--- /dev/null
+From 779bac9994452f6a894524f70c00cfb0cd4b6364 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Mon, 12 Aug 2024 15:08:04 +0200
+Subject: Revert "ACPI: EC: Evaluate orphan _REG under EC device"
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 779bac9994452f6a894524f70c00cfb0cd4b6364 upstream.
+
+This reverts commit 0e6b6dedf168 ("Revert "ACPI: EC: Evaluate orphan
+_REG under EC device") because the problem addressed by it will be
+addressed differently in what follows.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Cc: All applicable <stable@vger.kernel.org>
+Link: https://patch.msgid.link/3236716.5fSG56mABF@rjwysocki.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpica/acevents.h | 4 ---
+ drivers/acpi/acpica/evregion.c | 6 +++-
+ drivers/acpi/acpica/evxfregn.c | 54 -----------------------------------------
+ drivers/acpi/ec.c | 3 --
+ include/acpi/acpixf.h | 4 ---
+ 5 files changed, 5 insertions(+), 66 deletions(-)
+
+--- a/drivers/acpi/acpica/acevents.h
++++ b/drivers/acpi/acpica/acevents.h
+@@ -191,10 +191,6 @@ void
+ acpi_ev_execute_reg_methods(struct acpi_namespace_node *node,
+ acpi_adr_space_type space_id, u32 function);
+
+-void
+-acpi_ev_execute_orphan_reg_method(struct acpi_namespace_node *node,
+- acpi_adr_space_type space_id);
+-
+ acpi_status
+ acpi_ev_execute_reg_method(union acpi_operand_object *region_obj, u32 function);
+
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -20,6 +20,10 @@ extern u8 acpi_gbl_default_address_space
+
+ /* Local prototypes */
+
++static void
++acpi_ev_execute_orphan_reg_method(struct acpi_namespace_node *device_node,
++ acpi_adr_space_type space_id);
++
+ static acpi_status
+ acpi_ev_reg_run(acpi_handle obj_handle,
+ u32 level, void *context, void **return_value);
+@@ -814,7 +818,7 @@ acpi_ev_reg_run(acpi_handle obj_handle,
+ *
+ ******************************************************************************/
+
+-void
++static void
+ acpi_ev_execute_orphan_reg_method(struct acpi_namespace_node *device_node,
+ acpi_adr_space_type space_id)
+ {
+--- a/drivers/acpi/acpica/evxfregn.c
++++ b/drivers/acpi/acpica/evxfregn.c
+@@ -306,57 +306,3 @@ acpi_execute_reg_methods(acpi_handle dev
+ }
+
+ ACPI_EXPORT_SYMBOL(acpi_execute_reg_methods)
+-
+-/*******************************************************************************
+- *
+- * FUNCTION: acpi_execute_orphan_reg_method
+- *
+- * PARAMETERS: device - Handle for the device
+- * space_id - The address space ID
+- *
+- * RETURN: Status
+- *
+- * DESCRIPTION: Execute an "orphan" _REG method that appears under an ACPI
+- * device. This is a _REG method that has no corresponding region
+- * within the device's scope.
+- *
+- ******************************************************************************/
+-acpi_status
+-acpi_execute_orphan_reg_method(acpi_handle device, acpi_adr_space_type space_id)
+-{
+- struct acpi_namespace_node *node;
+- acpi_status status;
+-
+- ACPI_FUNCTION_TRACE(acpi_execute_orphan_reg_method);
+-
+- /* Parameter validation */
+-
+- if (!device) {
+- return_ACPI_STATUS(AE_BAD_PARAMETER);
+- }
+-
+- status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+- if (ACPI_FAILURE(status)) {
+- return_ACPI_STATUS(status);
+- }
+-
+- /* Convert and validate the device handle */
+-
+- node = acpi_ns_validate_handle(device);
+- if (node) {
+-
+- /*
+- * If an "orphan" _REG method is present in the device's scope
+- * for the given address space ID, run it.
