From: Greg Kroah-Hartman Date: Mon, 7 Oct 2024 09:33:39 +0000 (+0200) Subject: 6.10-stable patches X-Git-Tag: v6.6.55~114 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=10cecbf9226c80d41695ba4140da58af13c90c83;p=thirdparty%2Fkernel%2Fstable-queue.git 6.10-stable patches added patches: dt-bindings-clock-exynos7885-fix-duplicated-binding.patch firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch i2c-core-lock-address-during-client-device-instantiation.patch i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch i2c-synquacer-deal-with-optional-pclk-correctly.patch i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch memory-tegra186-emc-drop-unused-to_tegra186_emc.patch ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch rust-sync-require-t-sync-for-lockedby-access.patch spi-bcm63xx-fix-missing-pm_runtime_disable.patch spi-bcm63xx-fix-module-autoloading.patch --- diff --git a/queue-6.10/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch b/queue-6.10/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch new file mode 100644 index 00000000000..7ccc2ee029b --- /dev/null +++ b/queue-6.10/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch @@ -0,0 +1,46 @@ +From abf3a3ea9acb5c886c8729191a670744ecd42024 Mon Sep 17 00:00:00 2001 +From: David Virag +Date: Tue, 6 Aug 2024 14:11:44 +0200 +Subject: dt-bindings: clock: exynos7885: Fix duplicated binding + +From: David Virag + +commit abf3a3ea9acb5c886c8729191a670744ecd42024 upstream. + +The numbering in Exynos7885's FSYS CMU bindings has 4 duplicated by +accident, with the rest of the bindings continuing with 5. + +Fix this by moving CLK_MOUT_FSYS_USB30DRD_USER to the end as 11. + +Since CLK_MOUT_FSYS_USB30DRD_USER is not used in any device tree as of +now, and there are no other clocks affected (maybe apart from +CLK_MOUT_FSYS_MMC_SDIO_USER which the number was shared with, also not +used in a device tree), this is the least impactful way to solve this +problem. + +Fixes: cd268e309c29 ("dt-bindings: clock: Add bindings for Exynos7885 CMU_FSYS") +Cc: stable@vger.kernel.org +Signed-off-by: David Virag +Link: https://lore.kernel.org/r/20240806121157.479212-2-virag.david003@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + include/dt-bindings/clock/exynos7885.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/dt-bindings/clock/exynos7885.h ++++ b/include/dt-bindings/clock/exynos7885.h +@@ -136,12 +136,12 @@ + #define CLK_MOUT_FSYS_MMC_CARD_USER 2 + #define CLK_MOUT_FSYS_MMC_EMBD_USER 3 + #define CLK_MOUT_FSYS_MMC_SDIO_USER 4 +-#define CLK_MOUT_FSYS_USB30DRD_USER 4 + #define CLK_GOUT_MMC_CARD_ACLK 5 + #define CLK_GOUT_MMC_CARD_SDCLKIN 6 + #define CLK_GOUT_MMC_EMBD_ACLK 7 + #define CLK_GOUT_MMC_EMBD_SDCLKIN 8 + #define CLK_GOUT_MMC_SDIO_ACLK 9 + #define CLK_GOUT_MMC_SDIO_SDCLKIN 10 ++#define CLK_MOUT_FSYS_USB30DRD_USER 11 + + #endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */ diff --git a/queue-6.10/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch b/queue-6.10/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch new file mode 100644 index 00000000000..459065e69c1 --- /dev/null +++ b/queue-6.10/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch @@ -0,0 +1,37 @@ +From 9c3a62c20f7fb00294a4237e287254456ba8a48b Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 16 Aug 2024 15:57:21 +0200 +Subject: firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() + +From: Krzysztof Kozlowski + +commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream. + +mbox_client_to_bpmp() is not used, W=1 builds: + + drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function] + +Fixes: cdfa358b248e ("firmware: tegra: Refactor BPMP driver") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/tegra/bpmp.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/firmware/tegra/bpmp.c ++++ b/drivers/firmware/tegra/bpmp.c +@@ -24,12 +24,6 @@ + #define MSG_RING BIT(1) + #define TAG_SZ 32 + +-static inline struct tegra_bpmp * +-mbox_client_to_bpmp(struct mbox_client *client) +-{ +- return container_of(client, struct tegra_bpmp, mbox.client); +-} +- + static inline const struct tegra_bpmp_ops * + channel_to_ops(struct tegra_bpmp_channel *channel) + { diff --git a/queue-6.10/i2c-core-lock-address-during-client-device-instantiation.patch b/queue-6.10/i2c-core-lock-address-during-client-device-instantiation.patch new file mode 100644 index 00000000000..362face1d39 --- /dev/null +++ b/queue-6.10/i2c-core-lock-address-during-client-device-instantiation.patch @@ -0,0 +1,111 @@ +From 8d3cefaf659265aa82b0373a563fdb9d16a2b947 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Thu, 15 Aug 2024 21:44:50 +0200 +Subject: i2c: core: Lock address during client device instantiation + +From: Heiner Kallweit + +commit 8d3cefaf659265aa82b0373a563fdb9d16a2b947 upstream. + +Krzysztof reported an issue [0] which is caused by parallel attempts to +instantiate the same I2C client device. This can happen if driver +supports auto-detection, but certain devices are also instantiated +explicitly. +The original change isn't actually wrong, it just revealed that I2C core +isn't prepared yet to handle this scenario. +Calls to i2c_new_client_device() can be nested, therefore we can't use a +simple mutex here. Parallel instantiation of devices at different addresses +is ok, so we just have to prevent parallel instantiation at the same address. +We can use a bitmap with one bit per 7-bit I2C client address, and atomic +bit operations to set/check/clear bits. +Now a parallel attempt to instantiate a device at the same address will +result in -EBUSY being returned, avoiding the "sysfs: cannot create duplicate +filename" splash. + +Note: This patch version includes small cosmetic changes to the Tested-by + version, only functional change is that address locking is supported + for slave addresses too. + +[0] https://lore.kernel.org/linux-i2c/9479fe4e-eb0c-407e-84c0-bd60c15baf74@ans.pl/T/#m12706546e8e2414d8f1a0dc61c53393f731685cc + +Fixes: caba40ec3531 ("eeprom: at24: Probe for DDR3 thermal sensor in the SPD case") +Cc: stable@vger.kernel.org +Tested-by: Krzysztof Piotr Oledzki +Signed-off-by: Heiner Kallweit +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-core-base.c | 28 ++++++++++++++++++++++++++++ + include/linux/i2c.h | 3 +++ + 2 files changed, 31 insertions(+) + +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -915,6 +915,27 @@ int i2c_dev_irq_from_resources(const str + return 0; + } + ++/* ++ * Serialize device instantiation in case it can be instantiated explicitly ++ * and by auto-detection ++ */ ++static int i2c_lock_addr(struct i2c_adapter *adap, unsigned short addr, ++ unsigned short flags) ++{ ++ if (!