From: Greg Kroah-Hartman Date: Sun, 29 Oct 2023 12:25:51 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.1.61~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=202232b7197c36833bc6c364642034db331ab239;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: clk-sanitize-possible_parent_show-to-handle-return-value-of-of_clk_get_parent_name.patch i2c-aspeed-fix-i2c-bus-hang-in-slave-read.patch i2c-muxes-i2c-demux-pinctrl-use-of_get_i2c_adapter_by_node.patch i2c-muxes-i2c-mux-gpmux-use-of_get_i2c_adapter_by_node.patch i2c-muxes-i2c-mux-pinctrl-use-of_get_i2c_adapter_by_node.patch i2c-stm32f7-fix-pec-handling-in-case-of-smbus-transfers.patch iio-adc-xilinx-xadc-correct-temperature-offset-scale-for-ultrascale.patch iio-adc-xilinx-xadc-don-t-clobber-preset-voltage-temperature-thresholds.patch iio-afe-rescale-accept-only-offset-channels.patch iio-exynos-adc-request-second-interupt-only-when-touchscreen-mode-is-used.patch misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch nvmem-imx-correct-nregs-for-i.mx6sll.patch nvmem-imx-correct-nregs-for-i.mx6ul.patch nvmem-imx-correct-nregs-for-i.mx6ull.patch perf-core-fix-potential-null-deref.patch sparc32-fix-a-braino-in-fault-handling-in-csum_and_copy_..._user.patch tracing-kprobes-fix-symbol-counting-logic-by-looking-at-modules-as-well.patch tracing-kprobes-fix-the-description-of-variable-length-arguments.patch x86-cpu-add-model-number-for-intel-arrow-lake-mobile-processor.patch x86-i8259-skip-probing-when-acpi-madt-advertises-pcat-compatibility.patch --- diff --git a/queue-6.1/clk-sanitize-possible_parent_show-to-handle-return-value-of-of_clk_get_parent_name.patch b/queue-6.1/clk-sanitize-possible_parent_show-to-handle-return-value-of-of_clk_get_parent_name.patch new file mode 100644 index 00000000000..1eed6a55382 --- /dev/null +++ b/queue-6.1/clk-sanitize-possible_parent_show-to-handle-return-value-of-of_clk_get_parent_name.patch @@ -0,0 +1,73 @@ +From ceb87a361d0b079ecbc7d2831618c19087f304a9 Mon Sep 17 00:00:00 2001 +From: Alessandro Carminati +Date: Thu, 21 Sep 2023 07:32:17 +0000 +Subject: clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name + +From: Alessandro Carminati + +commit ceb87a361d0b079ecbc7d2831618c19087f304a9 upstream. + +In the possible_parent_show function, ensure proper handling of the return +value from of_clk_get_parent_name to prevent potential issues arising from +a NULL return. +The current implementation invokes seq_puts directly on the result of +of_clk_get_parent_name without verifying the return value, which can lead +to kernel panic if the function returns NULL. + +This patch addresses the concern by introducing a check on the return +value of of_clk_get_parent_name. If the return value is not NULL, the +function proceeds to call seq_puts, providing the returned value as +argument. +However, if of_clk_get_parent_name returns NULL, the function provides a +static string as argument, avoiding the panic. + +Fixes: 1ccc0ddf046a ("clk: Use seq_puts() in possible_parent_show()") +Reported-by: Philip Daly +Signed-off-by: Alessandro Carminati (Red Hat) +Link: https://lore.kernel.org/r/20230921073217.572151-1-alessandro.carminati@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3340,6 +3340,7 @@ static void possible_parent_show(struct + unsigned int i, char terminator) + { + struct clk_core *parent; ++ const char *name = NULL; + + /* + * Go through the following options to fetch a parent's name. +@@ -3354,18 +3355,20 @@ static void possible_parent_show(struct + * registered (yet). + */ + parent = clk_core_get_parent_by_index(core, i); +- if (parent) ++ if (parent) { + seq_puts(s, parent->name); +- else if (core->parents[i].name) ++ } else if (core->parents[i].name) { + seq_puts(s, core->parents[i].name); +- else if (core->parents[i].fw_name) ++ } else if (core->parents[i].fw_name) { + seq_printf(s, "<%s>(fw)", core->parents[i].fw_name); +- else if (core->parents[i].index >= 0) +- seq_puts(s, +- of_clk_get_parent_name(core->of_node, +- core->parents[i].index)); +- else +- seq_puts(s, "(missing)"); ++ } else { ++ if (core->parents[i].index >= 0) ++ name = of_clk_get_parent_name(core->of_node, core->parents[i].index); ++ if (!name) ++ name = "(missing)"; ++ ++ seq_puts(s, name); ++ } + + seq_putc(s, terminator); + } diff --git a/queue-6.1/i2c-aspeed-fix-i2c-bus-hang-in-slave-read.patch b/queue-6.1/i2c-aspeed-fix-i2c-bus-hang-in-slave-read.patch new file mode 100644 index 00000000000..dd83a2f4dba --- /dev/null +++ b/queue-6.1/i2c-aspeed-fix-i2c-bus-hang-in-slave-read.patch @@ -0,0 +1,49 @@ +From 54f1840ddee9bbdc8dd89fbbfdfa632401244146 Mon Sep 17 00:00:00 2001 +From: Jian Zhang +Date: Fri, 6 Oct 2023 10:22:33 +0800 +Subject: i2c: aspeed: Fix i2c bus hang in slave read + +From: Jian Zhang + +commit 54f1840ddee9bbdc8dd89fbbfdfa632401244146 upstream. + +When the `CONFIG_I2C_SLAVE` option is enabled and the device operates +as a slave, a situation arises where the master sends a START signal +without the accompanying STOP signal. This action results in a +persistent I2C bus timeout. The core issue stems from the fact that +the i2c controller remains in a slave read state without a timeout +mechanism. As a consequence, the bus perpetually experiences timeouts. + +In this case, the i2c bus will be reset, but the slave_state reset is +missing. + +Fixes: fee465150b45 ("i2c: aspeed: Reset the i2c controller when timeout occurs") +Signed-off-by: Jian Zhang +Acked-by: Andi Shyti +Tested-by: Andrew Jeffery +Reviewed-by: Andrew Jeffery +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-aspeed.