16:56 +0100 +Subject: slimbus: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is ignored (apart +from emitting a warning) and this typically results in resource leaks. + +To improve here there is a quest to make the remove callback return +void. In the first step of this quest all drivers are converted to +.remove_new(), which already returns void. Eventually after all drivers +are converted, .remove_new() will be renamed to .remove(). + +Trivially convert the slimbus drivers from always returning zero in the +remove callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd") +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ctrl.c | 5 ++--- + drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++------- + 2 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c +index ec58091fc948a2..5866014f0e2327 100644 +--- a/drivers/slimbus/qcom-ctrl.c ++++ b/drivers/slimbus/qcom-ctrl.c +@@ -630,7 +630,7 @@ static int qcom_slim_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_remove(struct platform_device *pdev) ++static void qcom_slim_remove(struct platform_device *pdev) + { + struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -639,7 +639,6 @@ static int qcom_slim_remove(struct platform_device *pdev) + clk_disable_unprepare(ctrl->rclk); + clk_disable_unprepare(ctrl->hclk); + destroy_workqueue(ctrl->rxwq); +- return 0; + } + + /* +@@ -726,7 +725,7 @@ static const struct of_device_id qcom_slim_dt_match[] = { + + static struct platform_driver qcom_slim_driver = { + .probe = qcom_slim_probe, +- .remove = qcom_slim_remove, ++ .remove_new = qcom_slim_remove, + .driver = { + .name = "qcom_slim_ctrl", + .of_match_table = qcom_slim_dt_match, +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 91e9a39c6dcf03..eb9d9d3d2948cc 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1597,7 +1597,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1605,11 +1605,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + qcom_slim_ngd_unregister(ctrl); +- +- return 0; + } + +-static int qcom_slim_ngd_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1622,7 +1620,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + + kfree(ctrl->ngd); + ctrl->ngd = NULL; +- return 0; + } + + static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev) +@@ -1665,7 +1662,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = { + + static struct platform_driver qcom_slim_ngd_ctrl_driver = { + .probe = qcom_slim_ngd_ctrl_probe, +- .remove = qcom_slim_ngd_ctrl_remove, ++ .remove_new = qcom_slim_ngd_ctrl_remove, + .driver = { + .name = "qcom,slim-ngd-ctrl", + .of_match_table = qcom_slim_ngd_dt_match, +@@ -1674,7 +1671,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = { + + static struct platform_driver qcom_slim_ngd_driver = { + .probe = qcom_slim_ngd_probe, +- .remove = qcom_slim_ngd_remove, ++ .remove_new = qcom_slim_ngd_remove, + .driver = { + .name = QCOM_SLIM_NGD_DRV_NAME, + .pm = &qcom_slim_ngd_dev_pm_ops, +-- +2.53.0 + diff --git a/queue-5.15/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch b/queue-5.15/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch new file mode 100644 index 0000000000..136f58f9c3 --- /dev/null +++ b/queue-5.15/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch @@ -0,0 +1,54 @@ +From 93fcce87174eb2127db224776c5e4f1d5fd0e98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:17 +0100 +Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership + +From: Bjorn Andersson + +[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ] + +PDR and SSR callbacks are registred from the controller probe function, +but currently released from the child device's remove function. + +The remove() function should only be unwinding what was done in the +same device's probe() function. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 0ee537576b8204..91e9a39c6dcf03 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1601,6 +1601,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + ++ pdr_handle_release(ctrl->pdr); ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); ++ + qcom_slim_ngd_unregister(ctrl); + + return 0; +@@ -1611,8 +1614,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + + pm_runtime_disable(&pdev->dev); +- pdr_handle_release(ctrl->pdr); +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + qcom_slim_ngd_enable(ctrl, false); + qcom_slim_ngd_exit_dma(ctrl); + qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi); +-- +2.53.0 + diff --git a/queue-5.15/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch b/queue-5.15/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch new file mode 100644 index 0000000000..b9f6ce3ec8 --- /dev/null +++ b/queue-5.15/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch @@ -0,0 +1,62 @@ +From cfbb74cdd4595a63b666e32b8e6a189fc406e524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:16 +0100 +Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering + +From: Bjorn Andersson + +[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ] + +qcom_slim_ngd_ctrl_probe() first registers the SSR callback then +allocates the PDR context, as such the error path needs to come in +opposite order to allow us to unroll each step. + +Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 346cd7c8127065..0ee537576b8204 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1577,23 +1577,22 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->pdr)) { + dev_err(dev, "Failed to init PDR handle\n"); + ret = PTR_ERR(ctrl->pdr); +- goto err_pdr_alloc; ++ goto err_unregister_ssr; + } + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { + ret = PTR_ERR(pds); + dev_err(dev, "pdr add lookup failed: %d\n", ret); +- goto err_pdr_lookup; ++ goto err_pdr_release; + } + + return of_qcom_slim_ngd_register(dev, ctrl); + +-err_pdr_alloc: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); +- +-err_pdr_lookup: ++err_pdr_release: + pdr_handle_release(ctrl->pdr); ++err_unregister_ssr: ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-5.15/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch b/queue-5.15/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch new file mode 100644 index 0000000000..519d0d7ab9 --- /dev/null +++ b/queue-5.15/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch @@ -0,0 +1,100 @@ +From f6126c79efb8a708f0115a21b5e817dab2fe7bf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:15 +0100 +Subject: slimbus: qcom-ngd-ctrl: Fix up platform_driver registration + +From: Bjorn Andersson + +[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ] + +Device drivers should not invoke platform_driver_register()/unregister() +in their probe and remove paths. They should further not rely on +platform_driver_unregister() as their only means of "deleting" their +child devices. + +Introduce a helper to unregister the child device and move the +platform_driver_register()/unregister() to module_init()/exit(). + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-3-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++--- + 1 file changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index defd22edcb414d..346cd7c8127065 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1471,6 +1471,13 @@ static int of_qcom_slim_ngd_register(struct device *parent, + return -ENODEV; + } + ++static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl) ++{ ++ struct qcom_slim_ngd *ngd = ctrl->ngd; ++ ++ platform_device_del(ngd->pdev); ++} ++ + static int qcom_slim_ngd_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1580,7 +1587,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + goto err_pdr_lookup; + } + +- platform_driver_register(&qcom_slim_ngd_driver); + return of_qcom_slim_ngd_register(dev, ctrl); + + err_pdr_alloc: +@@ -1594,7 +1600,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + + static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { +- platform_driver_unregister(&qcom_slim_ngd_driver); ++ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); ++ ++ qcom_slim_ngd_unregister(ctrl); + + return 0; + } +@@ -1673,6 +1681,28 @@ static struct platform_driver qcom_slim_ngd_driver = { + }, + }; + +-module_platform_driver(qcom_slim_ngd_ctrl_driver); ++static int qcom_slim_ngd_init(void) ++{ ++ int ret; ++ ++ ret = platform_driver_register(&qcom_slim_ngd_driver); ++ if (ret) ++ return ret; ++ ++ ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver); ++ if (ret) ++ platform_driver_unregister(&qcom_slim_ngd_driver); ++ ++ return ret; ++} ++ ++static void qcom_slim_ngd_exit(void) ++{ ++ platform_driver_unregister(&qcom_slim_ngd_ctrl_driver); ++ platform_driver_unregister(&qcom_slim_ngd_driver); ++} ++ ++module_init(qcom_slim_ngd_init); ++module_exit(qcom_slim_ngd_exit); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller"); +-- +2.53.0 + diff --git a/queue-5.15/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch b/queue-5.15/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch new file mode 100644 index 0000000000..7d1dc7cbf9 --- /dev/null +++ b/queue-5.15/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch @@ -0,0 +1,144 @@ +From ddb18b3538e93bc30bf539a60cb5b06b22ed6514 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:18 +0100 +Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd + +From: Bjorn Andersson + +[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ] + +When the remoteproc starts in parallel with the NGD driver being probed, +or the remoteproc is already up when the PDR lookup is being registered, +or in the theoretical event that we get an interrupt from the hardware, +these callbacks will operate on uninitialized data. This result in +issues to boot the affected boards. + +One such example can be seen in the following fault, where +qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. + +[ 21.858578] ------------[ cut here ]------------ +[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 +... +[ 21.859251] Call trace: +[ 21.859255] __queue_work+0x5e0/0x790 (P) +[ 21.859265] queue_work_on+0x6c/0xf0 +[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] +[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] +[ 21.859318] notifier_call_chain+0xa4/0x230 +[ 21.859329] srcu_notifier_call_chain+0x64/0xb8 +[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] +[ 21.859355] rproc_start+0x130/0x230 +[ 21.859367] rproc_boot+0x3d4/0x518 +... + +Move the enablement of interrupts, and the registration of SSR and PDR +until after the NGD device has been registered. + +This could be further refined by moving initialization to the control +driver probe and by removing the platform driver model from the picture. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 56 +++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 27 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index eb9d9d3d2948cc..da57e44624caa3 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1521,6 +1521,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct qcom_slim_ngd_ctrl *ctrl; + struct resource *res; ++ int irq; + int ret; + struct pdr_service *pds; + +@@ -1535,23 +1536,15 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->base)) + return PTR_ERR(ctrl->base); + +- res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res) { +- dev_err(&pdev->dev, "no slimbus IRQ resource\n"); +- return -ENODEV; +- } +- +- ret = devm_request_irq(dev, res->start, qcom_slim_ngd_interrupt, +- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl); +- if (ret) { +- dev_err(&pdev->dev, "request IRQ failed\n"); +- return ret; +- } ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + +- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; +- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); +- if (IS_ERR(ctrl->notifier)) +- return PTR_ERR(ctrl->notifier); ++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt, ++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, ++ "slim-ngd", ctrl); ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n"); + + ctrl->dev = dev; + ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3; +@@ -1574,25 +1567,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + init_completion(&ctrl->qmi_up); + + ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl); +- if (IS_ERR(ctrl->pdr)) { +- dev_err(dev, "Failed to init PDR handle\n"); +- ret = PTR_ERR(ctrl->pdr); +- goto err_unregister_ssr; +- } ++ if (IS_ERR(ctrl->pdr)) ++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n"); ++ ++ ret = of_qcom_slim_ngd_register(dev, ctrl); ++ if (ret) ++ goto err_pdr_release; + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { +- ret = PTR_ERR(pds); +- dev_err(dev, "pdr add lookup failed: %d\n", ret); +- goto err_pdr_release; ++ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n"); ++ goto err_unregister_ngd; ++ } ++ ++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; ++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); ++ if (IS_ERR(ctrl->notifier)) { ++ ret = PTR_ERR(ctrl->notifier); ++ goto err_unregister_ngd; + } + +- return of_qcom_slim_ngd_register(dev, ctrl); ++ enable_irq(irq); ++ ++ return 0; + ++err_unregister_ngd: ++ qcom_slim_ngd_unregister(ctrl); + err_pdr_release: + pdr_handle_release(ctrl->pdr); +-err_unregister_ssr: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-6.1/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch b/queue-6.1/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch new file mode 100644 index 0000000000..7cc87a56c4 --- /dev/null +++ b/queue-6.1/net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch @@ -0,0 +1,52 @@ +From 609d84d69abb3d0c4b13ebb4b1c445af817ebdb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 18:25:13 -0300 +Subject: net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys + +From: Pedro Tammela + +[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ] + +Transform two checks in the 'ex' key parsing into netlink policies +removing extra if checks. + +Signed-off-by: Pedro Tammela +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 09310b56b45beb..1d06873da8f12d 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + }; + + static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = { +- [TCA_PEDIT_KEY_EX_HTYPE] = { .type = NLA_U16 }, +- [TCA_PEDIT_KEY_EX_CMD] = { .type = NLA_U16 }, ++ [TCA_PEDIT_KEY_EX_HTYPE] = ++ NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX), ++ [TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX), + }; + + static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla, +@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla, + k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]); + k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]); + +- if (k->htype > TCA_PEDIT_HDR_TYPE_MAX || +- k->cmd > TCA_PEDIT_CMD_MAX) { +- err = -EINVAL; +- goto err_out; +- } +- + k++; + } + +-- +2.53.0 + diff --git a/queue-6.1/series b/queue-6.1/series index cc168ce6a7..57d129b5df 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -4,3 +4,9 @@ nfsd-release-layout-stid-on-setlease-failure.patch nfsd-reset-write-verifier-on-deferred-writeback-erro.patch loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch +net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch +slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch +slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch +slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch +slimbus-convert-to-platform-remove-callback-returnin.patch +slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch diff --git a/queue-6.1/slimbus-convert-to-platform-remove-callback-returnin.patch b/queue-6.1/slimbus-convert-to-platform-remove-callback-returnin.patch new file mode 100644 index 0000000000..4372967a2e --- /dev/null +++ b/queue-6.1/slimbus-convert-to-platform-remove-callback-returnin.patch @@ -0,0 +1,139 @@ +From 1f5444caab3affc9065b63de2d13b3fe1bcea67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:16:56 +0100 +Subject: slimbus: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is ignored (apart +from emitting a warning) and this typically results in resource leaks. + +To improve here there is a quest to make the remove callback return +void. In the first step of this quest all drivers are converted to +.remove_new(), which already returns void. Eventually after all drivers +are converted, .remove_new() will be renamed to .remove(). + +Trivially convert the slimbus drivers from always returning zero in the +remove callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd") +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ctrl.c | 5 ++--- + drivers/slimbus/qcom-ngd-ctrl.c | 15 +++++---------- + 2 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c +index c0c4f895d76e20..31f46000ca030f 100644 +--- a/drivers/slimbus/qcom-ctrl.c ++++ b/drivers/slimbus/qcom-ctrl.c +@@ -628,7 +628,7 @@ static int qcom_slim_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_remove(struct platform_device *pdev) ++static void qcom_slim_remove(struct platform_device *pdev) + { + struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -637,7 +637,6 @@ static int qcom_slim_remove(struct platform_device *pdev) + clk_disable_unprepare(ctrl->rclk); + clk_disable_unprepare(ctrl->hclk); + destroy_workqueue(ctrl->rxwq); +- return 0; + } + + /* +@@ -724,7 +723,7 @@ static const struct of_device_id qcom_slim_dt_match[] = { + + static struct platform_driver qcom_slim_driver = { + .probe = qcom_slim_probe, +- .remove = qcom_slim_remove, ++ .remove_new = qcom_slim_remove, + .driver = { + .name = "qcom_slim_ctrl", + .of_match_table = qcom_slim_dt_match, +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 6003f6f99e1db3..bf2007dc3cd043 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1537,7 +1537,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct qcom_slim_ngd_ctrl *ctrl; +- struct resource *res; + int ret; + struct pdr_service *pds; + +@@ -1547,8 +1546,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + + dev_set_drvdata(dev, ctrl); + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- ctrl->base = devm_ioremap_resource(dev, res); ++ ctrl->base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL); + if (IS_ERR(ctrl->base)) + return PTR_ERR(ctrl->base); + +@@ -1609,7 +1607,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1617,11 +1615,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + qcom_slim_ngd_unregister(ctrl); +- +- return 0; + } + +-static int qcom_slim_ngd_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1634,7 +1630,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + + kfree(ctrl->ngd); + ctrl->ngd = NULL; +- return 0; + } + + static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev) +@@ -1677,7 +1672,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = { + + static struct platform_driver qcom_slim_ngd_ctrl_driver = { + .probe = qcom_slim_ngd_ctrl_probe, +- .remove = qcom_slim_ngd_ctrl_remove, ++ .remove_new = qcom_slim_ngd_ctrl_remove, + .driver = { + .name = "qcom,slim-ngd-ctrl", + .of_match_table = qcom_slim_ngd_dt_match, +@@ -1686,7 +1681,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = { + + static struct platform_driver qcom_slim_ngd_driver = { + .probe = qcom_slim_ngd_probe, +- .remove = qcom_slim_ngd_remove, ++ .remove_new = qcom_slim_ngd_remove, + .driver = { + .name = QCOM_SLIM_NGD_DRV_NAME, + .pm = &qcom_slim_ngd_dev_pm_ops, +-- +2.53.0 + diff --git a/queue-6.1/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch b/queue-6.1/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch new file mode 100644 index 0000000000..45d8a64faa --- /dev/null +++ b/queue-6.1/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch @@ -0,0 +1,54 @@ +From f24a304170fbdc134aab3a794a4f86b2105c8d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:17 +0100 +Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership + +From: Bjorn Andersson + +[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ] + +PDR and SSR callbacks are registred from the controller probe function, +but currently released from the child device's remove function. + +The remove() function should only be unwinding what was done in the +same device's probe() function. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 62b0615a62c68f..6003f6f99e1db3 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1613,6 +1613,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + ++ pdr_handle_release(ctrl->pdr); ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); ++ + qcom_slim_ngd_unregister(ctrl); + + return 0; +@@ -1623,8 +1626,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + + pm_runtime_disable(&pdev->dev); +- pdr_handle_release(ctrl->pdr); +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + qcom_slim_ngd_enable(ctrl, false); + qcom_slim_ngd_exit_dma(ctrl); + qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi); +-- +2.53.0 + diff --git a/queue-6.1/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch b/queue-6.1/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch new file mode 100644 index 0000000000..d0c76395a7 --- /dev/null +++ b/queue-6.1/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch @@ -0,0 +1,61 @@ +From e2ba62022c09b261777d801efd4311c21bc5d233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:16 +0100 +Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering + +From: Bjorn Andersson + +[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ] + +qcom_slim_ngd_ctrl_probe() first registers the SSR callback then +allocates the PDR context, as such the error path needs to come in +opposite order to allow us to unroll each step. + +Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index a43daa48484f1e..62b0615a62c68f 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1590,22 +1590,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->pdr)) { + ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr), + "Failed to init PDR handle\n"); +- goto err_pdr_alloc; ++ goto err_unregister_ssr; + } + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { + ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n"); +- goto err_pdr_lookup; ++ goto err_pdr_release; + } + + return of_qcom_slim_ngd_register(dev, ctrl); + +-err_pdr_alloc: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); +- +-err_pdr_lookup: ++err_pdr_release: + pdr_handle_release(ctrl->pdr); ++err_unregister_ssr: ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-6.1/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch b/queue-6.1/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch new file mode 100644 index 0000000000..75264ed033 --- /dev/null +++ b/queue-6.1/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch @@ -0,0 +1,100 @@ +From 16c87c44cc56f8b72bbb026a0566982484caf04f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:15 +0100 +Subject: slimbus: qcom-ngd-ctrl: Fix up platform_driver registration + +From: Bjorn Andersson + +[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ] + +Device drivers should not invoke platform_driver_register()/unregister() +in their probe and remove paths. They should further not rely on +platform_driver_unregister() as their only means of "deleting" their +child devices. + +Introduce a helper to unregister the child device and move the +platform_driver_register()/unregister() to module_init()/exit(). + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-3-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++--- + 1 file changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index d294965e49972c..a43daa48484f1e 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1488,6 +1488,13 @@ static int of_qcom_slim_ngd_register(struct device *parent, + return -ENODEV; + } + ++static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl) ++{ ++ struct qcom_slim_ngd *ngd = ctrl->ngd; ++ ++ platform_device_del(ngd->pdev); ++} ++ + static int qcom_slim_ngd_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1592,7 +1599,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + goto err_pdr_lookup; + } + +- platform_driver_register(&qcom_slim_ngd_driver); + return of_qcom_slim_ngd_register(dev, ctrl); + + err_pdr_alloc: +@@ -1606,7 +1612,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + + static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { +- platform_driver_unregister(&qcom_slim_ngd_driver); ++ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); ++ ++ qcom_slim_ngd_unregister(ctrl); + + return 0; + } +@@ -1685,6 +1693,28 @@ static struct platform_driver qcom_slim_ngd_driver = { + }, + }; + +-module_platform_driver(qcom_slim_ngd_ctrl_driver); ++static int qcom_slim_ngd_init(void) ++{ ++ int ret; ++ ++ ret = platform_driver_register(&qcom_slim_ngd_driver); ++ if (ret) ++ return ret; ++ ++ ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver); ++ if (ret) ++ platform_driver_unregister(&qcom_slim_ngd_driver); ++ ++ return ret; ++} ++ ++static void qcom_slim_ngd_exit(void) ++{ ++ platform_driver_unregister(&qcom_slim_ngd_ctrl_driver); ++ platform_driver_unregister(&qcom_slim_ngd_driver); ++} ++ ++module_init(qcom_slim_ngd_init); ++module_exit(qcom_slim_ngd_exit); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller"); +-- +2.53.0 + diff --git a/queue-6.1/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch b/queue-6.1/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch new file mode 100644 index 0000000000..85e65407cb --- /dev/null +++ b/queue-6.1/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch @@ -0,0 +1,137 @@ +From 9327041a6f78da5d43e55fe9819c4adbea3b569c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:18 +0100 +Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd + +From: Bjorn Andersson + +[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ] + +When the remoteproc starts in parallel with the NGD driver being probed, +or the remoteproc is already up when the PDR lookup is being registered, +or in the theoretical event that we get an interrupt from the hardware, +these callbacks will operate on uninitialized data. This result in +issues to boot the affected boards. + +One such example can be seen in the following fault, where +qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. + +[ 21.858578] ------------[ cut here ]------------ +[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 +... +[ 21.859251] Call trace: +[ 21.859255] __queue_work+0x5e0/0x790 (P) +[ 21.859265] queue_work_on+0x6c/0xf0 +[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] +[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] +[ 21.859318] notifier_call_chain+0xa4/0x230 +[ 21.859329] srcu_notifier_call_chain+0x64/0xb8 +[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] +[ 21.859355] rproc_start+0x130/0x230 +[ 21.859367] rproc_boot+0x3d4/0x518 +... + +Move the enablement of interrupts, and the registration of SSR and PDR +until after the NGD device has been registered. + +This could be further refined by moving initialization to the control +driver probe and by removing the platform driver model from the picture. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++-------------- + 1 file changed, 26 insertions(+), 19 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index bf2007dc3cd043..76cd7d187dd2e2 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1537,6 +1537,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct qcom_slim_ngd_ctrl *ctrl; ++ int irq; + int ret; + struct pdr_service *pds; + +@@ -1550,20 +1551,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->base)) + return PTR_ERR(ctrl->base); + +- ret = platform_get_irq(pdev, 0); +- if (ret < 0) +- return ret; ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + +- ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt, +- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl); ++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt, ++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, ++ "slim-ngd", ctrl); + if (ret) + return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n"); + +- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; +- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); +- if (IS_ERR(ctrl->notifier)) +- return PTR_ERR(ctrl->notifier); +- + ctrl->dev = dev; + ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3; + ctrl->framer.superfreq = +@@ -1585,24 +1582,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + init_completion(&ctrl->qmi_up); + + ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl); +- if (IS_ERR(ctrl->pdr)) { +- ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr), +- "Failed to init PDR handle\n"); +- goto err_unregister_ssr; +- } ++ if (IS_ERR(ctrl->pdr)) ++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n"); ++ ++ ret = of_qcom_slim_ngd_register(dev, ctrl); ++ if (ret) ++ goto err_pdr_release; + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { + ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n"); +- goto err_pdr_release; ++ goto err_unregister_ngd; ++ } ++ ++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; ++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); ++ if (IS_ERR(ctrl->notifier)) { ++ ret = PTR_ERR(ctrl->notifier); ++ goto err_unregister_ngd; + } + +- return of_qcom_slim_ngd_register(dev, ctrl); ++ enable_irq(irq); + ++ return 0; ++ ++err_unregister_ngd: ++ qcom_slim_ngd_unregister(ctrl); + err_pdr_release: + pdr_handle_release(ctrl->pdr); +-err_unregister_ssr: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-6.18/rust-str-clean-unused-import-for-rust-1.98.patch-22556 b/queue-6.18/rust-str-clean-unused-import-for-rust-1.98.patch-22556 new file mode 100644 index 0000000000..a43d966ded --- /dev/null +++ b/queue-6.18/rust-str-clean-unused-import-for-rust-1.98.patch-22556 @@ -0,0 +1,53 @@ +From ff9be1416910b55d40528aa8f97292842741a137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:41:52 +0200 +Subject: rust: str: clean unused import for Rust >= 1.98 + +From: Miguel Ojeda + +[ Upstream commit 3fff4271809b57182c4011811e96556bdd4cb2f9 ] + +Starting with Rust 1.98.0 (expected 2026-08-20), the compiler has changed +how the resolution algorithm works [1] in upstream commit c4d84db5f184 +("Resolver: Batched import resolution."), and it now spots: + + error: unused import: `flags::*` + --> rust/kernel/str.rs:7:9 + | + 7 | flags::*, + | ^^^^^^^^ + | + = note: `-D unused-imports` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(unused_imports)]` + +It happens