+- */
+-
+- acpi_ev_execute_orphan_reg_method(node, space_id);
+- } else {
+- status = AE_BAD_PARAMETER;
+- }
+-
+- (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+- return_ACPI_STATUS(status);
+-}
+-
+-ACPI_EXPORT_SYMBOL(acpi_execute_orphan_reg_method)
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1507,9 +1507,6 @@ static int ec_install_handlers(struct ac
+
+ if (call_reg && !test_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags)) {
+ acpi_execute_reg_methods(scope_handle, ACPI_ADR_SPACE_EC);
+- if (scope_handle != ec->handle)
+- acpi_execute_orphan_reg_method(ec->handle, ACPI_ADR_SPACE_EC);
+-
+ set_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags);
+ }
+
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -663,10 +663,6 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_adr_space_type
+ space_id))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+- acpi_execute_orphan_reg_method(acpi_handle device,
+- acpi_adr_space_type
+- space_id))
+-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_remove_address_space_handler(acpi_handle
+ device,
+ acpi_adr_space_type
--- /dev/null
+From 9bb5e74b2bf88fbb024bb15ded3b011e02c673be Mon Sep 17 00:00:00 2001
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+Date: Thu, 15 Aug 2024 11:49:20 +0200
+Subject: Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
+
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+
+commit 9bb5e74b2bf88fbb024bb15ded3b011e02c673be upstream.
+
+This reverts commit bab2f5e8fd5d2f759db26b78d9db57412888f187.
+
+Joel reported that this commit breaks userspace and stops sensors in
+SDM845 from working. Also breaks other qcom SoC devices running postmarketOS.
+
+Cc: stable <stable@kernel.org>
+Cc: Ekansh Gupta <quic_ekangupt@quicinc.com>
+Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reported-by: Joel Selvaraj <joelselvaraj.oss@gmail.com>
+Link: https://lore.kernel.org/r/9a9f5646-a554-4b65-8122-d212bb665c81@umsystem.edu
+Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: bab2f5e8fd5d ("misc: fastrpc: Restrict untrusted app to attach to privileged PD")
+Link: https://lore.kernel.org/r/20240815094920.8242-1-griffin@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/fastrpc.c | 22 +++-------------------
+ include/uapi/misc/fastrpc.h | 3 ---
+ 2 files changed, 3 insertions(+), 22 deletions(-)
+
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -2087,16 +2087,6 @@ err_invoke:
+ return err;
+ }
+
+-static int is_attach_rejected(struct fastrpc_user *fl)
+-{
+- /* Check if the device node is non-secure */
+- if (!fl->is_secure_dev) {
+- dev_dbg(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");
+- return -EACCES;
+- }
+- return 0;
+-}
+-
+ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+ {
+@@ -2109,19 +2099,13 @@ static long fastrpc_device_ioctl(struct
+ err = fastrpc_invoke(fl, argp);
+ break;
+ case FASTRPC_IOCTL_INIT_ATTACH:
+- err = is_attach_rejected(fl);
+- if (!err)
+- err = fastrpc_init_attach(fl, ROOT_PD);
++ err = fastrpc_init_attach(fl, ROOT_PD);
+ break;
+ case FASTRPC_IOCTL_INIT_ATTACH_SNS:
+- err = is_attach_rejected(fl);
+- if (!err)
+- err = fastrpc_init_attach(fl, SENSORS_PD);
++ err = fastrpc_init_attach(fl, SENSORS_PD);
+ break;
+ case FASTRPC_IOCTL_INIT_CREATE_STATIC:
+- err = is_attach_rejected(fl);
+- if (!err)
+- err = fastrpc_init_create_static_process(fl, argp);
++ err = fastrpc_init_create_static_process(fl, argp);
+ break;
+ case FASTRPC_IOCTL_INIT_CREATE:
+ err = fastrpc_init_create_process(fl, argp);
+--- a/include/uapi/misc/fastrpc.h
++++ b/include/uapi/misc/fastrpc.h
+@@ -8,14 +8,11 @@
+ #define FASTRPC_IOCTL_ALLOC_DMA_BUFF _IOWR('R', 1, struct fastrpc_alloc_dma_buf)
+ #define FASTRPC_IOCTL_FREE_DMA_BUFF _IOWR('R', 2, __u32)
+ #define FASTRPC_IOCTL_INVOKE _IOWR('R', 3, struct fastrpc_invoke)
+-/* This ioctl is only supported with secure device nodes */
+ #define FASTRPC_IOCTL_INIT_ATTACH _IO('R', 4)
+ #define FASTRPC_IOCTL_INIT_CREATE _IOWR('R', 5, struct fastrpc_init_create)
+ #define FASTRPC_IOCTL_MMAP _IOWR('R', 6, struct fastrpc_req_mmap)
+ #define FASTRPC_IOCTL_MUNMAP _IOWR('R', 7, struct fastrpc_req_munmap)
+-/* This ioctl is only supported with secure device nodes */
+ #define FASTRPC_IOCTL_INIT_ATTACH_SNS _IO('R', 8)
+-/* This ioctl is only supported with secure device nodes */
+ #define FASTRPC_IOCTL_INIT_CREATE_STATIC _IOWR('R', 9, struct fastrpc_init_create_static)
+ #define FASTRPC_IOCTL_MEM_MAP _IOWR('R', 10, struct fastrpc_mem_map)
+ #define FASTRPC_IOCTL_MEM_UNMAP _IOWR('R', 11, struct fastrpc_mem_unmap)
--- /dev/null
+From 21ea1ce37fc267dc45fe27517bbde926211683df Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Fri, 9 Aug 2024 19:29:01 +0800
+Subject: Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit 21ea1ce37fc267dc45fe27517bbde926211683df upstream.