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-aspeed.c ++++ b/drivers/i2c/busses/i2c-aspeed.c +@@ -749,6 +749,8 @@ static void __aspeed_i2c_reg_slave(struc + func_ctrl_reg_val = readl(bus->base + ASPEED_I2C_FUN_CTRL_REG); + func_ctrl_reg_val |= ASPEED_I2CD_SLAVE_EN; + writel(func_ctrl_reg_val, bus->base + ASPEED_I2C_FUN_CTRL_REG); ++ ++ bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; + } + + static int aspeed_i2c_reg_slave(struct i2c_client *client) +@@ -765,7 +767,6 @@ static int aspeed_i2c_reg_slave(struct i + __aspeed_i2c_reg_slave(bus, client->addr); + + bus->slave = client; +- bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; + spin_unlock_irqrestore(&bus->lock, flags); + + return 0; diff --git a/queue-6.1/i2c-muxes-i2c-demux-pinctrl-use-of_get_i2c_adapter_by_node.patch b/queue-6.1/i2c-muxes-i2c-demux-pinctrl-use-of_get_i2c_adapter_by_node.patch new file mode 100644 index 00000000000..20d84ed56e9 --- /dev/null +++ b/queue-6.1/i2c-muxes-i2c-demux-pinctrl-use-of_get_i2c_adapter_by_node.patch @@ -0,0 +1,42 @@ +From 0fb118de5003028ad092a4e66fc6d07b86c3bc94 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Fri, 20 Oct 2023 17:30:12 +0200 +Subject: i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() + +From: Herve Codina + +commit 0fb118de5003028ad092a4e66fc6d07b86c3bc94 upstream. + +i2c-demux-pinctrl uses the pair of_find_i2c_adapter_by_node() / +i2c_put_adapter(). These pair alone is not correct to properly lock the +I2C parent adapter. + +Indeed, i2c_put_adapter() decrements the module refcount while +of_find_i2c_adapter_by_node() does not increment it. This leads to an +underflow of the parent module refcount. + +Use the dedicated function, of_get_i2c_adapter_by_node(), to handle +correctly the module refcount. + +Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver") +Signed-off-by: Herve Codina +Cc: stable@vger.kernel.org +Acked-by: Peter Rosin +Reviewed-by: Jonathan Cameron +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -61,7 +61,7 @@ static int i2c_demux_activate_master(str + if (ret) + goto err; + +- adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np); ++ adap = of_get_i2c_adapter_by_node(priv->chan[new_chan].parent_np); + if (!adap) { + ret = -ENODEV; + goto err_with_revert; diff --git a/queue-6.1/i2c-muxes-i2c-mux-gpmux-use-of_get_i2c_adapter_by_node.patch b/queue-6.1/i2c-muxes-i2c-mux-gpmux-use-of_get_i2c_adapter_by_node.patch new file mode 100644 index 00000000000..0f65bc4204b --- /dev/null +++ b/queue-6.1/i2c-muxes-i2c-mux-gpmux-use-of_get_i2c_adapter_by_node.patch @@ -0,0 +1,42 @@ +From 3dc0ec46f6e7511fc4fdf6b6cda439382bc957f1 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Fri, 20 Oct 2023 17:30:13 +0200 +Subject: i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() + +From: Herve Codina + +commit 3dc0ec46f6e7511fc4fdf6b6cda439382bc957f1 upstream. + +i2c-mux-gpmux uses the pair of_find_i2c_adapter_by_node() / +i2c_put_adapter(). These pair alone is not correct to properly lock the +I2C parent adapter. + +Indeed, i2c_put_adapter() decrements the module refcount while +of_find_i2c_adapter_by_node() does not increment it. This leads to an +underflow of the parent module refcount. + +Use the dedicated function, of_get_i2c_adapter_by_node(), to handle +correctly the module refcount. + +Fixes: ac8498f0ce53 ("i2c: i2c-mux-gpmux: new driver") +Signed-off-by: Herve Codina +Cc: stable@vger.kernel.org +Acked-by: Peter Rosin +Reviewed-by: Jonathan Cameron +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-mux-gpmux.c ++++ b/drivers/i2c/muxes/i2c-mux-gpmux.c +@@ -52,7 +52,7 @@ static struct i2c_adapter *mux_parent_ad + dev_err(dev, "Cannot parse i2c-parent\n"); + return ERR_PTR(-ENODEV); + } +- parent = of_find_i2c_adapter_by_node(parent_np); ++ parent = of_get_i2c_adapter_by_node(parent_np); + of_node_put(parent_np); + if (!parent) + return ERR_PTR(-EPROBE_DEFER); diff --git a/queue-6.1/i2c-muxes-i2c-mux-pinctrl-use-of_get_i2c_adapter_by_node.patch b/queue-6.1/i2c-muxes-i2c-mux-pinctrl-use-of_get_i2c_adapter_by_node.patch new file mode 100644 index 00000000000..1be0f124dbb --- /dev/null +++ b/queue-6.1/i2c-muxes-i2c-mux-pinctrl-use-of_get_i2c_adapter_by_node.patch @@ -0,0 +1,42 @@ +From 3171d37b58a76e1febbf3f4af2d06234a98cf88b Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Fri, 20 Oct 2023 17:30:11 +0200 +Subject: i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() + +From: Herve Codina + +commit 3171d37b58a76e1febbf3f4af2d06234a98cf88b upstream. + +i2c-mux-pinctrl uses the pair of_find_i2c_adapter_by_node() / +i2c_put_adapter(). These pair alone is not correct to properly lock the +I2C parent adapter. + +Indeed, i2c_put_adapter() decrements the module refcount while +of_find_i2c_adapter_by_node() does not increment it. This leads to an +underflow of the parent module refcount. + +Use the dedicated function, of_get_i2c_adapter_by_node(), to handle +correctly the module refcount. + +Fixes: c4aee3e1b0de ("i2c: mux: pinctrl: remove platform_data") +Signed-off-by: Herve Codina +Cc: stable@vger.kernel.org +Acked-by: Peter Rosin +Reviewed-by: Jonathan Cameron +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c +@@ -62,7 +62,7 @@ static struct i2c_adapter *i2c_mux_pinct + dev_err(dev, "Cannot parse i2c-parent\n"); + return ERR_PTR(-ENODEV); + } +- parent = of_find_i2c_adapter_by_node(parent_np); ++ parent = of_get_i2c_adapter_by_node(parent_np); + of_node_put(parent_np); + if (!parent) + return ERR_PTR(-EPROBE_DEFER); diff --git a/queue-6.1/i2c-stm32f7-fix-pec-handling-in-case-of-smbus-transfers.patch b/queue-6.1/i2c-stm32f7-fix-pec-handling-in-case-of-smbus-transfers.patch new file mode 100644 index 00000000000..f124010c79e --- /dev/null +++ b/queue-6.1/i2c-stm32f7-fix-pec-handling-in-case-of-smbus-transfers.patch @@ -0,0 +1,64 @@ +From c896ff2dd8f30a6b0a922c83a96f6d43f05f0e92 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Tue, 10 Oct 2023 10:44:54 +0200 +Subject: i2c: stm32f7: Fix PEC handling in case of SMBUS transfers + +From: Alain Volmat + +commit c896ff2dd8f30a6b0a922c83a96f6d43f05f0e92 upstream. + +In case of SMBUS byte read with PEC enabled, the whole transfer +is split into two commands. A first write command, followed by +a read command. The write command does not have any PEC byte +and a PEC byte is appended at the end of the read command. +(cf Read byte protocol with PEC in SMBUS specification) + +Within the STM32 I2C controller, handling (either sending +or receiving) of the PEC byte is done via the PECBYTE bit in +register CR2. + +Currently, the PECBYTE is set at the beginning of a transfer, +which lead to sending a PEC byte at the end of the write command +(hence losing the real last byte), and also does not check the +PEC byte received during the read command. + +This patch corrects the function stm32f7_i2c_smbus_xfer_msg +in order to only set the PECBYTE during the read command. + +Fixes: 9e48155f6bfe ("i2c: i2c-stm32f7: Add initial SMBus protocols support") +Signed-off-by: Alain Volmat +Reviewed-by: Pierre-Yves MORDRET +Acked-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32f7.