(flags & I2C_CLIENT_TEN) && ++ test_and_set_bit(addr, adap->addrs_in_instantiation)) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr, ++ unsigned short flags) ++{ ++ if (!(flags & I2C_CLIENT_TEN)) ++ clear_bit(addr, adap->addrs_in_instantiation); ++} ++ + /** + * i2c_new_client_device - instantiate an i2c device + * @adap: the adapter managing the device +@@ -962,6 +983,10 @@ i2c_new_client_device(struct i2c_adapter + goto out_err_silent; + } + ++ status = i2c_lock_addr(adap, client->addr, client->flags); ++ if (status) ++ goto out_err_silent; ++ + /* Check for address business */ + status = i2c_check_addr_busy(adap, i2c_encode_flags_to_addr(client)); + if (status) +@@ -993,6 +1018,8 @@ i2c_new_client_device(struct i2c_adapter + dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n", + client->name, dev_name(&client->dev)); + ++ i2c_unlock_addr(adap, client->addr, client->flags); ++ + return client; + + out_remove_swnode: +@@ -1004,6 +1031,7 @@ out_err: + dev_err(&adap->dev, + "Failed to register i2c client %s at 0x%02x (%d)\n", + client->name, client->addr, status); ++ i2c_unlock_addr(adap, client->addr, client->flags); + out_err_silent: + if (need_put) + put_device(&client->dev); +--- a/include/linux/i2c.h ++++ b/include/linux/i2c.h +@@ -748,6 +748,9 @@ struct i2c_adapter { + struct regulator *bus_regulator; + + struct dentry *debugfs; ++ ++ /* 7bit address space */ ++ DECLARE_BITMAP(addrs_in_instantiation, 1 << 7); + }; + #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev) + diff --git a/queue-6.10/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch b/queue-6.10/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch new file mode 100644 index 00000000000..da66611d93b --- /dev/null +++ b/queue-6.10/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch @@ -0,0 +1,133 @@ +From 5d69d5a00f80488ddcb4dee7d1374a0709398178 Mon Sep 17 00:00:00 2001 +From: Kimriver Liu +Date: Fri, 13 Sep 2024 11:31:46 +0800 +Subject: i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled + +From: Kimriver Liu + +commit 5d69d5a00f80488ddcb4dee7d1374a0709398178 upstream. + +It was observed that issuing the ABORT bit (IC_ENABLE[1]) will not +work when IC_ENABLE is already disabled. + +Check if the ENABLE bit (IC_ENABLE[0]) is disabled when the controller +is holding SCL low. If the ENABLE bit is disabled, the software needs +to enable it before trying to issue the ABORT bit. otherwise, +the controller ignores any write to ABORT bit. + +These kernel logs show up whenever an I2C transaction is +attempted after this failure. +i2c_designware e95e0000.i2c: timeout waiting for bus ready +i2c_designware e95e0000.i2c: timeout in disabling adapter + +The patch fixes the issue where the controller cannot be disabled +while SCL is held low if the ENABLE bit is already disabled. + +Fixes: 2409205acd3c ("i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low") +Signed-off-by: Kimriver Liu +Cc: # v6.6+ +Reviewed-by: Mika Westerberg +Acked-by: Jarkko Nikula +Reviewed-by: Andy Shevchenko +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-designware-common.c | 14 ++++++++++ + drivers/i2c/busses/i2c-designware-core.h | 1 + drivers/i2c/busses/i2c-designware-master.c | 38 +++++++++++++++++++++++++++++ + 3 files changed, 53 insertions(+) + +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -441,6 +441,7 @@ err_release_lock: + + void __i2c_dw_disable(struct dw_i2c_dev *dev) + { ++ struct i2c_timings *t = &dev->timings; + unsigned int raw_intr_stats; + unsigned int enable; + int timeout = 100; +@@ -453,6 +454,19 @@ void __i2c_dw_disable(struct dw_i2c_dev + + abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD; + if (abort_needed) { ++ if (!(enable & DW_IC_ENABLE_ENABLE)) { ++ regmap_write(dev->map, DW_IC_ENABLE, DW_IC_ENABLE_ENABLE); ++ /* ++ * Wait 10 times the signaling period of the highest I2C ++ * transfer supported by the driver (for 400KHz this is ++ * 25us) to ensure the I2C ENABLE bit is already set ++ * as described in the DesignWare I2C databook. ++ */ ++ fsleep(DIV_ROUND_CLOSEST_ULL(10 * MICRO, t->bus_freq_hz)); ++ /* Set ENABLE bit before setting ABORT */ ++ enable |= DW_IC_ENABLE_ENABLE; ++ } ++ + regmap_write(dev->map, DW_IC_ENABLE, enable | DW_IC_ENABLE_ABORT); + ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable, + !(enable & DW_IC_ENABLE_ABORT), 10, +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -109,6 +109,7 @@ + DW_IC_INTR_RX_UNDER | \ + DW_IC_INTR_RD_REQ) + ++#define DW_IC_ENABLE_ENABLE BIT(0) + #define DW_IC_ENABLE_ABORT BIT(1) + + #define DW_IC_STATUS_ACTIVITY BIT(0) +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -253,6 +253,34 @@ static void i2c_dw_xfer_init(struct dw_i + __i2c_dw_write_intr_mask(dev, DW_IC_INTR_MASTER_MASK); + } + ++/* ++ * This function waits for the controller to be idle before disabling I2C ++ * When the controller is not in the IDLE state, the MST_ACTIVITY bit ++ * (IC_STATUS[5]) is set. ++ * ++ * Values: ++ * 0x1 (ACTIVE): Controller not idle ++ * 0x0 (IDLE): Controller is idle ++ * ++ * The function is called after completing the current transfer. ++ * ++ * Returns: ++ * False when the controller is in the IDLE state. ++ * True when the controller is in the ACTIVE state. ++ */ ++static bool i2c_dw_is_controller_active(struct dw_i2c_dev *dev) ++{ ++ u32 status; ++ ++ regmap_read(dev->map, DW_IC_STATUS, &status); ++ if (!(status & DW_IC_STATUS_MASTER_ACTIVITY)) ++ return false; ++ ++ return regmap_read_poll_timeout(dev->map, DW_IC_STATUS, status, ++ !(status & DW_IC_STATUS_MASTER_ACTIVITY), ++ 1100, 20000) != 0; ++} ++ + static int i2c_dw_check_stopbit(struct dw_i2c_dev *dev) + { + u32 val; +@@ -789,6 +817,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, st + } + + /* ++ * This happens rarely (~1:500) and is hard to reproduce. Debug trace ++ * showed that IC_STATUS had value of 0x23 when STOP_DET occurred, ++ * if disable IC_ENABLE.ENABLE immediately that can result in ++ * IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if ++ * controller is still ACTIVE before disabling I2C. ++ */ ++ if (i2c_dw_is_controller_active(dev)) ++ dev_err(dev->dev, "controller active\n"); ++ ++ /* + * We must disable the adapter before returning and signaling the end + * of the current transfer. Otherwise the hardware might continue + * generating interrupts which in turn causes a race condition with diff --git a/queue-6.10/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.10/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..5153c28dd24 --- /dev/null +++ b/queue-6.10/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,43 @@ +From e2c85d85a05f16af2223fcc0195ff50a7938b372 Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Thu, 12 Sep 2024 11:34:59 +0800 +Subject: i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream. + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") +Signed-off-by: Jinjie Ruan +Cc: # v4.19+ +Acked-by: Mukesh Kumar Savaliya +Reviewed-by: Vladimir Zapolskiy +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qcom-geni.