+
+This reverts commit bf20c69cf3cf9c6445c4925dd9a8a6ca1b78bfdf.
+
+During tcpm_init() stage, if the VBUS is still present after
+tcpm_reset_port(), then we assume that VBUS will off and goto safe0v
+after a specific discharge time. Following a TCPM_VBUS_EVENT event if
+VBUS reach to off state. TCPM_VBUS_EVENT event may be set during
+PORT_RESET handling stage. If pd_events reset to 0 after TCPM_VBUS_EVENT
+set, we will lost this VBUS event. Then the port state machine may stuck
+at one state.
+
+Before:
+
+[ 2.570172] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev1 NONE_AMS]
+[ 2.570179] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]
+[ 2.570182] pending state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED @ 920 ms [rev1 NONE_AMS]
+[ 3.490213] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [delayed 920 ms]
+[ 3.490220] Start toggling
+[ 3.546050] CC1: 0 -> 0, CC2: 0 -> 2 [state TOGGLING, polarity 0, connected]
+[ 3.546057] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS]
+
+After revert this patch, we can see VBUS off event and the port will goto
+expected state.
+
+[ 2.441992] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev1 NONE_AMS]
+[ 2.441999] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]
+[ 2.442002] pending state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED @ 920 ms [rev1 NONE_AMS]
+[ 2.442122] VBUS off
+[ 2.442125] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev1 NONE_AMS]
+[ 2.442127] VBUS VSAFE0V
+[ 2.442351] CC1: 0 -> 0, CC2: 0 -> 0 [state SNK_UNATTACHED, polarity 0, disconnected]
+[ 2.442357] Start toggling
+[ 2.491850] CC1: 0 -> 0, CC2: 0 -> 2 [state TOGGLING, polarity 0, connected]
+[ 2.491858] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS]
+[ 2.491863] pending state change SRC_ATTACH_WAIT -> SNK_TRY @ 200 ms [rev1 NONE_AMS]
+[ 2.691905] state change SRC_ATTACH_WAIT -> SNK_TRY [delayed 200 ms]
+
+Fixes: bf20c69cf3cf ("usb: typec: tcpm: clear pd_event queue in PORT_RESET")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20240809112901.535072-1-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4880,7 +4880,6 @@ static void run_state_machine(struct tcp
+ break;
+ case PORT_RESET:
+ tcpm_reset_port(port);
+- port->pd_events = 0;
+ if (port->self_powered)
+ tcpm_set_cc(port, TYPEC_CC_OPEN);
+ else
--- /dev/null
+From 05a3d6e9307250a5911d75308e4363466794ab21 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Thu, 8 Aug 2024 11:57:38 -0400
+Subject: selinux: revert our use of vma_is_initial_heap()
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 05a3d6e9307250a5911d75308e4363466794ab21 upstream.
+
+Unfortunately it appears that vma_is_initial_heap() is currently broken
+for applications that do not currently have any heap allocated, e.g.
+brk == start_brk. The breakage is such that it will cause SELinux to
+check for the process/execheap permission on memory regions that cross
+brk/start_brk even when there is no heap.
+
+The proper fix would be to correct vma_is_initial_heap(), but as there
+are multiple callers I am hesitant to unilaterally modify the helper
+out of concern that I would end up breaking some other subsystem. The
+mm developers have been made aware of the situation and hopefully they
+will have a fix at some point in the future, but we need a fix soon so
+we are simply going to revert our use of vma_is_initial_heap() in favor
+of our old logic/code which works as expected, even in the face of a
+zero size heap. We can return to using vma_is_initial_heap() at some
+point in the future when it is fixed.
+
+Cc: stable@vger.kernel.org
+Reported-by: Marc Reisner <reisner.marc@gmail.com>
+Closes: https://lore.kernel.org/all/ZrPmoLKJEf1wiFmM@marcreisner.com
+Fixes: 68df1baf158f ("selinux: use vma_is_initial_stack() and vma_is_initial_heap()")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3835,7 +3835,17 @@ static int selinux_file_mprotect(struct
+ if (default_noexec &&
+ (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
+ int rc = 0;
+- if (vma_is_initial_heap(vma)) {
++ /*
++ * We don't use the vma_is_initial_heap() helper as it has
++ * a history of problems and is currently broken on systems
++ * where there is no heap, e.g. brk == start_brk. Before
++ * replacing the conditional below with vma_is_initial_heap(),
++ * or something similar, please ensure that the logic is the
++ * same as what we have below or you have tested every possible
++ * corner case you can think to test.