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1059,9 +1059,10 @@ static int stm32f7_i2c_smbus_xfer_msg(st + /* Configure PEC */ + if ((flags & I2C_CLIENT_PEC) && f7_msg->size != I2C_SMBUS_QUICK) { + cr1 |= STM32F7_I2C_CR1_PECEN; +- cr2 |= STM32F7_I2C_CR2_PECBYTE; +- if (!f7_msg->read_write) ++ if (!f7_msg->read_write) { ++ cr2 |= STM32F7_I2C_CR2_PECBYTE; + f7_msg->count++; ++ } + } else { + cr1 &= ~STM32F7_I2C_CR1_PECEN; + cr2 &= ~STM32F7_I2C_CR2_PECBYTE; +@@ -1149,8 +1150,10 @@ static void stm32f7_i2c_smbus_rep_start( + f7_msg->stop = true; + + /* Add one byte for PEC if needed */ +- if (cr1 & STM32F7_I2C_CR1_PECEN) ++ if (cr1 & STM32F7_I2C_CR1_PECEN) { ++ cr2 |= STM32F7_I2C_CR2_PECBYTE; + f7_msg->count++; ++ } + + /* Set number of bytes to be transferred */ + cr2 &= ~(STM32F7_I2C_CR2_NBYTES_MASK); diff --git a/queue-6.1/iio-adc-xilinx-xadc-correct-temperature-offset-scale-for-ultrascale.patch b/queue-6.1/iio-adc-xilinx-xadc-correct-temperature-offset-scale-for-ultrascale.patch new file mode 100644 index 00000000000..0076b5f26f4 --- /dev/null +++ b/queue-6.1/iio-adc-xilinx-xadc-correct-temperature-offset-scale-for-ultrascale.patch @@ -0,0 +1,100 @@ +From e2bd8c28b9bd835077eb65715d416d667694a80d Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Thu, 14 Sep 2023 18:10:19 -0600 +Subject: iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale + +From: Robert Hancock + +commit e2bd8c28b9bd835077eb65715d416d667694a80d upstream. + +The driver was previously using offset and scale values for the +temperature sensor readings which were only valid for 7-series devices. +Add per-device-type values for offset and scale and set them appropriately +for each device type. + +Note that the values used for the UltraScale family are for UltraScale+ +(i.e. the SYSMONE4 primitive) using the internal reference, as that seems +to be the most common configuration and the device tree values Xilinx's +device tree generator produces don't seem to give us anything to tell us +which configuration is used. However, the differences within the UltraScale +family seem fairly minor and it's closer than using the 7-series values +instead in any case. + +Fixes: c2b7720a7905 ("iio: xilinx-xadc: Add basic support for Ultrascale System Monitor") +Signed-off-by: Robert Hancock +Acked-by: O'Griofa, Conall +Tested-by: O'Griofa, Conall +Link: https://lore.kernel.org/r/20230915001019.2862964-3-robert.hancock@calian.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/xilinx-xadc-core.c | 17 ++++++++++++++--- + drivers/iio/adc/xilinx-xadc.h | 2 ++ + 2 files changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -456,6 +456,9 @@ static const struct xadc_ops xadc_zynq_o + .interrupt_handler = xadc_zynq_interrupt_handler, + .update_alarm = xadc_zynq_update_alarm, + .type = XADC_TYPE_S7, ++ /* Temp in C = (val * 503.975) / 2**bits - 273.15 */ ++ .temp_scale = 503975, ++ .temp_offset = 273150, + }; + + static const unsigned int xadc_axi_reg_offsets[] = { +@@ -566,6 +569,9 @@ static const struct xadc_ops xadc_7s_axi + .interrupt_handler = xadc_axi_interrupt_handler, + .flags = XADC_FLAGS_BUFFERED | XADC_FLAGS_IRQ_OPTIONAL, + .type = XADC_TYPE_S7, ++ /* Temp in C = (val * 503.975) / 2**bits - 273.15 */ ++ .temp_scale = 503975, ++ .temp_offset = 273150, + }; + + static const struct xadc_ops xadc_us_axi_ops = { +@@ -577,6 +583,12 @@ static const struct xadc_ops xadc_us_axi + .interrupt_handler = xadc_axi_interrupt_handler, + .flags = XADC_FLAGS_BUFFERED | XADC_FLAGS_IRQ_OPTIONAL, + .type = XADC_TYPE_US, ++ /** ++ * Values below are for UltraScale+ (SYSMONE4) using internal reference. ++ * See https://docs.xilinx.com/v/u/en-US/ug580-ultrascale-sysmon ++ */ ++ .temp_scale = 509314, ++ .temp_offset = 280231, + }; + + static int _xadc_update_adc_reg(struct xadc *xadc, unsigned int reg, +@@ -948,8 +960,7 @@ static int xadc_read_raw(struct iio_dev + *val2 = bits; + return IIO_VAL_FRACTIONAL_LOG2; + case IIO_TEMP: +- /* Temp in C = (val * 503.975) / 2**bits - 273.15 */ +- *val = 503975; ++ *val = xadc->ops->temp_scale; + *val2 = bits; + return IIO_VAL_FRACTIONAL_LOG2; + default: +@@ -957,7 +968,7 @@ static int xadc_read_raw(struct iio_dev + } + case IIO_CHAN_INFO_OFFSET: + /* Only the temperature channel has an offset */ +- *val = -((273150 << bits) / 503975); ++ *val = -((xadc->ops->temp_offset << bits) / xadc->ops->temp_scale); + return IIO_VAL_INT; + case IIO_CHAN_INFO_SAMP_FREQ: + ret = xadc_read_samplerate(xadc); +--- a/drivers/iio/adc/xilinx-xadc.h ++++ b/drivers/iio/adc/xilinx-xadc.h +@@ -85,6 +85,8 @@ struct xadc_ops { + + unsigned int flags; + enum xadc_type type; ++ int temp_scale; ++ int temp_offset; + }; + + static inline int _xadc_read_adc_reg(struct xadc *xadc, unsigned int reg, diff --git a/queue-6.1/iio-adc-xilinx-xadc-don-t-clobber-preset-voltage-temperature-thresholds.patch b/queue-6.1/iio-adc-xilinx-xadc-don-t-clobber-preset-voltage-temperature-thresholds.patch new file mode 100644 index 00000000000..41959589e8e --- /dev/null +++ b/queue-6.1/iio-adc-xilinx-xadc-don-t-clobber-preset-voltage-temperature-thresholds.patch @@ -0,0 +1,68 @@ +From 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Thu, 14 Sep 2023 18:10:18 -0600 +Subject: iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds + +From: Robert Hancock + +commit 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 upstream. + +In the probe function, the driver was reading out the thresholds already +set in the core, which can be configured by the user in the Vivado tools +when the FPGA image is built. However, it later clobbered those values +with zero or maximum values. In particular, the overtemperature shutdown +threshold register was overwritten with the max value, which effectively +prevents the FPGA from shutting down when the desired threshold was +eached, potentially risking hardware damage in that case. + +Remove this code to leave the preconfigured default threshold values +intact. + +The code was also disabling all alarms regardless of what enable state +they were left in by the FPGA image, including the overtemperature +shutdown feature. Leave these bits in their original state so they are +not unconditionally disabled. + +Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") +Signed-off-by: Robert Hancock +Acked-by: O'Griofa, Conall +Tested-by: O'Griofa, Conall +Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/xilinx-xadc-core.c | 22 ---------------------- + 1 file changed, 22 deletions(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -1426,28 +1426,6 @@ static int xadc_probe(struct platform_de + if (ret) + return ret; + +- /* Disable all alarms */ +- ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK, +- XADC_CONF1_ALARM_MASK); +- if (ret) +- return ret; +- +- /* Set thresholds to min/max */ +- for (i = 0; i < 16; i++) { +- /* +- * Set max voltage