From ab8660b425ae05e8cdef0747c3c96497d0d8ae97 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 19 Feb 2024 07:56:35 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...-fix-block-process-call-transactions.patch | 56 ++++++++++++ ...01-remove-i801_set_block_buffer_mode.patch | 71 ++++++++++++++++ ...dia-ir_toy-fix-a-memleak-in-irtoy_tx.patch | 44 ++++++++++ ...ding-spaces-when-processing-source-f.patch | 42 +++++++++ ...-high-bat-enable-flag-on-g2_le-cores.patch | 85 +++++++++++++++++++ ...x-addr-error-caused-by-page-alignmen.patch | 63 ++++++++++++++ queue-5.10/series | 6 ++ 7 files changed, 367 insertions(+) create mode 100644 queue-5.10/i2c-i801-fix-block-process-call-transactions.patch create mode 100644 queue-5.10/i2c-i801-remove-i801_set_block_buffer_mode.patch create mode 100644 queue-5.10/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch create mode 100644 queue-5.10/modpost-trim-leading-spaces-when-processing-source-f.patch create mode 100644 queue-5.10/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch create mode 100644 queue-5.10/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch diff --git a/queue-5.10/i2c-i801-fix-block-process-call-transactions.patch b/queue-5.10/i2c-i801-fix-block-process-call-transactions.patch new file mode 100644 index 00000000000..c9bcb6dbafd --- /dev/null +++ b/queue-5.10/i2c-i801-fix-block-process-call-transactions.patch @@ -0,0 +1,56 @@ +From 994955e150e02c5f87bedabfb0ad5355b73fe9e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 15:59:39 +0100 +Subject: i2c: i801: Fix block process call transactions + +From: Jean Delvare + +[ Upstream commit c1c9d0f6f7f1dbf29db996bd8e166242843a5f21 ] + +According to the Intel datasheets, software must reset the block +buffer index twice for block process call transactions: once before +writing the outgoing data to the buffer, and once again before +reading the incoming data from the buffer. + +The driver is currently missing the second reset, causing the wrong +portion of the block buffer to be read. + +Signed-off-by: Jean Delvare +Reported-by: Piotr Zakowski +Closes: https://lore.kernel.org/linux-i2c/20240213120553.7b0ab120@endymion.delvare/ +Fixes: 315cd67c9453 ("i2c: i801: Add Block Write-Block Read Process Call support") +Reviewed-by: Alexander Sverdlin +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-i801.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 15520d491140..d6b945f5b887 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -543,11 +543,10 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, + /* Set block buffer mode */ + outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv)); + +- inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ +- + if (read_write == I2C_SMBUS_WRITE) { + len = data->block[0]; + outb_p(len, SMBHSTDAT0(priv)); ++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ + for (i = 0; i < len; i++) + outb_p(data->block[i+1], SMBBLKDAT(priv)); + } +@@ -563,6 +562,7 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, + return -EPROTO; + + data->block[0] = len; ++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ + for (i = 0; i < len; i++) + data->block[i + 1] = inb_p(SMBBLKDAT(priv)); + } +-- +2.43.0 + diff --git a/queue-5.10/i2c-i801-remove-i801_set_block_buffer_mode.patch b/queue-5.10/i2c-i801-remove-i801_set_block_buffer_mode.patch new file mode 100644 index 00000000000..a70b4d07c05 --- /dev/null +++ b/queue-5.10/i2c-i801-remove-i801_set_block_buffer_mode.patch @@ -0,0 +1,71 @@ +From f1ac08d17da81ae746af8bf56aee09e2e6b7b2ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 23:58:17 +0100 +Subject: i2c: i801: Remove i801_set_block_buffer_mode + +From: Heiner Kallweit + +[ Upstream commit 1e1d6582f483a4dba4ea03445e6f2f05d9de5bcf ] + +If FEATURE_BLOCK_BUFFER is set then bit SMBAUXCTL_E32B is supported +and there's no benefit in reading it back. Origin of this check +seems to be 14 yrs ago when people were not completely sure which +chip versions support the block buffer mode. + +Signed-off-by: Heiner Kallweit +Reviewed-by: Jean Delvare +Tested-by: Jean Delvare +Signed-off-by: Wolfram Sang +Stable-dep-of: c1c9d0f6f7f1 ("i2c: i801: Fix block process call transactions") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-i801.