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -818,15 +818,13 @@ static int geni_i2c_probe(struct platfor + init_completion(&gi2c->done); + spin_lock_init(&gi2c->lock); + platform_set_drvdata(pdev, gi2c); +- ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0, ++ ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN, + dev_name(dev), gi2c); + if (ret) { + dev_err(dev, "Request_irq failed:%d: err:%d\n", + gi2c->irq, ret); + return ret; + } +- /* Disable the interrupt so that the system can enter low-power mode */ +- disable_irq(gi2c->irq); + i2c_set_adapdata(&gi2c->adap, gi2c); + gi2c->adap.dev.parent = dev; + gi2c->adap.dev.of_node = dev->of_node; diff --git a/queue-6.10/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch b/queue-6.10/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch new file mode 100644 index 00000000000..eb1463f5337 --- /dev/null +++ b/queue-6.10/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch @@ -0,0 +1,58 @@ +From 048bbbdbf85e5e00258dfb12f5e368f908801d7b Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Mon, 30 Sep 2024 21:27:41 +0200 +Subject: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume + +From: Marek Vasut + +commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream. + +In case there is any sort of clock controller attached to this I2C bus +controller, for example Versaclock or even an AIC32x4 I2C codec, then +an I2C transfer triggered from the clock controller clk_ops .prepare +callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex. + +This is because the clock controller first grabs the prepare_lock mutex +and then performs the prepare operation, including its I2C access. The +I2C access resumes this I2C bus controller via .runtime_resume callback, +which calls clk_prepare_enable(), which attempts to grab the prepare_lock +mutex again and deadlocks. + +Since the clock are already prepared since probe() and unprepared in +remove(), use simple clk_enable()/clk_disable() calls to enable and +disable the clock on runtime suspend and resume, to avoid hitting the +prepare_lock mutex. + +Acked-by: Alain Volmat +Signed-off-by: Marek Vasut +Fixes: 4e7bca6fc07b ("i2c: i2c-stm32f7: add PM Runtime support") +Cc: # v5.0+ +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32f7.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -2395,7 +2395,7 @@ static int __maybe_unused stm32f7_i2c_ru + struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev); + + if (!stm32f7_i2c_is_slave_registered(i2c_dev)) +- clk_disable_unprepare(i2c_dev->clk); ++ clk_disable(i2c_dev->clk); + + return 0; + } +@@ -2406,9 +2406,9 @@ static int __maybe_unused stm32f7_i2c_ru + int ret; + + if (!stm32f7_i2c_is_slave_registered(i2c_dev)) { +- ret = clk_prepare_enable(i2c_dev->clk); ++ ret = clk_enable(i2c_dev->clk); + if (ret) { +- dev_err(dev, "failed to prepare_enable clock\n"); ++ dev_err(dev, "failed to enable clock\n"); + return ret; + } + } diff --git a/queue-6.10/i2c-synquacer-deal-with-optional-pclk-correctly.patch b/queue-6.10/i2c-synquacer-deal-with-optional-pclk-correctly.patch new file mode 100644 index 00000000000..8f1ef28bea0 --- /dev/null +++ b/queue-6.10/i2c-synquacer-deal-with-optional-pclk-correctly.patch @@ -0,0 +1,42 @@ +From f2990f8630531a99cad4dc5c44cb2a11ded42492 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 12 Sep 2024 12:46:31 +0200 +Subject: i2c: synquacer: Deal with optional PCLK correctly + +From: Ard Biesheuvel + +commit f2990f8630531a99cad4dc5c44cb2a11ded42492 upstream. + +ACPI boot does not provide clocks and regulators, but instead, provides +the PCLK rate directly, and enables the clock in firmware. So deal +gracefully with this. + +Fixes: 55750148e559 ("i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()") +Cc: stable@vger.kernel.org # v6.10+ +Cc: Andi Shyti +Cc: Christophe JAILLET +Signed-off-by: Ard Biesheuvel +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-synquacer.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-synquacer.c ++++ b/drivers/i2c/busses/i2c-synquacer.c +@@ -550,12 +550,13 @@ static int synquacer_i2c_probe(struct pl + device_property_read_u32(&pdev->dev, "socionext,pclk-rate", + &i2c->pclkrate); + +- pclk = devm_clk_get_enabled(&pdev->dev, "pclk"); ++ pclk = devm_clk_get_optional_enabled(&pdev->dev, "pclk"); + if (IS_ERR(pclk)) + return dev_err_probe(&pdev->dev, PTR_ERR(pclk), + "failed to get and enable clock\n"); + +- i2c->pclkrate = clk_get_rate(pclk); ++ if (pclk) ++ i2c->pclkrate = clk_get_rate(pclk); + + if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE || + i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE) diff --git a/queue-6.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch b/queue-6.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch new file mode 100644 index 00000000000..f21b026e7a4 --- /dev/null +++ b/queue-6.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch @@ -0,0 +1,34 @@ +From 0c8d604dea437b69a861479b413d629bc9b3da70 Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Mon, 23 Sep 2024 11:42:50 +0800 +Subject: i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled + +From: Jinjie Ruan + +commit 0c8d604dea437b69a861479b413d629bc9b3da70 upstream. + +It is not valid to call pm_runtime_set_suspended() for devices +with runtime PM enabled because it returns -EAGAIN if it is enabled +already and working. So, call pm_runtime_disable() before to fix it. + +Fixes: 36ecbcab84d0 ("i2c: xiic: Implement power management") +Cc: # v4.6+ +Signed-off-by: Jinjie Ruan +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-xiic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -1337,8 +1337,8 @@ static int xiic_i2c_probe(struct platfor + return 0; + + err_pm_disable: +- pm_runtime_set_suspended(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ pm_runtime_set_suspended(&pdev->dev); + + return ret; + } diff --git a/queue-6.10/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch b/queue-6.10/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch new file mode 100644 index 00000000000..0fc6a701e52 --- /dev/null +++ b/queue-6.10/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch @@ -0,0 +1,75 @@ +From 521da1e9225450bd323db5fa5bca942b1dc485b7 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 21 Nov 2023 18:11:16 +0000 +Subject: i2c: xiic: Wait for TX empty to avoid missed TX NAKs + +From: Robert Hancock + +commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream. + +Frequently an I2C write will be followed by a read, such as a register +address write followed by a read of the register value. In this driver, +when the TX FIFO half empty interrupt was raised and it was determined +that there was enough space in the TX FIFO to send the following read +command, it would do so without waiting for the TX FIFO to actually +empty. + +Unfortunately it appears that in some cases this can result in a NAK +that was raised by the target device on the write, such as due to an +unsupported register address, being ignored and the subsequent read +being done anyway. This can potentially put the I2C bus into an +invalid state and/or result in invalid read data being processed. + +To avoid this, once a message has been fully written to the TX FIFO, +wait for the TX FIFO empty interrupt before moving on to the next +message, to ensure NAKs are handled properly. + +Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface") +Signed-off-by: Robert Hancock +Cc: # v2.6.34+ +Reviewed-by: Manikanta Guntupalli +Acked-by: Michal Simek +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-xiic.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -772,14 +772,17 @@ static irqreturn_t xiic_process(int irq, + goto out; + } + +- xiic_fill_tx_fifo(i2c); +- +- /* current message sent and there is space in the fifo */ +- if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) { ++ if (xiic_tx_space(i2c)) { ++ xiic_fill_tx_fifo(i2c); ++ } else { ++ /* current message fully written */ + dev_dbg(i2c->adap.dev.parent, + "%s end of message sent, nmsgs: %d\n", + __func__, i2c->nmsgs); +- if (i2c->nmsgs > 1) { ++ /* Don't move onto the next message until the TX FIFO empties, ++ * to ensure that a NAK is not missed. ++ */ ++ if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) { + i2c->nmsgs--; + i2c->tx_msg++; + xfer_more = 1; +@@ -790,11 +793,7 @@ static irqreturn_t xiic_process(int irq, + "%s Got TX IRQ but no more to do...\n", + __func__); + } +- } else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1)) +- /* current frame is sent and is last, +- * make sure to disable tx half +- */ +- xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK); ++ } + } + + if (pend & XIIC_INTR_BNB_MASK) { diff --git a/queue-6.10/kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch b/queue-6.10/kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch new file mode 100644 index 00000000000..515ea8090ee --- /dev/null +++ b/queue-6.10/kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch @@ -0,0 +1,92 @@ +From a1d402abf8e3ff1d821e88993fc5331784fac0da Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Wed, 2 Oct 2024 21:42:39 +0100 +Subject: KVM: arm64: Fix kvm_has_feat*() handling of negative features + +From: Marc Zyngier + +commit a1d402abf8e3ff1d821e88993fc5331784fac0da upstream. + +Oliver reports that the kvm_has_feat() helper is not behaviing as +expected for negative feature. On investigation, the main issue +seems to be caused by the following construct: + + #define get_idreg_field(kvm, id, fld) \ + (id##_##fld##_SIGNED ? \ + get_idreg_field_signed(kvm, id, fld) : \ + get_idreg_field_unsigned(kvm, id, fld)) + +where one side of the expression evaluates as something signed, +and the other as something unsigned. In retrospect, this is totally +braindead, as the compiler converts this into an unsigned expression. +When compared to something that is 0, the test is simply elided. + +Epic fail. Similar issue exists in the expand_field_sign() macro. + +The correct way to handle this is to chose between signed and unsigned +comparisons, so that both sides of the ternary expression are of the +same type (bool). + +In order to keep the code readable (sort of), we introduce new +comparison primitives taking an operator as a parameter, and +rewrite the kvm_has_feat*() helpers in terms of these primitives. + +Fixes: c62d7a23b947 ("KVM: arm64: Add feature checking helpers") +Reported-by: Oliver Upton +Tested-by: Oliver Upton +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20241002204239.2051637-1-maz@kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/kvm_host.h | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -1364,11 +1364,6 @@ bool kvm_arm_vcpu_stopped(struct kvm_vcp + sign_extend64(__val, id##_##fld##_WIDTH - 1); \ + }) + +-#define expand_field_sign(id, fld, val) \ +- (id##_##fld##_SIGNED ? \ +- __expand_field_sign_signed(id, fld, val) : \ +- __expand_field_sign_unsigned(id, fld, val)) +- + #define get_idreg_field_unsigned(kvm, id, fld) \ + ({ \ + u64 __val = IDREG((kvm), SYS_##id); \ +@@ -1384,20 +1379,26 @@ bool kvm_arm_vcpu_stopped(struct kvm_vcp + #define get_idreg_field_enum(kvm, id, fld) \ + get_idreg_field_unsigned(kvm, id, fld) + +-#define get_idreg_field(kvm, id, fld) \ ++#define kvm_cmp_feat_signed(kvm, id, fld, op, limit) \ ++ (get_idreg_field_signed((kvm), id, fld) op __expand_field_sign_signed(id, fld, limit)) ++ ++#define kvm_cmp_feat_unsigned(kvm, id, fld, op, limit) \ ++ (get_idreg_field_unsigned((kvm), id, fld) op __expand_field_sign_unsigned(id, fld, limit)) ++ ++#define kvm_cmp_feat(kvm, id, fld, op, limit) \ + (id##_##fld##_SIGNED ? \ +- get_idreg_field_signed(kvm, id, fld) : \ +- get_idreg_field_unsigned(kvm, id, fld)) ++ kvm_cmp_feat_signed(kvm, id, fld, op, limit) : \ ++ kvm_cmp_feat_unsigned(kvm, id, fld, op, limit)) + + #define kvm_has_feat(kvm, id, fld, limit) \ +- (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, limit)) ++ kvm_cmp_feat(kvm, id, fld, >=, limit) + + #define kvm_has_feat_enum(kvm, id, fld, val) \ +- (get_idreg_field_unsigned((kvm), id, fld) == __expand_field_sign_unsigned(id, fld, val)) ++ kvm_cmp_feat_unsigned(kvm, id, fld, ==, val) + + #define kvm_has_feat_range(kvm, id, fld, min, max) \ +- (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, min) && \ +- get_idreg_field((kvm), id, fld) <= expand_field_sign(id, fld, max)) ++ (kvm_cmp_feat(kvm, id, fld, >=, min) && \ ++ kvm_cmp_feat(kvm, id, fld, <=, max)) + + /* Check for a given level of PAuth support */ + #define kvm_has_pauth(k, l) \ diff --git a/queue-6.10/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch b/queue-6.10/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch new file mode 100644 index 00000000000..89541f461f9 --- /dev/null +++ b/queue-6.10/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch @@ -0,0 +1,74 @@ +From bee1aed819a8cda47927436685d216906ed17f62 Mon Sep 17 00:00:00 2001 +From: Alexander Shiyan +Date: Thu, 29 Aug 2024 08:48:49 +0300 +Subject: media: i2c: ar0521: Use cansleep version of gpiod_set_value() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Shiyan + +commit bee1aed819a8cda47927436685d216906ed17f62 upstream. + +If we use GPIO reset from I2C port expander, we must use *_cansleep() +variant of GPIO functions. +This was not done in ar0521_power_on()/ar0521_power_off() functions. +Let's fix that. + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c +Modules linked in: +CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 +Hardware name: Diasom DS-RK3568-SOM-EVB (DT) +Workqueue: events_unbound deferred_probe_work_func +pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : gpiod_set_value+0x74/0x7c +lr : ar0521_power_on+0xcc/0x290 +sp : ffffff8001d7ab70 +x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000 +x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088 +x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088 +x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80 +x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000 +x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930 +x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 +x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 +x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001 +Call trace: + gpiod_set_value+0x74/0x7c + ar0521_power_on+0xcc/0x290 +... + +Signed-off-by: Alexander Shiyan +Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver") +Cc: stable@vger.kernel.org +Acked-by: Krzysztof Hałasa +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ar0521.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ar0521.c ++++ b/drivers/media/i2c/ar0521.c +@@ -844,7 +844,8 @@ static int ar0521_power_off(struct devic + clk_disable_unprepare(sensor->extclk); + + if (sensor->reset_gpio) +- gpiod_set_value(sensor->reset_gpio, 1); /* assert RESET signal */ ++ /* assert RESET signal */ ++ gpiod_set_value_cansleep(sensor->reset_gpio, 1); + + for (i = ARRAY_SIZE(ar0521_supply_names) - 1; i >= 0; i--) { + if (sensor->supplies[i]) +@@ -878,7 +879,7 @@ static int ar0521_power_on(struct device + + if (sensor->reset_gpio) + /* deassert RESET signal */ +- gpiod_set_value(sensor->reset_gpio, 0); ++ gpiod_set_value_cansleep(sensor->reset_gpio, 0); + usleep_range(4500, 5000); /* min 45000 clocks */ + + for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) { diff --git a/queue-6.10/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch b/queue-6.10/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch new file mode 100644 index 00000000000..aa35c9c76ef --- /dev/null +++ b/queue-6.10/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch @@ -0,0 +1,36 @@ +From 67dd9e861add38755a7c5d29e25dd0f6cb4116ab Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 12 Aug 2024 14:30:55 +0200 +Subject: memory: tegra186-emc: drop unused to_tegra186_emc() + +From: Krzysztof Kozlowski + +commit 67dd9e861add38755a7c5d29e25dd0f6cb4116ab upstream. + +to_tegra186_emc() is not used, W=1 builds: + + tegra186-emc.c:38:36: error: unused function 'to_tegra186_emc' [-Werror,-Wunused-function] + +Fixes: 9a38cb27668e ("memory: tegra: Add interconnect support for DRAM scaling in Tegra234") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240812123055.124123-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/tegra/tegra186-emc.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/memory/tegra/tegra186-emc.c ++++ b/drivers/memory/tegra/tegra186-emc.c +@@ -35,11 +35,6 @@ struct tegra186_emc { + struct icc_provider provider; + }; + +-static inline struct tegra186_emc *to_tegra186_emc(struct icc_provider *provider) +-{ +- return container_of(provider, struct tegra186_emc, provider); +-} +- + /* + * debugfs interface + * diff --git a/queue-6.10/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch b/queue-6.10/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch new file mode 100644 index 00000000000..aa0b270ea38 --- /dev/null +++ b/queue-6.10/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch @@ -0,0 +1,91 @@ +From 6c4a5f96450415735c31ed70ff354f0ee5cbf67b Mon Sep 17 00:00:00 2001 +From: Mike Baynton +Date: Wed, 10 Jul 2024 22:52:04 -0500 +Subject: ovl: fail if trusted xattrs are needed but caller lacks permission + +From: Mike Baynton + +commit 6c4a5f96450415735c31ed70ff354f0ee5cbf67b upstream. + +Some overlayfs features require permission to read/write trusted.* +xattrs. These include redirect_dir, verity, metacopy, and data-only +layers. This patch adds additional validations at mount time to stop +overlays from mounting in certain cases where the resulting mount would +not function according to the user's expectations because they lack +permission to access trusted.* xattrs (for example, not global root.) + +Similar checks in ovl_make_workdir() that disable features instead of +failing are still relevant and used in cases where the resulting mount +can still work "reasonably well." Generally, if the feature was enabled +through kernel config or module option, any mount that worked before +will still work the same; this applies to redirect_dir and metacopy. The +user must explicitly request these features in order to generate a mount +failure. Verity and data-only layers on the other hand must be explictly +requested and have no "reasonable" disabled or degraded alternative, so +mounts attempting either always fail. + +"lower data-only dirs require metacopy support" moved down in case +userxattr is set, which disables metacopy. + +Cc: stable@vger.kernel.org # v6.6+ +Signed-off-by: Mike Baynton +Signed-off-by: Amir Goldstein +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/params.c | 38 +++++++++++++++++++++++++++++++++----- + 1 file changed, 33 insertions(+), 5 deletions(-) + +--- a/fs/overlayfs/params.c ++++ b/fs/overlayfs/params.c +@@ -782,11 +782,6 @@ int ovl_fs_params_verify(const struct ov + { + struct ovl_opt_set set = ctx->set; + +- if (ctx->nr_data > 0 && !config->metacopy) { +- pr_err("lower data-only dirs require metacopy support.