threshold and both temperature thresholds to +- * 0xffff, min voltage threshold to 0. +- */ +- if (i % 8 < 4 || i == 7) +- xadc->threshold[i] = 0xffff; +- else +- xadc->threshold[i] = 0; +- ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), +- xadc->threshold[i]); +- if (ret) +- return ret; +- } +- + /* Go to non-buffered mode */ + xadc_postdisable(indio_dev); + diff --git a/queue-6.1/iio-afe-rescale-accept-only-offset-channels.patch b/queue-6.1/iio-afe-rescale-accept-only-offset-channels.patch new file mode 100644 index 00000000000..8e056ffba0a --- /dev/null +++ b/queue-6.1/iio-afe-rescale-accept-only-offset-channels.patch @@ -0,0 +1,69 @@ +From bee448390e5166d019e9e037194d487ee94399d9 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Sat, 2 Sep 2023 21:46:20 +0200 +Subject: iio: afe: rescale: Accept only offset channels + +From: Linus Walleij + +commit bee448390e5166d019e9e037194d487ee94399d9 upstream. + +As noted by Jonathan Cameron: it is perfectly legal for a channel +to have an offset but no scale in addition to the raw interface. +The conversion will imply that scale is 1:1. + +Make rescale_configure_channel() accept just scale, or just offset +to process a channel. + +When a user asks for IIO_CHAN_INFO_OFFSET in rescale_read_raw() +we now have to deal with the fact that OFFSET could be present +but SCALE missing. Add code to simply scale 1:1 in this case. + +Link: https://lore.kernel.org/linux-iio/CACRpkdZXBjHU4t-GVOCFxRO-AHGxKnxMeHD2s4Y4PuC29gBq6g@mail.gmail.com/ +Fixes: 53ebee949980 ("iio: afe: iio-rescale: Support processed channels") +Fixes: 9decacd8b3a4 ("iio: afe: rescale: Fix boolean logic bug") +Reported-by: Jonathan Cameron +Signed-off-by: Linus Walleij +Reviewed-by: Peter Rosin +Link: https://lore.kernel.org/r/20230902-iio-rescale-only-offset-v2-1-988b807754c8@linaro.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/afe/iio-rescale.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/iio/afe/iio-rescale.c ++++ b/drivers/iio/afe/iio-rescale.c +@@ -214,8 +214,18 @@ static int rescale_read_raw(struct iio_d + return ret < 0 ? ret : -EOPNOTSUPP; + } + +- ret = iio_read_channel_scale(rescale->source, &scale, &scale2); +- return rescale_process_offset(rescale, ret, scale, scale2, ++ if (iio_channel_has_info(rescale->source->channel, ++ IIO_CHAN_INFO_SCALE)) { ++ ret = iio_read_channel_scale(rescale->source, &scale, &scale2); ++ return rescale_process_offset(rescale, ret, scale, scale2, ++ schan_off, val, val2); ++ } ++ ++ /* ++ * If we get here we have no scale so scale 1:1 but apply ++ * rescaler and offset, if any. ++ */ ++ return rescale_process_offset(rescale, IIO_VAL_FRACTIONAL, 1, 1, + schan_off, val, val2); + default: + return -EINVAL; +@@ -280,8 +290,9 @@ static int rescale_configure_channel(str + chan->type = rescale->cfg->type; + + if (iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) && +- iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE)) { +- dev_info(dev, "using raw+scale source channel\n"); ++ (iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE) || ++ iio_channel_has_info(schan, IIO_CHAN_INFO_OFFSET))) { ++ dev_info(dev, "using raw+scale/offset source channel\n"); + } else if (iio_channel_has_info(schan, IIO_CHAN_INFO_PROCESSED)) { + dev_info(dev, "using processed channel\n"); + rescale->chan_processed = true; diff --git a/queue-6.1/iio-exynos-adc-request-second-interupt-only-when-touchscreen-mode-is-used.patch b/queue-6.1/iio-exynos-adc-request-second-interupt-only-when-touchscreen-mode-is-used.patch new file mode 100644 index 00000000000..ea4c38986a8 --- /dev/null +++ b/queue-6.1/iio-exynos-adc-request-second-interupt-only-when-touchscreen-mode-is-used.patch @@ -0,0 +1,72 @@ +From 865b080e3229102f160889328ce2e8e97aa65ea0 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Mon, 9 Oct 2023 12:14:12 +0200 +Subject: iio: exynos-adc: request second interupt only when touchscreen mode is used + +From: Marek Szyprowski + +commit 865b080e3229102f160889328ce2e8e97aa65ea0 upstream. + +Second interrupt is needed only when touchscreen mode is used, so don't +request it unconditionally. This removes the following annoying warning +during boot: + +exynos-adc 14d10000.adc: error -ENXIO: IRQ index 1 not found + +Fixes: 2bb8ad9b44c5 ("iio: exynos-adc: add experimental touchscreen support") +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20231009101412.916922-1-m.szyprowski@samsung.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/exynos_adc.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +--- a/drivers/iio/adc/exynos_adc.c ++++ b/drivers/iio/adc/exynos_adc.c +@@ -826,16 +826,26 @@ static int exynos_adc_probe(struct platf + } + } + ++ /* leave out any TS related code if unreachable */ ++ if (IS_REACHABLE(CONFIG_INPUT)) { ++ has_ts = of_property_read_bool(pdev->dev.of_node, ++ "has-touchscreen") || pdata; ++ } ++ + irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + info->irq = irq; + +- irq = platform_get_irq(pdev, 1); +- if (irq == -EPROBE_DEFER) +- return irq; +- +- info->tsirq = irq; ++ if (has_ts) { ++ irq = platform_get_irq(pdev, 1); ++ if (irq == -EPROBE_DEFER) ++ return irq; ++ ++ info->tsirq = irq; ++ } else { ++ info->tsirq = -1; ++ } + + info->dev = &pdev->dev; + +@@ -900,12 +910,6 @@ static int exynos_adc_probe(struct platf + if (info->data->init_hw) + info->data->init_hw(info); + +- /* leave out any TS related code if unreachable */ +- if (IS_REACHABLE(CONFIG_INPUT)) { +- has_ts = of_property_read_bool(pdev->dev.of_node, +- "has-touchscreen") || pdata; +- } +- + if (pdata) + info->delay = pdata->delay; + else diff --git a/queue-6.1/misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch b/queue-6.1/misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch new file mode 100644 index 00000000000..2b50145f56d --- /dev/null +++ b/queue-6.1/misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch @@ -0,0 +1,51 @@ +From 1c8093591d1e372d700fe65423e7315a8ecf721b Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta +Date: Fri, 13 Oct 2023 13:20:06 +0100 +Subject: misc: fastrpc: Clean buffers on remote invocation failures + +From: Ekansh Gupta + +commit 1c8093591d1e372d700fe65423e7315a8ecf721b upstream. + +With current design, buffers and dma handles are not freed in case +of remote invocation failures returned from DSP. This could result +in buffer leakings and dma handle pointing to wrong memory in the +fastrpc kernel. Adding changes to clean buffers and dma handles +even when remote invocation to DSP returns