++ */
++ if (vma->vm_start >= vma->vm_mm->start_brk &&
++ vma->vm_end <= vma->vm_mm->brk) {
+ rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
+ PROCESS__EXECHEAP, NULL);
+ } else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
--- /dev/null
+tty-serial-fsl_lpuart-mark-last-busy-before-uart_add_one_port.patch
+tty-atmel_serial-use-the-correct-rts-flag.patch
+revert-acpi-ec-evaluate-orphan-_reg-under-ec-device.patch
+revert-misc-fastrpc-restrict-untrusted-app-to-attach-to-privileged-pd.patch
+revert-usb-typec-tcpm-clear-pd_event-queue-in-port_reset.patch
+selinux-revert-our-use-of-vma_is_initial_heap.patch
--- /dev/null
+From c9f6613b16123989f2c3bd04b1d9b2365d6914e7 Mon Sep 17 00:00:00 2001
+From: Mathieu Othacehe <othacehe@gnu.org>
+Date: Thu, 8 Aug 2024 08:06:37 +0200
+Subject: tty: atmel_serial: use the correct RTS flag.
+
+From: Mathieu Othacehe <othacehe@gnu.org>
+
+commit c9f6613b16123989f2c3bd04b1d9b2365d6914e7 upstream.
+
+In RS485 mode, the RTS pin is driven high by hardware when the transmitter
+is operating. This behaviour cannot be changed. This means that the driver
+should claim that it supports SER_RS485_RTS_ON_SEND and not
+SER_RS485_RTS_AFTER_SEND.
+
+Otherwise, when configuring the port with the SER_RS485_RTS_ON_SEND, one
+get the following warning:
+
+kern.warning kernel: atmel_usart_serial atmel_usart_serial.2.auto:
+ttyS1 (1): invalid RTS setting, using RTS_AFTER_SEND instead
+
+which is contradictory with what's really happening.
+
+Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
+Cc: stable <stable@kernel.org>
+Tested-by: Alexander Dahl <ada@thorsis.com>
+Fixes: af47c491e3c7 ("serial: atmel: Fill in rs485_supported")
+Link: https://lore.kernel.org/r/20240808060637.19886-1-othacehe@gnu.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/atmel_serial.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2522,7 +2522,7 @@ static const struct uart_ops atmel_pops
+ };
+
+ static const struct serial_rs485 atmel_rs485_supported = {
+- .flags = SER_RS485_ENABLED | SER_RS485_RTS_AFTER_SEND | SER_RS485_RX_DURING_TX,
++ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RX_DURING_TX,
+ .delay_rts_before_send = 1,
+ .delay_rts_after_send = 1,
+ };
--- /dev/null
+From dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Thu, 8 Aug 2024 22:03:25 +0800
+Subject: tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c upstream.
+
+With "earlycon initcall_debug=1 loglevel=8" in bootargs, kernel
+sometimes boot hang. It is because normal console still is not ready,
+but runtime suspend is called, so early console putchar will hang
+in waiting TRDE set in UARTSTAT.
+
+The lpuart driver has auto suspend delay set to 3000ms, but during
+uart_add_one_port, a child device serial ctrl will added and probed with
+its pm runtime enabled(see serial_ctrl.c).
+The runtime suspend call path is:
+device_add
+ |-> bus_probe_device
+ |->device_initial_probe
+ |->__device_attach
+ |-> pm_runtime_get_sync(dev->parent);
+ |-> pm_request_idle(dev);
+ |-> pm_runtime_put(dev->parent);
+
+So in the end, before normal console ready, the lpuart get runtime
+suspended. And earlycon putchar will hang.
+
+To address the issue, mark last busy just after pm_runtime_enable,
+three seconds is long enough to switch from bootconsole to normal
+console.
+
+Fixes: 43543e6f539b ("tty: serial: fsl_lpuart: Add runtime pm support")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20240808140325.580105-1-peng.fan@oss.nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2930,6 +2930,7 @@ static int lpuart_probe(struct platform_
+ pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT);
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
++ pm_runtime_mark_last_busy(&pdev->dev);
+
+ ret = lpuart_global_reset(sport);
+ if (ret)
projects / thirdparty / kernel / stable-queue.git / commitdiff