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index cb8f56022592..15520d491140 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -540,9 +540,11 @@ static int i801_block_transaction_by_block(struct i801_priv *priv, + return -EOPNOTSUPP; + } + ++ /* Set block buffer mode */ ++ outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv)); ++ + inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */ + +- /* Use 32-byte buffer to process this transaction */ + if (read_write == I2C_SMBUS_WRITE) { + len = data->block[0]; + outb_p(len, SMBHSTDAT0(priv)); +@@ -780,14 +782,6 @@ static int i801_block_transaction_byte_by_byte(struct i801_priv *priv, + return i801_check_post(priv, status); + } + +-static int i801_set_block_buffer_mode(struct i801_priv *priv) +-{ +- outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv)); +- if ((inb_p(SMBAUXCTL(priv)) & SMBAUXCTL_E32B) == 0) +- return -EIO; +- return 0; +-} +- + /* Block transaction function */ + static int i801_block_transaction(struct i801_priv *priv, + union i2c_smbus_data *data, char read_write, +@@ -817,9 +811,8 @@ static int i801_block_transaction(struct i801_priv *priv, + /* Experience has shown that the block buffer can only be used for + SMBus (not I2C) block transactions, even though the datasheet + doesn't mention this limitation. */ +- if ((priv->features & FEATURE_BLOCK_BUFFER) +- && command != I2C_SMBUS_I2C_BLOCK_DATA +- && i801_set_block_buffer_mode(priv) == 0) ++ if ((priv->features & FEATURE_BLOCK_BUFFER) && ++ command != I2C_SMBUS_I2C_BLOCK_DATA) + result = i801_block_transaction_by_block(priv, data, + read_write, + command, hwpec); +-- +2.43.0 + diff --git a/queue-5.10/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch b/queue-5.10/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch new file mode 100644 index 00000000000..e043473c3b6 --- /dev/null +++ b/queue-5.10/media-ir_toy-fix-a-memleak-in-irtoy_tx.patch @@ -0,0 +1,44 @@ +From 6fb72f220cc9b5d81db2c236af6375e18fca3d3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 09:14:19 +0100 +Subject: media: ir_toy: fix a memleak in irtoy_tx + +From: Zhipeng Lu + +[ Upstream commit dc9ceb90c4b42c6e5c6757df1d6257110433788e ] + +When irtoy_command fails, buf should be freed since it is allocated by +irtoy_tx, or there is a memleak. + +Fixes: 4114978dcd24 ("media: ir_toy: prevent device from hanging during transmit") +Signed-off-by: Zhipeng Lu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ir_toy.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c +index 7f394277478b..cd2fddf003bd 100644 +--- a/drivers/media/rc/ir_toy.c ++++ b/drivers/media/rc/ir_toy.c +@@ -324,6 +324,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) + sizeof(COMMAND_SMODE_EXIT), STATE_RESET); + if (err) { + dev_err(irtoy->dev, "exit sample mode: %d\n", err); ++ kfree(buf); + return err; + } + +@@ -331,6 +332,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) + sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND); + if (err) { + dev_err(irtoy->dev, "enter sample mode: %d\n", err); ++ kfree(buf); + return err; + } + +-- +2.43.0 + diff --git a/queue-5.10/modpost-trim-leading-spaces-when-processing-source-f.patch b/queue-5.10/modpost-trim-leading-spaces-when-processing-source-f.patch new file mode 100644 index 00000000000..8dfcddfbd8a --- /dev/null +++ b/queue-5.10/modpost-trim-leading-spaces-when-processing-source-f.patch @@ -0,0 +1,42 @@ +From 7498fe3d98368b1974e4d110bcc13219f4d9354e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:14:07 +0100 +Subject: modpost: trim leading spaces when processing source files list + +From: Radek Krejci + +[ Upstream commit 5d9a16b2a4d9e8fa028892ded43f6501bc2969e5 ] + +get_line() does not trim the leading spaces, but the +parse_source_files() expects to get lines with source files paths where +the first space occurs after the file path. + +Fixes: 70f30cfe5b89 ("modpost: use read_text_file() and get_line() for reading text files") +Signed-off-by: Radek Krejci +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/sumversion.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c +index d587f40f1117..b6eda411be15 100644 +--- a/scripts/mod/sumversion.c ++++ b/scripts/mod/sumversion.c +@@ -328,7 +328,12 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md) + + /* Sum all files in the same dir or subdirs. */ + while ((line = get_line(&pos))) { +- char* p = line; ++ char* p; ++ ++ /* trim the leading spaces away */ ++ while (isspace(*line)) ++ line++; ++ p = line; + + if (strncmp(line, "source_", sizeof("source_")-1) == 0) { + p = strrchr(line, ' '); +-- +2.43.0 + diff --git a/queue-5.10/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch b/queue-5.10/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch new file mode 100644 index 00000000000..9ff15c66058 --- /dev/null +++ b/queue-5.10/powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch @@ -0,0 +1,85 @@ +From e786cd77f90d16843c3c0634de6f13624af55d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 11:38:38 +0100 +Subject: powerpc/6xx: set High BAT Enable flag on G2_LE cores + +From: Matthias Schiffer + +[ Upstream commit a038a3ff8c6582404834852c043dadc73a5b68b4 ] + +MMU_FTR_USE_HIGH_BATS is set for G2_LE cores and derivatives like e300cX, +but the high BATs need to be enabled in HID2 to work. Add register +definitions and add the needed setup to __setup_cpu_603. + +This fixes boot on CPUs like the MPC5200B with STRICT_KERNEL_RWX enabled +on systems where the flag has not been set by the bootloader already. + +Fixes: e4d6654ebe6e ("powerpc/mm/32s: rework mmu_mapin_ram()") +Signed-off-by: Matthias Schiffer +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240124103838.43675-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg.h | 2 ++ + arch/powerpc/kernel/cpu_setup_6xx.S | 20 +++++++++++++++++++- + 2 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 6afb14b6bbc2..01006de8a900 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -612,6 +612,8 @@ + #endif + #define SPRN_HID2 0x3F8 /* Hardware Implementation Register 2 */ + #define SPRN_HID2_GEKKO 0x398 /* Gekko HID2 Register */ ++#define SPRN_HID2_G2_LE 0x3F3 /* G2_LE HID2 Register */ ++#define HID2_G2_LE_HBE (1<<18) /* High BAT Enable (G2_LE) */ + #define SPRN_IABR 0x3F2 /* Instruction Address Breakpoint Register */ + #define SPRN_IABR2 0x3FA /* 83xx */ + #define SPRN_IBCR 0x135 /* 83xx Insn Breakpoint Control Reg */ +diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S +index f8b5ff64b604..6cbad50c71f6 100644 +--- a/arch/powerpc/kernel/cpu_setup_6xx.S ++++ b/arch/powerpc/kernel/cpu_setup_6xx.S +@@ -24,6 +24,15 @@ BEGIN_FTR_SECTION + bl __init_fpu_registers + END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE) + bl setup_common_caches ++ ++ /* ++ * This assumes that all cores using __setup_cpu_603 with ++ * MMU_FTR_USE_HIGH_BATS are G2_LE compatible ++ */ ++BEGIN_MMU_FTR_SECTION ++ bl setup_g2_le_hid2 ++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) ++ + mtlr r5 + blr + _GLOBAL(__setup_cpu_604) +@@ -111,6 +120,16 @@ setup_604_hid0: + isync + blr + ++/* Enable high BATs for G2_LE and derivatives like e300cX */ ++SYM_FUNC_START_LOCAL(setup_g2_le_hid2) ++ mfspr r11,SPRN_HID2_G2_LE ++ oris r11,r11,HID2_G2_LE_HBE@h ++ mtspr SPRN_HID2_G2_LE,r11 ++ sync ++ isync ++ blr ++SYM_FUNC_END(setup_g2_le_hid2) ++ + /* 7400 <= rev 2.7 and 7410 rev = 1.0 suffer from some + * erratas we work around here. + * Moto MPC710CE.pdf describes them, those are errata +@@ -485,4 +504,3 @@ _GLOBAL(__restore_cpu_setup) + mtcr r7 + blr + _ASM_NOKPROBE_SYMBOL(__restore_cpu_setup) +- +-- +2.43.0 + diff --git a/queue-5.10/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch b/queue-5.10/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch new file mode 100644 index 00000000000..6ae6a824002 --- /dev/null +++ b/queue-5.10/powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch @@ -0,0 +1,63 @@ +From bfa0e959d714e2ec4d857b83fd21c960b047e47f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 09:45:59 +0800 +Subject: powerpc/kasan: Fix addr error caused by page alignment + +From: Jiangfeng Xiao + +[ Upstream commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 ] + +In kasan_init_region, when k_start is not page aligned, at the begin of +for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then +`va = block + k_cur - k_start` is less than block, the addr va is invalid, +because the memory address space from va to block is not alloced by +memblock_alloc, which will not be reserved by memblock_reserve later, it +will be used by other places. + +As a result, memory overwriting occurs. + +for example: +int __init __weak kasan_init_region(void *start, size_t size) +{ +[...] + /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ + block = memblock_alloc(k_end - k_start, PAGE_SIZE); + [...] + for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { + /* at the begin of for loop + * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) + * va(dcd96c00) is less than block(dcd97000), va is invalid + */ + void *va = block + k_cur - k_start; + [...] + } +[...] +} + +Therefore, page alignment is performed on k_start before +memblock_alloc() to ensure the validity of the VA address. + +Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") +Signed-off-by: Jiangfeng Xiao +Signed-off-by: Michael Ellerman +Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/kasan/kasan_init_32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c +index f3e4d069e0ba..643fc525897d 100644 +--- a/arch/powerpc/mm/kasan/kasan_init_32.c ++++ b/arch/powerpc/mm/kasan/kasan_init_32.c +@@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) + if (ret) + return ret; + ++ k_start = k_start & PAGE_MASK; + block = memblock_alloc(k_end - k_start, PAGE_SIZE); + if (!block) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 28f4f71aae0..5f13a16810a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -304,3 +304,9 @@ hid-wacom-do-not-register-input-devices-until-after-hid_hw_start.patch usb-ucsi_acpi-fix-command-completion-handling.patch usb-hub-check-for-alternate-port-before-enabling-a_alt_hnp_support.patch usb-f_mass_storage-forbid-async-queue-when-shutdown-happen.patch +media-ir_toy-fix-a-memleak-in-irtoy_tx.patch +powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch +powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch +i2c-i801-remove-i801_set_block_buffer_mode.patch +i2c-i801-fix-block-process-call-transactions.patch +modpost-trim-leading-spaces-when-processing-source-f.patch -- 2.47.3