failures. + +Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") +Cc: stable +Signed-off-by: Ekansh Gupta +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013122007.174464-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1122,11 +1122,6 @@ static int fastrpc_internal_invoke(struc + if (err) + goto bail; + +- /* Check the response from remote dsp */ +- err = ctx->retval; +- if (err) +- goto bail; +- + /* make sure that all memory writes by DSP are seen by CPU */ + dma_rmb(); + /* populate all the output buffers with results */ +@@ -1134,6 +1129,11 @@ static int fastrpc_internal_invoke(struc + if (err) + goto bail; + ++ /* Check the response from remote dsp */ ++ err = ctx->retval; ++ if (err) ++ goto bail; ++ + bail: + if (err != -ERESTARTSYS && err != -ETIMEDOUT) { + /* We are done with this compute context */ diff --git a/queue-6.1/misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch b/queue-6.1/misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch new file mode 100644 index 00000000000..0ff5aa13151 --- /dev/null +++ b/queue-6.1/misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch @@ -0,0 +1,72 @@ +From 206484303892a2a36c0c3414030ddfef658a4e70 Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta +Date: Fri, 13 Oct 2023 13:20:05 +0100 +Subject: misc: fastrpc: Free DMA handles for RPC calls with no arguments + +From: Ekansh Gupta + +commit 206484303892a2a36c0c3414030ddfef658a4e70 upstream. + +The FDs for DMA handles to be freed is updated in fdlist by DSP over +a remote call. This holds true even for remote calls with no +arguments. To handle this, get_args and put_args are needed to +be called for remote calls with no arguments also as fdlist +is allocated in get_args and FDs updated in fdlist is freed +in put_args. + +Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") +Cc: stable +Signed-off-by: Ekansh Gupta +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013122007.174464-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1036,6 +1036,7 @@ static int fastrpc_put_args(struct fastr + } + } + ++ /* Clean up fdlist which is updated by DSP */ + for (i = 0; i < FASTRPC_MAX_FDLIST; i++) { + if (!fdlist[i]) + break; +@@ -1100,11 +1101,9 @@ static int fastrpc_internal_invoke(struc + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- if (ctx->nscalars) { +- err = fastrpc_get_args(kernel, ctx); +- if (err) +- goto bail; +- } ++ err = fastrpc_get_args(kernel, ctx); ++ if (err) ++ goto bail; + + /* make sure that all CPU memory writes are seen by DSP */ + dma_wmb(); +@@ -1128,14 +1127,12 @@ static int fastrpc_internal_invoke(struc + if (err) + goto bail; + +- if (ctx->nscalars) { +- /* make sure that all memory writes by DSP are seen by CPU */ +- dma_rmb(); +- /* populate all the output buffers with results */ +- err = fastrpc_put_args(ctx, kernel); +- if (err) +- goto bail; +- } ++ /* make sure that all memory writes by DSP are seen by CPU */ ++ dma_rmb(); ++ /* populate all the output buffers with results */ ++ err = fastrpc_put_args(ctx, kernel); ++ if (err) ++ goto bail; + + bail: + if (err != -ERESTARTSYS && err != -ETIMEDOUT) { diff --git a/queue-6.1/misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch b/queue-6.1/misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch new file mode 100644 index 00000000000..5102e5f0d60 --- /dev/null +++ b/queue-6.1/misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch @@ -0,0 +1,37 @@ +From 1c29d80134ac116e0196c7bad58a2121381b679c Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta +Date: Fri, 13 Oct 2023 13:20:04 +0100 +Subject: misc: fastrpc: Reset metadata buffer to avoid incorrect free + +From: Ekansh Gupta + +commit 1c29d80134ac116e0196c7bad58a2121381b679c upstream. + +Metadata buffer is allocated during get_args for any remote call. +This buffer carries buffers, fdlists and other payload information +for the call. If the buffer is not reset, put_args might find some +garbage FDs in the fdlist which might have an existing mapping in +the list. This could result in improper freeing of FD map when DSP +might still be using the buffer. Added change to reset the metadata +buffer after allocation. + +Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") +Cc: stable +Signed-off-by: Ekansh Gupta +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013122007.174464-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -903,6 +903,7 @@ static int fastrpc_get_args(u32 kernel, + if (err) + return err; + ++ memset(ctx->buf->virt, 0, pkt_size); + rpra = ctx->buf->virt; + list = fastrpc_invoke_buf_start(rpra, ctx->nscalars); + pages = fastrpc_phy_page_start(list, ctx->nscalars); diff --git a/queue-6.1/misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch b/queue-6.1/misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch new file mode 100644 index 00000000000..b70503a501d --- /dev/null +++ b/queue-6.1/misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch @@ -0,0 +1,43 @@ +From 509143385db364c67556a914bef6c9a42fd2c74c Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta +Date: Fri, 13 Oct 2023 13:20:07 +0100 +Subject: misc: fastrpc: Unmap only if buffer is unmapped from DSP + +From: Ekansh Gupta + +commit 509143385db364c67556a914bef6c9a42fd2c74c upstream. + +For unmapping any buffer from kernel, it should first be unmapped +from DSP. In case unmap from DSP request fails, the map should not +be removed from kernel as it might lead to SMMU faults and other +memory issues. + +Fixes: 5c1b97c7d7b7 ("misc: fastrpc: add support for FASTRPC_IOCTL_MEM_MAP/UNMAP") +Cc: stable +Signed-off-by: Ekansh Gupta +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013122007.174464-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1783,11 +1783,13 @@ static int fastrpc_req_mem_unmap_impl(st + sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_MEM_UNMAP, 1, 0); + err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, + &args[0]); +- fastrpc_map_put(map); +- if (err) ++ if (err) { + dev_err(dev, "unmmap\tpt fd = %d, 0x%09llx error\n", map->fd, map->raddr); ++ return err; ++ } ++ fastrpc_map_put(map); + +- return err; ++ return 0; + } + + static int fastrpc_req_mem_unmap(struct fastrpc_user *fl, char __user *argp) diff --git a/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6sll.patch b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6sll.patch new file mode 100644 index 00000000000..24b9e6ed93f --- /dev/null +++ b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6sll.patch @@ -0,0 +1,32 @@ +From 414a98abbefd82d591f4e2d1efd2917bcd3b6f6d Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Fri, 13 Oct 2023 13:49:02 +0100 +Subject: nvmem: imx: correct nregs for i.MX6SLL + +From: Peng Fan + +commit 414a98abbefd82d591f4e2d1efd2917bcd3b6f6d upstream. + +The nregs for i.MX6SLL should be 80 per fuse map, correct it. + +Fixes: 6da27821a6f5 ("nvmem: imx-ocotp: add support for imx6sll") +Cc: Stable@vger.kernel.org +Signed-off-by: Peng Fan +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013124904.175782-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/imx-ocotp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -506,7 +506,7 @@ static const struct ocotp_params imx6sl_ + }; + + static const struct ocotp_params imx6sll_params = { +- .nregs = 128, ++ .nregs = 80, + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, diff --git a/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ul.patch b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ul.patch new file mode 100644 index 00000000000..125fe765db9 --- /dev/null +++ b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ul.patch @@ -0,0 +1,32 @@ +From 7d6e10f5d254681983b53d979422c8de3fadbefb Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Fri, 13 Oct 2023 13:49:03 +0100 +Subject: nvmem: imx: correct nregs for i.MX6UL + +From: Peng Fan + +commit 7d6e10f5d254681983b53d979422c8de3fadbefb upstream. + +The nregs for i.MX6UL should be 144 per fuse map, correct it. + +Fixes: 4aa2b4802046 ("nvmem: octop: Add support for imx6ul") +Cc: Stable@vger.kernel.org +Signed-off-by: Peng Fan +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013124904.175782-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/imx-ocotp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -520,7 +520,7 @@ static const struct ocotp_params imx6sx_ + }; + + static const struct ocotp_params imx6ul_params = { +- .nregs = 128, ++ .nregs = 144, + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, diff --git a/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ull.patch b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ull.patch new file mode 100644 index 00000000000..7ed3a81301a --- /dev/null +++ b/queue-6.1/nvmem-imx-correct-nregs-for-i.mx6ull.patch @@ -0,0 +1,32 @@ +From 2382c1b044231fd49eaf9aa82bc7113fc55487b8 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Fri, 13 Oct 2023 13:49:04 +0100 +Subject: nvmem: imx: correct nregs for i.MX6ULL + +From: Peng Fan + +commit 2382c1b044231fd49eaf9aa82bc7113fc55487b8 upstream. + +The nregs for i.MX6ULL should be 80 per fuse map, correct it. + +Fixes: ffbc34bf0e9c ("nvmem: imx-ocotp: Implement i.MX6ULL/ULZ support") +Cc: Stable@vger.kernel.org +Signed-off-by: Peng Fan +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231013124904.175782-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/imx-ocotp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -527,7 +527,7 @@ static const struct ocotp_params imx6ul_ + }; + + static const struct ocotp_params imx6ull_params = { +- .nregs = 64, ++ .nregs = 80, + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, diff --git a/queue-6.1/perf-core-fix-potential-null-deref.patch b/queue-6.1/perf-core-fix-potential-null-deref.patch new file mode 100644 index 00000000000..b8f924edd73 --- /dev/null +++ b/queue-6.1/perf-core-fix-potential-null-deref.patch @@ -0,0 +1,32 @@ +From a71ef31485bb51b846e8db8b3a35e432cc15afb5 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Tue, 24 Oct 2023 11:42:21 +0200 +Subject: perf/core: Fix potential NULL deref + +From: Peter Zijlstra + +commit a71ef31485bb51b846e8db8b3a35e432cc15afb5 upstream. + +Smatch is awesome. + +Fixes: 32671e3799ca ("perf: Disallow mis-matched inherited group reads") +Reported-by: Dan Carpenter +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman +--- + kernel/events/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -13293,7 +13293,8 @@ static int inherit_group(struct perf_eve + !perf_get_aux_event(child_ctr, leader)) + return -EINVAL; + } +- leader->group_generation = parent_event->group_generation; ++ if (leader) ++ leader->group_generation = parent_event->group_generation; + return 0; + } + diff --git a/queue-6.1/series b/queue-6.1/series index 1453f75ce22..56bc54cc0f2 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -58,3 +58,26 @@ scsi-sd-introduce-manage_shutdown-device-flag.patch blk-throttle-check-for-overflow-in-calculate_bytes_allowed.patch kasan-print-the-original-fault-addr-when-access-invalid-shadow.patch io_uring-fdinfo-lock-sq-thread-while-retrieving-thre.patch +iio-afe-rescale-accept-only-offset-channels.patch +iio-exynos-adc-request-second-interupt-only-when-touchscreen-mode-is-used.patch +iio-adc-xilinx-xadc-don-t-clobber-preset-voltage-temperature-thresholds.patch +iio-adc-xilinx-xadc-correct-temperature-offset-scale-for-ultrascale.patch +i2c-muxes-i2c-mux-pinctrl-use-of_get_i2c_adapter_by_node.patch +i2c-muxes-i2c-mux-gpmux-use-of_get_i2c_adapter_by_node.patch +i2c-muxes-i2c-demux-pinctrl-use-of_get_i2c_adapter_by_node.patch +i2c-stm32f7-fix-pec-handling-in-case-of-smbus-transfers.patch +i2c-aspeed-fix-i2c-bus-hang-in-slave-read.patch +tracing-kprobes-fix-symbol-counting-logic-by-looking-at-modules-as-well.patch +tracing-kprobes-fix-the-description-of-variable-length-arguments.patch +misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch +misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch +misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch +misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch +nvmem-imx-correct-nregs-for-i.mx6ull.patch +nvmem-imx-correct-nregs-for-i.mx6sll.patch +nvmem-imx-correct-nregs-for-i.mx6ul.patch +x86-i8259-skip-probing-when-acpi-madt-advertises-pcat-compatibility.patch +x86-cpu-add-model-number-for-intel-arrow-lake-mobile-processor.patch +perf-core-fix-potential-null-deref.patch +sparc32-fix-a-braino-in-fault-handling-in-csum_and_copy_..._user.patch +clk-sanitize-possible_parent_show-to-handle-return-value-of-of_clk_get_parent_name.patch diff --git a/queue-6.1/sparc32-fix-a-braino-in-fault-handling-in-csum_and_copy_..._user.patch b/queue-6.1/sparc32-fix-a-braino-in-fault-handling-in-csum_and_copy_..._user.patch new file mode 100644 index 00000000000..f784cccf111 --- /dev/null +++ b/queue-6.1/sparc32-fix-a-braino-in-fault-handling-in-csum_and_copy_..._user.patch @@ -0,0 +1,45 @@ +From 1f36cd05e0081f2c75769a551d584c4ffb2a5660 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sun, 22 Oct 2023 19:34:28 -0400 +Subject: sparc32: fix a braino in fault handling in csum_and_copy_..._user() + +From: Al Viro + +commit 1f36cd05e0081f2c75769a551d584c4ffb2a5660 upstream. + +Fault handler used to make non-trivial calls, so it needed +to set a stack frame up. Used to be + save ... - grab a stack frame, old %o... become %i... + .... + ret - go back to address originally in %o7, currently %i7 + restore - switch to previous stack frame, in delay slot +Non-trivial calls had been gone since ab5e8b331244 and that code should +have become + retl - go back to address in %o7 + clr %o0 - have return value set to 0 +What it had become instead was + ret - go back to address in %i7 - return address of *caller* + clr %o0 - have return value set to 0 +which is not good, to put it mildly - we forcibly return 0 from +csum_and_copy_{from,to}_iter() (which is what the call of that +thing had been inlined into) and do that without dropping the +stack frame of said csum_and_copy_..._iter(). Confuses the +hell out of the caller of csum_and_copy_..._iter(), obviously... + +Reviewed-by: Sam Ravnborg +Fixes: ab5e8b331244 "sparc32: propagate the calling conventions change down to __csum_partial_copy_sparc_generic()" +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/lib/checksum_32.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/lib/checksum_32.S ++++ b/arch/sparc/lib/checksum_32.S +@@ -453,5 +453,5 @@ ccslow: cmp %g1, 0 + * we only bother with faults on loads... */ + + cc_fault: +- ret ++ retl + clr %o0 diff --git a/queue-6.1/tracing-kprobes-fix-symbol-counting-logic-by-looking-at-modules-as-well.patch b/queue-6.1/tracing-kprobes-fix-symbol-counting-logic-by-looking-at-modules-as-well.patch new file mode 100644 index 00000000000..2e8f4ba442f --- /dev/null +++ b/queue-6.1/tracing-kprobes-fix-symbol-counting-logic-by-looking-at-modules-as-well.patch @@ -0,0 +1,73 @@ +From 926fe783c8a64b33997fec405cf1af3e61aed441 Mon Sep 17 00:00:00 2001 +From: Andrii Nakryiko +Date: Fri, 27 Oct 2023 16:31:26 -0700 +Subject: tracing/kprobes: Fix symbol counting logic by looking at modules as well + +From: Andrii Nakryiko + +commit 926fe783c8a64b33997fec405cf1af3e61aed441 upstream. + +Recent changes to count number of matching symbols when creating +a kprobe event failed to take into account kernel modules. As such, it +breaks kprobes on kernel module symbols, by assuming there is no match. + +Fix this my calling module_kallsyms_on_each_symbol() in addition to +kallsyms_on_each_match_symbol() to perform a proper counting. + +Link: https://lore.kernel.org/all/20231027233126.2073148-1-andrii@kernel.org/ + +Cc: Francis Laniel +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Steven Rostedt +Fixes: b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols") +Signed-off-by: Andrii Nakryiko +Acked-by: Song Liu +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_kprobe.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 95c5b0668cb7..e834f149695b 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -714,14 +714,30 @@ static int count_symbols(void *data, unsigned long unused) + return 0; + } + ++struct sym_count_ctx { ++ unsigned int count; ++ const char *name; ++}; ++ ++static int count_mod_symbols(void *data, const char *name, unsigned long unused) ++{ ++ struct sym_count_ctx *ctx = data; ++ ++ if (strcmp(name, ctx->name) == 0) ++ ctx->count++; ++ ++ return 0; ++} ++ + static unsigned int number_of_same_symbols(char *func_name) + { +- unsigned int count; ++ struct sym_count_ctx ctx = { .count = 0, .name = func_name }; ++ ++ kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count); + +- count = 0; +- kallsyms_on_each_match_symbol(count_symbols, func_name, &count); ++ module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx); + +- return count; ++ return ctx.count; + } + + static int __trace_kprobe_create(int argc, const char *argv[]) +-- +2.42.0 + diff --git a/queue-6.1/tracing-kprobes-fix-the-description-of-variable-length-arguments.patch b/queue-6.1/tracing-kprobes-fix-the-description-of-variable-length-arguments.patch new file mode 100644 index 00000000000..da4cfbd0ec2 --- /dev/null +++ b/queue-6.1/tracing-kprobes-fix-the-description-of-variable-length-arguments.patch @@ -0,0 +1,51 @@ +From e0f831836cead677fb07d54bd6bf499df35640c2 Mon Sep 17 00:00:00 2001 +From: Yujie Liu +Date: Fri, 27 Oct 2023 12:13:14 +0800 +Subject: tracing/kprobes: Fix the description of variable length arguments + +From: Yujie Liu + +commit e0f831836cead677fb07d54bd6bf499df35640c2 upstream. + +Fix the following kernel-doc warnings: + +kernel/trace/trace_kprobe.c:1029: warning: Excess function parameter 'args' description in '__kprobe_event_gen_cmd_start' +kernel/trace/trace_kprobe.c:1097: warning: Excess function parameter 'args' description in '__kprobe_event_add_fields' + +Refer to the usage of variable length arguments elsewhere in the kernel +code, "@..." is the proper way to express it in the description. + +Link: https://lore.kernel.org/all/20231027041315.2613166-1-yujie.liu@intel.com/ + +Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202310190437.paI6LYJF-lkp@intel.com/ +Signed-off-by: Yujie Liu +Reviewed-by: Mukesh Ojha +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_kprobe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -1005,7 +1005,7 @@ EXPORT_SYMBOL_GPL(kprobe_event_cmd_init) + * @name: The name of the kprobe event + * @loc: The location of the kprobe event + * @kretprobe: Is this a return probe? +- * @args: Variable number of arg (pairs), one pair for each field ++ * @...: Variable number of arg (pairs), one pair for each field + * + * NOTE: Users normally won't want to call this function directly, but + * rather use the kprobe_event_gen_cmd_start() wrapper, which automatically +@@ -1078,7 +1078,7 @@ EXPORT_SYMBOL_GPL(__kprobe_event_gen_cmd + /** + * __kprobe_event_add_fields - Add probe fields to a kprobe command from arg list + * @cmd: A pointer to the dynevent_cmd struct representing the new event +- * @args: Variable number of arg (pairs), one pair for each field ++ * @...: Variable number of arg (pairs), one pair for each field + * + * NOTE: Users normally won't want to call this function directly, but + * rather use the kprobe_event_add_fields() wrapper, which diff --git a/queue-6.1/x86-cpu-add-model-number-for-intel-arrow-lake-mobile-processor.patch b/queue-6.1/x86-cpu-add-model-number-for-intel-arrow-lake-mobile-processor.patch new file mode 100644 index 00000000000..8bdd243d87a --- /dev/null +++ b/queue-6.1/x86-cpu-add-model-number-for-intel-arrow-lake-mobile-processor.patch @@ -0,0 +1,41 @@ +From b99d70c0d1380f1368fd4a82271280c4fd28558b Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Wed, 25 Oct 2023 13:25:13 -0700 +Subject: x86/cpu: Add model number for Intel Arrow Lake mobile processor + +From: Tony Luck + +commit b99d70c0d1380f1368fd4a82271280c4fd28558b upstream. + +For "reasons" Intel has code-named this CPU with a "_H" suffix. + +[ dhansen: As usual, apply this and send it upstream quickly to + make it easier for anyone who is doing work that + consumes this. ] + +Signed-off-by: Tony Luck +Signed-off-by: Dave Hansen +Link: https://lore.kernel.org/all/20231025202513.12358-1-tony.luck%40intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/intel-family.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -27,6 +27,7 @@ + * _X - regular server parts + * _D - micro server parts + * _N,_P - other mobile parts ++ * _H - premium mobile parts + * _S - other client parts + * + * Historical OPTDIFFs: +@@ -125,6 +126,7 @@ + + #define INTEL_FAM6_LUNARLAKE_M 0xBD + ++#define INTEL_FAM6_ARROWLAKE_H 0xC5 + #define INTEL_FAM6_ARROWLAKE 0xC6 + + /* "Small Core" Processors (Atom/E-Core) */ diff --git a/queue-6.1/x86-i8259-skip-probing-when-acpi-madt-advertises-pcat-compatibility.patch b/queue-6.1/x86-i8259-skip-probing-when-acpi-madt-advertises-pcat-compatibility.patch new file mode 100644 index 00000000000..b9d948ab004 --- /dev/null +++ b/queue-6.1/x86-i8259-skip-probing-when-acpi-madt-advertises-pcat-compatibility.patch @@ -0,0 +1,142 @@ +From 128b0c9781c9f2651bea163cb85e52a6c7be0f9e Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 25 Oct 2023 23:04:15 +0200 +Subject: x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility + +From: Thomas Gleixner + +commit 128b0c9781c9f2651bea163cb85e52a6c7be0f9e upstream. + +David and a few others reported that on certain newer systems some legacy +interrupts fail to work correctly. + +Debugging revealed that the BIOS of these systems leaves the legacy PIC in +uninitialized state which makes the PIC detection fail and the kernel +switches to a dummy implementation. + +Unfortunately this fallback causes quite some code to fail as it depends on +checks for the number of legacy PIC interrupts or the availability of the +real PIC. + +In theory there is no reason to use the PIC on any modern system when +IO/APIC is available, but the dependencies on the related checks cannot be +resolved trivially and on short notice. This needs lots of analysis and +rework. + +The PIC detection has been added to avoid quirky checks and force selection +of the dummy implementation all over the place, especially in VM guest +scenarios. So it's not an option to revert the relevant commit as that +would break a lot of other scenarios. + +One solution would be to try to initialize the PIC on detection fail and +retry the detection, but that puts the burden on everything which does not +have a PIC. + +Fortunately the ACPI/MADT table header has a flag field, which advertises +in bit 0 that the system is PCAT compatible, which means it has a legacy +8259 PIC. + +Evaluate that bit and if set avoid the detection routine and keep the real +PIC installed, which then gets initialized (for nothing) and makes the rest +of the code with all the dependencies work again. + +Fixes: e179f6914152 ("x86, irq, pic: Probe for legacy PIC and set legacy_pic appropriately") +Reported-by: David Lazar +Signed-off-by: Thomas Gleixner +Tested-by: David Lazar +Reviewed-by: Hans de Goede +Reviewed-by: Mario Limonciello +Cc: stable@vger.kernel.org +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218003 +Link: https://lore.kernel.org/r/875y2u5s8g.ffs@tglx +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/i8259.h | 2 ++ + arch/x86/kernel/acpi/boot.c | 3 +++ + arch/x86/kernel/i8259.c | 38 ++++++++++++++++++++++++++++++-------- + 3 files changed, 35 insertions(+), 8 deletions(-) + +--- a/arch/x86/include/asm/i8259.h ++++ b/arch/x86/include/asm/i8259.h +@@ -69,6 +69,8 @@ struct legacy_pic { + void (*make_irq)(unsigned int irq); + }; + ++void legacy_pic_pcat_compat(void); ++ + extern struct legacy_pic *legacy_pic; + extern struct legacy_pic null_legacy_pic; + +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -147,6 +147,9 @@ static int __init acpi_parse_madt(struct + pr_debug("Local APIC address 0x%08x\n", madt->address); + } + ++ if (madt->flags & ACPI_MADT_PCAT_COMPAT) ++ legacy_pic_pcat_compat(); ++ + /* ACPI 6.3 and newer support the online capable bit. */ + if (acpi_gbl_FADT.header.revision > 6 || + (acpi_gbl_FADT.header.revision == 6 && +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -32,6 +32,7 @@ + */ + static void init_8259A(int auto_eoi); + ++static bool pcat_compat __ro_after_init; + static int i8259A_auto_eoi; + DEFINE_RAW_SPINLOCK(i8259A_lock); + +@@ -301,15 +302,32 @@ static void unmask_8259A(void) + + static int probe_8259A(void) + { ++ unsigned char new_val, probe_val = ~(1 << PIC_CASCADE_IR); + unsigned long flags; +- unsigned char probe_val = ~(1 << PIC_CASCADE_IR); +- unsigned char new_val; ++ ++ /* ++ * If MADT has the PCAT_COMPAT flag set, then do not bother probing ++ * for the PIC. Some BIOSes leave the PIC uninitialized and probing ++ * fails. ++ * ++ * Right now this causes problems as quite some code depends on ++ * nr_legacy_irqs() > 0 or has_legacy_pic() == true. This is silly ++ * when the system has an IO/APIC because then PIC is not required ++ * at all, except for really old machines where the timer interrupt ++ * must be routed through the PIC. So just pretend that the PIC is ++ * there and let legacy_pic->init() initialize it for nothing. ++ * ++ * Alternatively this could just try to initialize the PIC and ++ * repeat the probe, but for cases where there is no PIC that's ++ * just pointless. ++ */ ++ if (pcat_compat) ++ return nr_legacy_irqs(); ++ + /* +- * Check to see if we have a PIC. +- * Mask all except the cascade and read +- * back the value we just wrote. If we don't +- * have a PIC, we will read 0xff as opposed to the +- * value we wrote. ++ * Check to see if we have a PIC. Mask all except the cascade and ++ * read back the value we just wrote. If we don't have a PIC, we ++ * will read 0xff as opposed to the value we wrote. + */ + raw_spin_lock_irqsave(&i8259A_lock, flags); + +@@ -431,5 +449,9 @@ static int __init i8259A_init_ops(void) + + return 0; + } +- + device_initcall(i8259A_init_ops); ++ ++void __init legacy_pic_pcat_compat(void) ++{ ++ pcat_compat = true; ++}