\n"); +- return -EINVAL; +- } +- + /* Workdir/index are useless in non-upper mount */ + if (!config->upperdir) { + if (config->workdir) { +@@ -938,6 +933,39 @@ int ovl_fs_params_verify(const struct ov + config->metacopy = false; + } + ++ /* ++ * Fail if we don't have trusted xattr capability and a feature was ++ * explicitly requested that requires them. ++ */ ++ if (!config->userxattr && !capable(CAP_SYS_ADMIN)) { ++ if (set.redirect && ++ config->redirect_mode != OVL_REDIRECT_NOFOLLOW) { ++ pr_err("redirect_dir requires permission to access trusted xattrs\n"); ++ return -EPERM; ++ } ++ if (config->metacopy && set.metacopy) { ++ pr_err("metacopy requires permission to access trusted xattrs\n"); ++ return -EPERM; ++ } ++ if (config->verity_mode) { ++ pr_err("verity requires permission to access trusted xattrs\n"); ++ return -EPERM; ++ } ++ if (ctx->nr_data > 0) { ++ pr_err("lower data-only dirs require permission to access trusted xattrs\n"); ++ return -EPERM; ++ } ++ /* ++ * Other xattr-dependent features should be disabled without ++ * great disturbance to the user in ovl_make_workdir(). ++ */ ++ } ++ ++ if (ctx->nr_data > 0 && !config->metacopy) { ++ pr_err("lower data-only dirs require metacopy support.\n"); ++ return -EINVAL; ++ } ++ + return 0; + } + diff --git a/queue-6.10/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch b/queue-6.10/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch new file mode 100644 index 00000000000..bebdf87439a --- /dev/null +++ b/queue-6.10/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch @@ -0,0 +1,122 @@ +From 7d59ac07ccb58f8f604f8057db63b8efcebeb3de Mon Sep 17 00:00:00 2001 +From: Zach Wade +Date: Mon, 23 Sep 2024 22:45:08 +0800 +Subject: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug + +From: Zach Wade + +commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream. + +Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". +kasan report: +[ 19.411889] ================================================================== +[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 +[ 19.417368] +[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 +[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 +[ 19.422687] Call Trace: +[ 19.424091] +[ 19.425448] dump_stack_lvl+0x5d/0x80 +[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.428694] print_report+0x19d/0x52e +[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 +[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.433539] kasan_report+0xf0/0x170 +[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] +[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 +[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] +[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] +[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 +[ 19.444797] cpuhp_invoke_callback+0x221/0xec0 +[ 19.446337] cpuhp_thread_fun+0x21b/0x610 +[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 +[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 +[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 +[ 19.452405] kthread+0x29c/0x350 +[ 19.453817] ? __pfx_kthread+0x10/0x10 +[ 19.455253] ret_from_fork+0x31/0x70 +[ 19.456685] ? __pfx_kthread+0x10/0x10 +[ 19.458114] ret_from_fork_asm+0x1a/0x30 +[ 19.459573] +[ 19.460853] +[ 19.462055] Allocated by task 1198: +[ 19.463410] kasan_save_stack+0x30/0x50 +[ 19.464788] kasan_save_track+0x14/0x30 +[ 19.466139] __kasan_kmalloc+0xaa/0xb0 +[ 19.467465] __kmalloc+0x1cd/0x470 +[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] +[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] +[ 19.471670] do_one_initcall+0xa4/0x380 +[ 19.472903] do_init_module+0x238/0x760 +[ 19.474105] load_module+0x5239/0x6f00 +[ 19.475285] init_module_from_file+0xd1/0x130 +[ 19.476506] idempotent_init_module+0x23b/0x650 +[ 19.477725] __x64_sys_finit_module+0xbe/0x130 +[ 19.476506] idempotent_init_module+0x23b/0x650 +[ 19.477725] __x64_sys_finit_module+0xbe/0x130 +[ 19.478920] do_syscall_64+0x82/0x160 +[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 19.481292] +[ 19.482205] The buggy address belongs to the object at ffff888829e65000 + which belongs to the cache kmalloc-512 of size 512 +[ 19.484818] The buggy address is located 0 bytes to the right of + allocated 512-byte region [ffff888829e65000, ffff888829e65200) +[ 19.487447] +[ 19.488328] The buggy address belongs to the physical page: +[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 +[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) +[ 19.493914] page_type: 0xffffffff() +[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 +[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 +[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 +[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 +[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff +[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 +[ 19.503784] page dumped because: kasan: bad access detected +[ 19.505058] +[ 19.505970] Memory state around the buggy address: +[ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.510014] ^ +[ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.515367] ================================================================== + +The reason for this error is physical_package_ids assigned by VMware VMM +are not continuous and have gaps. This will cause value returned by +topology_physical_package_id() to be more than topology_max_packages(). + +Here the allocation uses topology_max_packages(). The call to +topology_max_packages() returns maximum logical package ID not physical +ID. Hence use topology_logical_package_id() instead of +topology_physical_package_id(). + +Fixes: 9a1aac8a96dc ("platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering") +Cc: stable@vger.kernel.org +Acked-by: Srinivas Pandruvada +Signed-off-by: Zach Wade +Link: https://lore.kernel.org/r/20240923144508.1764-1-zachwade.k@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c ++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c +@@ -316,7 +316,9 @@ static struct pci_dev *_isst_if_get_pci_ + cpu >= nr_cpu_ids || cpu >= num_possible_cpus()) + return NULL; + +- pkg_id = topology_physical_package_id(cpu); ++ pkg_id = topology_logical_package_id(cpu); ++ if (pkg_id >= topology_max_packages()) ++ return NULL; + + bus_number = isst_cpu_info[cpu].bus_info[bus_no]; + if (bus_number < 0) diff --git a/queue-6.10/platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch b/queue-6.10/platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch new file mode 100644 index 00000000000..f6575dc66ce --- /dev/null +++ b/queue-6.10/platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch @@ -0,0 +1,52 @@ +From 2fae3129c0c08e72b1fe93e61fd8fd203252094a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 