to not be needed because the `prelude::*` already provides +the flags. + +Thus clean it up. + +Cc: stable@vger.kernel.org # Needed in 6.18.y and later (prelude added to `str`). +Link: https://github.com/rust-lang/rust/pull/145108 [1] +Reviewed-by: Gary Guo +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260609104152.261145-2-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + rust/kernel/str.rs | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs +index 3a276bc32962d9..22cefbc9852360 100644 +--- a/rust/kernel/str.rs ++++ b/rust/kernel/str.rs +@@ -4,7 +4,6 @@ + + use crate::{ + alloc::{ +- flags::*, + AllocError, + KVec, // + }, +-- +2.53.0 + diff --git a/queue-6.18/rust-str-use-the-kernel-vertical-imports-style.patch-6121 b/queue-6.18/rust-str-use-the-kernel-vertical-imports-style.patch-6121 new file mode 100644 index 0000000000..7bae237728 --- /dev/null +++ b/queue-6.18/rust-str-use-the-kernel-vertical-imports-style.patch-6121 @@ -0,0 +1,65 @@ +From bdd11ea01c3f5e9daf7289fed6d2c4a2e9c20792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:41:51 +0200 +Subject: rust: str: use the "kernel vertical" imports style + +From: Miguel Ojeda + +[ Upstream commit 724a93a9f6033800b02a3530dbcb464638448e7f ] + +Convert the imports to use the "kernel vertical" imports style [1]. + +No functional changes intended. + +Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1] +Reviewed-by: Gary Guo +Link: https://patch.msgid.link/20260609104152.261145-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Stable-dep-of: 3fff4271809b ("rust: str: clean unused import for Rust >= 1.98") +Signed-off-by: Sasha Levin +--- + rust/kernel/str.rs | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs +index 8992fedabaf0f7..3a276bc32962d9 100644 +--- a/rust/kernel/str.rs ++++ b/rust/kernel/str.rs +@@ -3,14 +3,29 @@ + //! String representations. + + use crate::{ +- alloc::{flags::*, AllocError, KVec}, +- error::{to_result, Result}, +- fmt::{self, Write}, +- prelude::*, ++ alloc::{ ++ flags::*, ++ AllocError, ++ KVec, // ++ }, ++ error::{ ++ to_result, ++ Result, // ++ }, ++ fmt::{ ++ self, ++ Write, // ++ }, ++ prelude::*, // + }; + use core::{ + marker::PhantomData, +- ops::{self, Deref, DerefMut, Index}, ++ ops::{ ++ self, ++ Deref, ++ DerefMut, ++ Index, // ++ }, // + }; + + /// Byte string without UTF-8 validity guarantee. +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index bafe9a3f46..81b70e05f4 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -5,3 +5,5 @@ nfsd-release-layout-stid-on-setlease-failure.patch rust-str-use-the-kernel-vertical-imports-style.patch rust-str-clean-unused-import-for-rust-1.98.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch +rust-str-use-the-kernel-vertical-imports-style.patch-6121 +rust-str-clean-unused-import-for-rust-1.98.patch-22556 diff --git a/queue-6.6/series b/queue-6.6/series index 613b91e273..ba3cb9e4e3 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -14,3 +14,7 @@ bluetooth-btmtk-fix-wait_on_bit_timeout-interruption.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch bluetooth-btmtk-fix-btmtk.c-undefined-reference-buil.patch +slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch +slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch +slimbus-convert-to-platform-remove-callback-returnin.patch +slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch diff --git a/queue-6.6/slimbus-convert-to-platform-remove-callback-returnin.patch b/queue-6.6/slimbus-convert-to-platform-remove-callback-returnin.patch new file mode 100644 index 0000000000..4db5d59b31 --- /dev/null +++ b/queue-6.6/slimbus-convert-to-platform-remove-callback-returnin.patch @@ -0,0 +1,121 @@ +From aa8cc20ff8e5a004f96f86f75b98bd7f954e2088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 10:16:56 +0100 +Subject: slimbus: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is ignored (apart +from emitting a warning) and this typically results in resource leaks. + +To improve here there is a quest to make the remove callback return +void. In the first step of this quest all drivers are converted to +.remove_new(), which already returns void. Eventually after all drivers +are converted, .remove_new() will be renamed to .remove(). + +Trivially convert the slimbus drivers from always returning zero in the +remove callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd") +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ctrl.c | 5 ++--- + drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++------- + 2 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c +index 400b7b385a443e..7d632fad13005f 100644 +--- a/drivers/slimbus/qcom-ctrl.c ++++ b/drivers/slimbus/qcom-ctrl.c +@@ -626,7 +626,7 @@ static int qcom_slim_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_remove(struct platform_device *pdev) ++static void qcom_slim_remove(struct platform_device *pdev) + { + struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -635,7 +635,6 @@ static int qcom_slim_remove(struct platform_device *pdev) + clk_disable_unprepare(ctrl->rclk); + clk_disable_unprepare(ctrl->hclk); + destroy_workqueue(ctrl->rxwq); +- return 0; + } + + /* +@@ -721,7 +720,7 @@ static const struct of_device_id qcom_slim_dt_match[] = { + + static struct platform_driver qcom_slim_driver = { + .probe = qcom_slim_probe, +- .remove = qcom_slim_remove, ++ .remove_new = qcom_slim_remove, + .driver = { + .name = "qcom_slim_ctrl", + .of_match_table = qcom_slim_dt_match, +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 12643aaf164268..43bb5107259b71 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1682,7 +1682,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + return ret; + } + +-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1690,11 +1690,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + qcom_slim_ngd_unregister(ctrl); +- +- return 0; + } + +-static int qcom_slim_ngd_remove(struct platform_device *pdev) ++static void qcom_slim_ngd_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + +@@ -1708,7 +1706,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + + kfree(ctrl->ngd); + ctrl->ngd = NULL; +- return 0; + } + + static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev) +@@ -1751,7 +1748,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = { + + static struct platform_driver qcom_slim_ngd_ctrl_driver = { + .probe = qcom_slim_ngd_ctrl_probe, +- .remove = qcom_slim_ngd_ctrl_remove, ++ .remove_new = qcom_slim_ngd_ctrl_remove, + .driver = { + .name = "qcom,slim-ngd-ctrl", + .of_match_table = qcom_slim_ngd_dt_match, +@@ -1760,7 +1757,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = { + + static struct platform_driver qcom_slim_ngd_driver = { + .probe = qcom_slim_ngd_probe, +- .remove = qcom_slim_ngd_remove, ++ .remove_new = qcom_slim_ngd_remove, + .driver = { + .name = QCOM_SLIM_NGD_DRV_NAME, + .pm = &qcom_slim_ngd_dev_pm_ops, +-- +2.53.0 + diff --git a/queue-6.6/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch b/queue-6.6/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch new file mode 100644 index 0000000000..c162debfe0 --- /dev/null +++ b/queue-6.6/slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch @@ -0,0 +1,54 @@ +From fbc8c875f3aedbd96c41a9551f5cdff7467ebe9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:17 +0100 +Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership + +From: Bjorn Andersson + +[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ] + +PDR and SSR callbacks are registred from the controller probe function, +but currently released from the child device's remove function. + +The remove() function should only be unwinding what was done in the +same device's probe() function. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 6a3c1cf06b81a3..12643aaf164268 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1686,6 +1686,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev) + { + struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev); + ++ pdr_handle_release(ctrl->pdr); ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); ++ + qcom_slim_ngd_unregister(ctrl); + + return 0; +@@ -1697,8 +1700,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev) + + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- pdr_handle_release(ctrl->pdr); +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + qcom_slim_ngd_enable(ctrl, false); + qcom_slim_ngd_exit_dma(ctrl); + qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi); +-- +2.53.0 + diff --git a/queue-6.6/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch b/queue-6.6/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch new file mode 100644 index 0000000000..c9cb30e892 --- /dev/null +++ b/queue-6.6/slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch @@ -0,0 +1,61 @@ +From 711b6b823264967fe77c7ba4d6c28022f567e16c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:16 +0100 +Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering + +From: Bjorn Andersson + +[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ] + +qcom_slim_ngd_ctrl_probe() first registers the SSR callback then +allocates the PDR context, as such the error path needs to come in +opposite order to allow us to unroll each step. + +Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index de1834d52cb831..6a3c1cf06b81a3 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1663,22 +1663,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->pdr)) { + ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr), + "Failed to init PDR handle\n"); +- goto err_pdr_alloc; ++ goto err_unregister_ssr; + } + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { + ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n"); +- goto err_pdr_lookup; ++ goto err_pdr_release; + } + + return of_qcom_slim_ngd_register(dev, ctrl); + +-err_pdr_alloc: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); +- +-err_pdr_lookup: ++err_pdr_release: + pdr_handle_release(ctrl->pdr); ++err_unregister_ssr: ++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-6.6/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch b/queue-6.6/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch new file mode 100644 index 0000000000..8231fa0d47 --- /dev/null +++ b/queue-6.6/slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch @@ -0,0 +1,137 @@ +From 88e04dd569fc8ef16781f1bdee5cebf81b46fd88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2026 21:44:18 +0100 +Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd + +From: Bjorn Andersson + +[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ] + +When the remoteproc starts in parallel with the NGD driver being probed, +or the remoteproc is already up when the PDR lookup is being registered, +or in the theoretical event that we get an interrupt from the hardware, +these callbacks will operate on uninitialized data. This result in +issues to boot the affected boards. + +One such example can be seen in the following fault, where +qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. + +[ 21.858578] ------------[ cut here ]------------ +[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 +... +[ 21.859251] Call trace: +[ 21.859255] __queue_work+0x5e0/0x790 (P) +[ 21.859265] queue_work_on+0x6c/0xf0 +[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] +[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] +[ 21.859318] notifier_call_chain+0xa4/0x230 +[ 21.859329] srcu_notifier_call_chain+0x64/0xb8 +[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] +[ 21.859355] rproc_start+0x130/0x230 +[ 21.859367] rproc_boot+0x3d4/0x518 +... + +Move the enablement of interrupts, and the registration of SSR and PDR +until after the NGD device has been registered. + +This could be further refined by moving initialization to the control +driver probe and by removing the platform driver model from the picture. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Cc: stable@vger.kernel.org +Reviewed-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++-------------- + 1 file changed, 26 insertions(+), 19 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 43bb5107259b71..3a09f244ee8b5a 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1612,6 +1612,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct qcom_slim_ngd_ctrl *ctrl; ++ int irq; + int ret; + struct pdr_service *pds; + +@@ -1625,20 +1626,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + if (IS_ERR(ctrl->base)) + return PTR_ERR(ctrl->base); + +- ret = platform_get_irq(pdev, 0); +- if (ret < 0) +- return ret; ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + +- ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt, +- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl); ++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt, ++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, ++ "slim-ngd", ctrl); + if (ret) + return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n"); + +- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; +- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); +- if (IS_ERR(ctrl->notifier)) +- return PTR_ERR(ctrl->notifier); +- + ctrl->dev = dev; + ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3; + ctrl->framer.superfreq = +@@ -1660,24 +1657,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev) + init_completion(&ctrl->qmi_up); + + ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl); +- if (IS_ERR(ctrl->pdr)) { +- ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr), +- "Failed to init PDR handle\n"); +- goto err_unregister_ssr; +- } ++ if (IS_ERR(ctrl->pdr)) ++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n"); ++ ++ ret = of_qcom_slim_ngd_register(dev, ctrl); ++ if (ret) ++ goto err_pdr_release; + + pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd"); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { + ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n"); +- goto err_pdr_release; ++ goto err_unregister_ngd; ++ } ++ ++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify; ++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb); ++ if (IS_ERR(ctrl->notifier)) { ++ ret = PTR_ERR(ctrl->notifier); ++ goto err_unregister_ngd; + } + +- return of_qcom_slim_ngd_register(dev, ctrl); ++ enable_irq(irq); + ++ return 0; ++ ++err_unregister_ngd: ++ qcom_slim_ngd_unregister(ctrl); + err_pdr_release: + pdr_handle_release(ctrl->pdr); +-err_unregister_ssr: +- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb); + + return ret; + } +-- +2.53.0 + diff --git a/queue-7.1/rust-str-clean-unused-import-for-rust-1.98.patch-12096 b/queue-7.1/rust-str-clean-unused-import-for-rust-1.98.patch-12096 new file mode 100644 index 0000000000..409050d47e --- /dev/null +++ b/queue-7.1/rust-str-clean-unused-import-for-rust-1.98.patch-12096 @@ -0,0 +1,53 @@ +From 474b39b3ad8b17909795e92c5a7e78574ffe11ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:41:52 +0200 +Subject: rust: str: clean unused import for Rust >= 1.98 + +From: Miguel Ojeda + +[ Upstream commit 3fff4271809b57182c4011811e96556bdd4cb2f9 ] + +Starting with Rust 1.98.0 (expected 2026-08-20), the compiler has changed +how the resolution algorithm works [1] in upstream commit c4d84db5f184 +("Resolver: Batched import resolution."), and it now spots: + + error: unused import: `flags::*` + --> rust/kernel/str.rs:7:9 + | + 7 | flags::*, + | ^^^^^^^^ + | + = note: `-D unused-imports` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(unused_imports)]` + +It happens to not be needed because the `prelude::*` already provides +the flags. + +Thus clean it up. + +Cc: stable@vger.kernel.org # Needed in 6.18.y and later (prelude added to `str`). +Link: https://github.com/rust-lang/rust/pull/145108 [1] +Reviewed-by: Gary Guo +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260609104152.261145-2-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + rust/kernel/str.rs | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs +index a7fccd4c4f3b18..4517c1bc547afb 100644 +--- a/rust/kernel/str.rs ++++ b/rust/kernel/str.rs +@@ -4,7 +4,6 @@ + + use crate::{ + alloc::{ +- flags::*, + AllocError, + KVec, // + }, +-- +2.53.0 + diff --git a/queue-7.1/rust-str-use-the-kernel-vertical-imports-style.patch-28199 b/queue-7.1/rust-str-use-the-kernel-vertical-imports-style.patch-28199 new file mode 100644 index 0000000000..2897945445 --- /dev/null +++ b/queue-7.1/rust-str-use-the-kernel-vertical-imports-style.patch-28199 @@ -0,0 +1,64 @@ +From 529f6ae7ec8428057c7220dfa69ebccd02b46fab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:41:51 +0200 +Subject: rust: str: use the "kernel vertical" imports style + +From: Miguel Ojeda + +[ Upstream commit 724a93a9f6033800b02a3530dbcb464638448e7f ] + +Convert the imports to use the "kernel vertical" imports style [1]. + +No functional changes intended. + +Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1] +Reviewed-by: Gary Guo +Link: https://patch.msgid.link/20260609104152.261145-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Stable-dep-of: 3fff4271809b ("rust: str: clean unused import for Rust >= 1.98") +Signed-off-by: Sasha Levin +--- + rust/kernel/str.rs | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs +index 8311d91549e15e..a7fccd4c4f3b18 100644 +--- a/rust/kernel/str.rs ++++ b/rust/kernel/str.rs +@@ -3,14 +3,28 @@ + //! String representations. + + use crate::{ +- alloc::{flags::*, AllocError, KVec}, +- error::{to_result, Result}, +- fmt::{self, Write}, +- prelude::*, ++ alloc::{ ++ flags::*, ++ AllocError, ++ KVec, // ++ }, ++ error::{ ++ to_result, ++ Result, // ++ }, ++ fmt::{ ++ self, ++ Write, // ++ }, ++ prelude::*, // + }; + use core::{ + marker::PhantomData, +- ops::{Deref, DerefMut, Index}, ++ ops::{ ++ Deref, ++ DerefMut, ++ Index, // ++ }, // + }; + + pub use crate::prelude::CStr; +-- +2.53.0 + diff --git a/queue-7.1/series b/queue-7.1/series index 2b10839b9c..a5bba63087 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1,3 +1,5 @@ rust-str-use-the-kernel-vertical-imports-style.patch rust-str-clean-unused-import-for-rust-1.98.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch +rust-str-use-the-kernel-vertical-imports-style.patch-28199 +rust-str-clean-unused-import-for-rust-1.98.patch-12096