5 Oct 2024 15:05:45 +0200 +Subject: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors + +From: Hans de Goede + +commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a upstream. + +x86_android_tablet_remove() frees the pdevs[] array, so it should not +be used after calling x86_android_tablet_remove(). + +When platform_device_register() fails, store the pdevs[x] PTR_ERR() value +into the local ret variable before calling x86_android_tablet_remove() +to avoid using pdevs[] after it has been freed. + +Fixes: 5eba0141206e ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs") +Fixes: e2200d3f26da ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()") +Cc: stable@vger.kernel.org +Reported-by: Aleksandr Burakov +Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/ +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/x86-android-tablets/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/x86-android-tablets/core.c ++++ b/drivers/platform/x86/x86-android-tablets/core.c +@@ -390,8 +390,9 @@ static __init int x86_android_tablet_pro + for (i = 0; i < pdev_count; i++) { + pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]); + if (IS_ERR(pdevs[i])) { ++ ret = PTR_ERR(pdevs[i]); + x86_android_tablet_remove(pdev); +- return PTR_ERR(pdevs[i]); ++ return ret; + } + } + +@@ -443,8 +444,9 @@ static __init int x86_android_tablet_pro + PLATFORM_DEVID_AUTO, + &pdata, sizeof(pdata)); + if (IS_ERR(pdevs[pdev_count])) { ++ ret = PTR_ERR(pdevs[pdev_count]); + x86_android_tablet_remove(pdev); +- return PTR_ERR(pdevs[pdev_count]); ++ return ret; + } + pdev_count++; + } diff --git a/queue-6.10/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch b/queue-6.10/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch new file mode 100644 index 00000000000..41cbc66ec7b --- /dev/null +++ b/queue-6.10/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch @@ -0,0 +1,41 @@ +From e50a57d16f897e45de1112eb6478577b197fab52 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 8 Sep 2024 20:53:37 +0200 +Subject: power: supply: hwmon: Fix missing temp1_max_alarm attribute + +From: Hans de Goede + +commit e50a57d16f897e45de1112eb6478577b197fab52 upstream. + +Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for +power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX +property. + +HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for +temp channel 0, causing the hwmon temp1_max_alarm attribute to be +missing from such power_supply devices. + +Add this to power_supply_hwmon_info to fix this. + +Fixes: f1d33ae806ec ("power: supply: remove duplicated argument in power_supply_hwmon_info") +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240908185337.103696-2-hdegoede@redhat.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/power_supply_hwmon.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/power_supply_hwmon.c ++++ b/drivers/power/supply/power_supply_hwmon.c +@@ -299,7 +299,8 @@ static const struct hwmon_channel_info * + HWMON_T_INPUT | + HWMON_T_MAX | + HWMON_T_MIN | +- HWMON_T_MIN_ALARM, ++ HWMON_T_MIN_ALARM | ++ HWMON_T_MAX_ALARM, + + HWMON_T_LABEL | + HWMON_T_INPUT | diff --git a/queue-6.10/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch b/queue-6.10/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch new file mode 100644 index 00000000000..9e4a6090240 --- /dev/null +++ b/queue-6.10/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch @@ -0,0 +1,74 @@ +From 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 2 Oct 2024 17:59:39 +0200 +Subject: Revert "ALSA: hda: Conditionally use snooping for AMD HDMI" + +From: Takashi Iwai + +commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream. + +This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4. + +The fix seems leading to regressions for other systems. +Also, the way to check the presence of IOMMU via get_dma_ops() isn't +reliable and it's no longer applicable for 6.12. After all, it's no +right fix, so let's revert it at first. + +To be noted, the PCM buffer allocation has been changed to try the +continuous pages at first since 6.12, so the problem could be already +addressed without this hackish workaround. + +Reported-by: Salvatore Bonaccorso +Closes: https://lore.kernel.org/ZvgCdYfKgwHpJXGE@eldamar.lan +Link: https://patch.msgid.link/20241002155948.4859-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_controller.h | 2 +- + sound/pci/hda/hda_intel.c | 10 +--------- + 2 files changed, 2 insertions(+), 10 deletions(-) + +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -28,7 +28,7 @@ + #else + #define AZX_DCAPS_I915_COMPONENT 0 /* NOP */ + #endif +-#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14) /* AMD allocation workaround */ ++/* 14 unused */ + #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */ + #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */ + #define AZX_DCAPS_AMD_WORKAROUND (1 << 17) /* AMD-specific workaround */ +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -40,7 +40,6 @@ + + #ifdef CONFIG_X86 + /* for snoop control */ +-#include + #include + #include + #endif +@@ -307,7 +306,7 @@ enum { + + /* quirks for ATI HDMI with snoop off */ + #define AZX_DCAPS_PRESET_ATI_HDMI_NS \ +- (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX) ++ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF) + + /* quirks for AMD SB */ + #define AZX_DCAPS_PRESET_AMD_SB \ +@@ -1703,13 +1702,6 @@ static void azx_check_snoop_available(st + if (chip->driver_caps & AZX_DCAPS_SNOOP_OFF) + snoop = false; + +-#ifdef CONFIG_X86 +- /* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */ +- if ((chip->driver_caps & AZX_DCAPS_AMD_ALLOC_FIX) && +- !get_dma_ops(chip->card->dev)) +- snoop = false; +-#endif +- + chip->snoop = snoop; + if (!snoop) { + dev_info(chip->card->dev, "Force to non-snoop mode\n"); diff --git a/queue-6.10/rust-sync-require-t-sync-for-lockedby-access.patch b/queue-6.10/rust-sync-require-t-sync-for-lockedby-access.patch new file mode 100644 index 00000000000..e1c709b7f2e --- /dev/null +++ b/queue-6.10/rust-sync-require-t-sync-for-lockedby-access.patch @@ -0,0 +1,73 @@ +From a8ee30f45d5d57467ddb7877ed6914d0eba0af7f Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Sun, 15 Sep 2024 14:41:28 +0000 +Subject: rust: sync: require `T: Sync` for `LockedBy::access` + +From: Alice Ryhl + +commit a8ee30f45d5d57467ddb7877ed6914d0eba0af7f upstream. + +The `LockedBy::access` method only requires a shared reference to the +owner, so if we have shared access to the `LockedBy` from several +threads at once, then two threads could call `access` in parallel and +both obtain a shared reference to the inner value. Thus, require that +`T: Sync` when calling the `access` method. + +An alternative is to require `T: Sync` in the `impl Sync for LockedBy`. +This patch does not choose that approach as it gives up the ability to +use `LockedBy` with `!Sync` types, which is okay as long as you only use +`access_mut`. + +Cc: stable@vger.kernel.org +Fixes: 7b1f55e3a984 ("rust: sync: introduce `LockedBy`") +Signed-off-by: Alice Ryhl +Suggested-by: Boqun Feng +Reviewed-by: Gary Guo +Link: https://lore.kernel.org/r/20240915-locked-by-sync-fix-v2-1-1a8d89710392@google.com +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/sync/locked_by.rs | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/rust/kernel/sync/locked_by.rs ++++ b/rust/kernel/sync/locked_by.rs +@@ -83,8 +83,12 @@ pub struct LockedBy Send for LockedBy {} + +-// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the +-// data it protects is `Send`. ++// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use ++// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is ++// sufficient to allow that. ++// ++// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain ++// several `&T` from several threads at once. However, this is okay as `T` is `Sync`. + unsafe impl Sync for LockedBy {} + + impl LockedBy { +@@ -118,7 +122,10 @@ impl LockedBy { + /// + /// Panics if `owner` is different from the data protected by the lock used in + /// [`new`](LockedBy::new). +- pub fn access<'a>(&'a self, owner: &'a U) -> &'a T { ++ pub fn access<'a>(&'a self, owner: &'a U) -> &'a T ++ where ++ T: Sync, ++ { + build_assert!( + size_of::() > 0, + "`U` cannot be a ZST because `owner` wouldn't be unique" +@@ -127,7 +134,10 @@ impl LockedBy { + panic!("mismatched owners"); + } + +- // SAFETY: `owner` is evidence that the owner is locked. ++ // SAFETY: `owner` is evidence that there are only shared references to the owner for the ++ // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable ++ // reference to the inner value that aliases with this shared reference. The type is `Sync` ++ // so there are no other requirements. + unsafe { &*self.data.get() } + } + diff --git a/queue-6.10/series b/queue-6.10/series index 4be2ca23057..341431b4a3e 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -286,3 +286,23 @@ f2fs-introduce-migration_window_granularity.patch f2fs-increase-bg-gc-migration-window-granularity-whe.patch f2fs-do-fg_gc-when-gc-boosting-is-required-for-zoned.patch f2fs-forcibly-migrate-to-secure-space-for-zoned-devi.patch +revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch +platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch +platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch +kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch +i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch +i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch +i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch +media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch +i2c-core-lock-address-during-client-device-instantiation.patch +i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch +i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch +i2c-synquacer-deal-with-optional-pclk-correctly.patch +rust-sync-require-t-sync-for-lockedby-access.patch +ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch +firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch +memory-tegra186-emc-drop-unused-to_tegra186_emc.patch +dt-bindings-clock-exynos7885-fix-duplicated-binding.patch +spi-bcm63xx-fix-module-autoloading.patch +spi-bcm63xx-fix-missing-pm_runtime_disable.patch +power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch diff --git a/queue-6.10/spi-bcm63xx-fix-missing-pm_runtime_disable.patch b/queue-6.10/spi-bcm63xx-fix-missing-pm_runtime_disable.patch new file mode 100644 index 00000000000..46b52dd4ce2 --- /dev/null +++ b/queue-6.10/spi-bcm63xx-fix-missing-pm_runtime_disable.patch @@ -0,0 +1,53 @@ +From 265697288ec2160ca84707565d6641d46f69b0ff Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Mon, 19 Aug 2024 20:33:49 +0800 +Subject: spi: bcm63xx: Fix missing pm_runtime_disable() + +From: Jinjie Ruan + +commit 265697288ec2160ca84707565d6641d46f69b0ff upstream. + +The pm_runtime_disable() is missing in the remove function, fix it +by using devm_pm_runtime_enable(), so the pm_runtime_disable() in +the probe error path can also be removed. + +Fixes: 2d13f2ff6073 ("spi: bcm63xx-spi: fix pm_runtime") +Cc: stable@vger.kernel.org # v5.13+ +Signed-off-by: Jinjie Ruan +Suggested-by: Jonas Gorski +Link: https://patch.msgid.link/20240819123349.4020472-3-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -584,13 +584,15 @@ static int bcm63xx_spi_probe(struct plat + + bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS); + +- pm_runtime_enable(&pdev->dev); ++ ret = devm_pm_runtime_enable(&pdev->dev); ++ if (ret) ++ goto out_clk_disable; + + /* register and we are done */ + ret = devm_spi_register_controller(dev, host); + if (ret) { + dev_err(dev, "spi register failed\n"); +- goto out_pm_disable; ++ goto out_clk_disable; + } + + dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n", +@@ -598,8 +600,6 @@ static int bcm63xx_spi_probe(struct plat + + return 0; + +-out_pm_disable: +- pm_runtime_disable(&pdev->dev); + out_clk_disable: + clk_disable_unprepare(clk); + out_err: diff --git a/queue-6.10/spi-bcm63xx-fix-module-autoloading.patch b/queue-6.10/spi-bcm63xx-fix-module-autoloading.patch new file mode 100644 index 00000000000..4fac79b5e2d --- /dev/null +++ b/queue-6.10/spi-bcm63xx-fix-module-autoloading.patch @@ -0,0 +1,33 @@ +From 909f34f2462a99bf876f64c5c61c653213e32fce Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Mon, 19 Aug 2024 20:33:48 +0800 +Subject: spi: bcm63xx: Fix module autoloading + +From: Jinjie Ruan + +commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream. + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded +based on the alias from platform_device_id table. + +Fixes: 44d8fb30941d ("spi/bcm63xx: move register definitions into the driver") +Cc: stable@vger.kernel.org +Signed-off-by: Jinjie Ruan +Reviewed-by: Jonas Gorski +Link: https://patch.msgid.link/20240819123349.4020472-2-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -466,6 +466,7 @@ static const struct platform_device_id b + { + }, + }; ++MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match); + + static const struct of_device_id bcm63xx_spi_of_match[] = { + { .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },