From: Greg Kroah-Hartman Date: Tue, 8 Apr 2025 09:22:58 +0000 (+0200) Subject: 6.14-stable patches X-Git-Tag: v5.4.292~39 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2e02196f5fbc076580856f34dc63a1edc802c08a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.14-stable patches added patches: acpi-nfit-fix-narrowing-conversion-in-acpi_nfit_ctl.patch acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch acpi-resource-skip-irq-override-on-asus-vivobook-14-x1404vap.patch acpi-video-handle-fetching-edid-as-acpi_type_package.patch arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch arm-9444-1-add-keep-keyword-to-arm_vectors.patch media-omap3isp-handle-arm-dma_iommu_mapping.patch wifi-mt76-mt7925-remove-unused-acpi-function-for-clc.patch x86-kconfig-add-cmpxchg8b-support-back-to-geode-cpus.patch x86-mm-fix-flush_tlb_range-when-used-for-zapping-normal-pmds.patch x86-tsc-always-save-restore-tsc-sched_clock-on-suspend-resume.patch --- diff --git a/queue-6.14/acpi-nfit-fix-narrowing-conversion-in-acpi_nfit_ctl.patch b/queue-6.14/acpi-nfit-fix-narrowing-conversion-in-acpi_nfit_ctl.patch new file mode 100644 index 0000000000..e701855b48 --- /dev/null +++ b/queue-6.14/acpi-nfit-fix-narrowing-conversion-in-acpi_nfit_ctl.patch @@ -0,0 +1,50 @@ +From 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f Mon Sep 17 00:00:00 2001 +From: Murad Masimov +Date: Thu, 23 Jan 2025 19:39:45 +0300 +Subject: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl + +From: Murad Masimov + +commit 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f upstream. + +Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary +bus families can be translated". This warning is emited if the argument +is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first +verifies that a user-provided value call_pkg->nd_family of type u64 is +not equal to 0. Then the value is converted to int, and only after that +is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid +argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while +the lower 32 bits are zero. + +Furthermore, it is best to return EINVAL immediately upon seeing the +invalid user input. The WARNING is insufficient to prevent further +undefined behavior based on other invalid user input. + +All checks of the input value should be applied to the original variable +call_pkg->nd_family. + +[iweiny: update commit message] + +Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands") +Cc: stable@vger.kernel.org +Reported-by: syzbot+c80d8dc0d9fa81a3cd8c@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=c80d8dc0d9fa81a3cd8c +Signed-off-by: Murad Masimov +Link: https://patch.msgid.link/20250123163945.251-1-m.masimov@mt-integration.ru +Signed-off-by: Ira Weiny +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + cmd_mask = nd_desc->cmd_mask; + if (cmd == ND_CMD_CALL && call_pkg->nd_family) { + family = call_pkg->nd_family; +- if (family > NVDIMM_BUS_FAMILY_MAX || ++ if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX || + !test_bit(family, &nd_desc->bus_family_mask)) + return -EINVAL; + family = array_index_nospec(family, diff --git a/queue-6.14/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch b/queue-6.14/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch new file mode 100644 index 0000000000..b30c103aed --- /dev/null +++ b/queue-6.14/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch @@ -0,0 +1,125 @@ +From dd4f730b557ce701a2cd4f604bf1e57667bd8b6e Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 10 Feb 2025 21:28:25 -0500 +Subject: ACPI: platform-profile: Fix CFI violation when accessing sysfs files + +From: Nathan Chancellor + +commit dd4f730b557ce701a2cd4f604bf1e57667bd8b6e upstream. + +When an attribute group is created with sysfs_create_group(), the +->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() +and ->store() callbacks to kobj_attr_show() and kobj_attr_store() +respectively. These functions use container_of() to get the respective +callback from the passed attribute, meaning that these callbacks need to +be of the same type as the callbacks in 'struct kobj_attribute'. + +However, ->show() and ->store() in the platform_profile driver are +defined for struct device_attribute with the help of DEVICE_ATTR_RO() +and DEVICE_ATTR_RW(), which results in a CFI violation when accessing +platform_profile or platform_profile_choices under /sys/firmware/acpi +because the types do not match: + + CFI failure at kobj_attr_show+0x19/0x30 (target: platform_profile_choices_show+0x0/0x140; expected type: 0x7a69590c) + +There is no functional issue from the type mismatch because the layout +of 'struct kobj_attribute' and 'struct device_attribute' are the same, +so the container_of() cast does not break anything aside from CFI. + +Change the type of platform_profile_choices_show() and +platform_profile_{show,store}() to match the callbacks in +'struct kobj_attribute' and update the attribute variables to +match, which resolves the CFI violation. + +Cc: All applicable +Fixes: a2ff95e018f1 ("ACPI: platform: Add platform profile support") +Reported-by: John Rowley +Closes: https://github.com/ClangBuiltLinux/linux/issues/2047 +Tested-by: John Rowley +Reviewed-by: Sami Tolvanen +Signed-off-by: Nathan Chancellor +Acked-by: Greg Kroah-Hartman +Reviewed-by: Mark Pearson +Tested-by: Mark Pearson +Link: https://patch.msgid.link/20250210-acpi-platform_profile-fix-cfi-violation-v3-1-ed9e9901c33a@kernel.org +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/platform_profile.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +--- a/drivers/acpi/platform_profile.c ++++ b/drivers/acpi/platform_profile.c +@@ -289,14 +289,14 @@ static int _remove_hidden_choices(struct + + /** + * platform_profile_choices_show - Show the available profile choices for legacy sysfs interface +- * @dev: The device ++ * @kobj: The kobject + * @attr: The attribute + * @buf: The buffer to write to + * + * Return: The number of bytes written + */ +-static ssize_t platform_profile_choices_show(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_choices_show(struct kobject *kobj, ++ struct kobj_attribute *attr, + char *buf) + { + struct aggregate_choices_data data = { +@@ -371,14 +371,14 @@ static int _store_and_notify(struct devi + + /** + * platform_profile_show - Show the current profile for legacy sysfs interface +- * @dev: The device ++ * @kobj: The kobject + * @attr: The attribute + * @buf: The buffer to write to + * + * Return: The number of bytes written + */ +-static ssize_t platform_profile_show(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_show(struct kobject *kobj, ++ struct kobj_attribute *attr, + char *buf) + { + enum platform_profile_option profile = PLATFORM_PROFILE_LAST; +@@ -400,15 +400,15 @@ static ssize_t platform_profile_show(str + + /** + * platform_profile_store - Set the profile for legacy sysfs interface +- * @dev: The device ++ * @kobj: The kobject + * @attr: The attribute + * @buf: The buffer to read from + * @count: The number of bytes to read + * + * Return: The number of bytes read + */ +-static ssize_t platform_profile_store(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_store(struct kobject *kobj, ++ struct kobj_attribute *attr, + const char *buf, size_t count) + { + struct aggregate_choices_data data = { +@@ -442,12 +442,12 @@ static ssize_t platform_profile_store(st + return count; + } + +-static DEVICE_ATTR_RO(platform_profile_choices); +-static DEVICE_ATTR_RW(platform_profile); ++static struct kobj_attribute attr_platform_profile_choices = __ATTR_RO(platform_profile_choices); ++static struct kobj_attribute attr_platform_profile = __ATTR_RW(platform_profile); + + static struct attribute *platform_profile_attrs[] = { +- &dev_attr_platform_profile_choices.attr, +- &dev_attr_platform_profile.attr, ++ &attr_platform_profile_choices.attr, ++ &attr_platform_profile.attr, + NULL + }; + diff --git a/queue-6.14/acpi-resource-skip-irq-override-on-asus-vivobook-14-x1404vap.patch b/queue-6.14/acpi-resource-skip-irq-override-on-asus-vivobook-14-x1404vap.patch new file mode 100644 index 0000000000..c1dbdc76bb --- /dev/null +++ b/queue-6.14/acpi-resource-skip-irq-override-on-asus-vivobook-14-x1404vap.patch @@ -0,0 +1,57 @@ +From 2da31ea2a085cd189857f2db0f7b78d0162db87a Mon Sep 17 00:00:00 2001 +From: Paul Menzel +Date: Tue, 18 Mar 2025 17:09:02 +0100 +Subject: ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Menzel + +commit 2da31ea2a085cd189857f2db0f7b78d0162db87a upstream. + +Like the ASUS Vivobook X1504VAP and Vivobook X1704VAP, the ASUS Vivobook 14 +X1404VAP has its keyboard IRQ (1) described as ActiveLow in the DSDT, which +the kernel overrides to EdgeHigh breaking the keyboard. + + $ sudo dmidecode + […] + System Information + Manufacturer: ASUSTeK COMPUTER INC. + Product Name: ASUS Vivobook 14 X1404VAP_X1404VA + […] + $ grep -A 30 PS2K dsdt.dsl | grep IRQ -A 1 + IRQ (Level, ActiveLow, Exclusive, ) + {1} + +Add the X1404VAP to the irq1_level_low_skip_override[] quirk table to fix +this. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219224 +Cc: All applicable +Signed-off-by: Paul Menzel +Reviewed-by: Hans de Goede +Tested-by: Anton Shyndin +Link: https://patch.msgid.link/20250318160903.77107-1-pmenzel@molgen.mpg.de +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -441,6 +441,13 @@ static const struct dmi_system_id irq1_l + }, + }, + { ++ /* Asus Vivobook X1404VAP */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "X1404VAP"), ++ }, ++ }, ++ { + /* Asus Vivobook X1504VAP */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), diff --git a/queue-6.14/acpi-video-handle-fetching-edid-as-acpi_type_package.patch b/queue-6.14/acpi-video-handle-fetching-edid-as-acpi_type_package.patch new file mode 100644 index 0000000000..b3efce2106 --- /dev/null +++ b/queue-6.14/acpi-video-handle-fetching-edid-as-acpi_type_package.patch @@ -0,0 +1,91 @@ +From ebca08fef88febdb0a898cefa7c99b9e25b3a984 Mon Sep 17 00:00:00 2001 +From: Gergo Koteles +Date: Fri, 28 Mar 2025 22:08:56 +0100 +Subject: ACPI: video: Handle fetching EDID as ACPI_TYPE_PACKAGE + +From: Gergo Koteles + +commit ebca08fef88febdb0a898cefa7c99b9e25b3a984 upstream. + +The _DDC method should return a buffer, or an integer in case of an error. +But some Lenovo laptops incorrectly return EDID as buffer in ACPI package. + +Calling _DDC generates this ACPI Warning: +ACPI Warning: \_SB.PCI0.GP17.VGA.LCD._DDC: Return type mismatch - \ +found Package, expected Integer/Buffer (20240827/nspredef-254) + +Use the first element of the package to get the EDID buffer. + +The DSDT: + +Name (AUOP, Package (0x01) +{ + Buffer (0x80) + { + ... + } +}) + +... + +Method (_DDC, 1, NotSerialized) // _DDC: Display Data Current +{ + If ((PAID == AUID)) + { + Return (AUOP) /* \_SB_.PCI0.GP17.VGA_.LCD_.AUOP */ + } + ElseIf ((PAID == IVID)) + { + Return (IVOP) /* \_SB_.PCI0.GP17.VGA_.LCD_.IVOP */ + } + ElseIf ((PAID == BOID)) + { + Return (BOEP) /* \_SB_.PCI0.GP17.VGA_.LCD_.BOEP */ + } + ElseIf ((PAID == SAID)) + { + Return (SUNG) /* \_SB_.PCI0.GP17.VGA_.LCD_.SUNG */ + } + + Return (Zero) +} + +Link: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/Apx_B_Video_Extensions/output-device-specific-methods.html#ddc-return-the-edid-for-this-device +Cc: stable@vger.kernel.org +Fixes: c6a837088bed ("drm/amd/display: Fetch the EDID from _DDC if available for eDP") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4085 +Signed-off-by: Gergo Koteles +Reviewed-by: Hans de Goede +Reviewed-by: Mario Limonciello +Link: https://patch.msgid.link/61c3df83ab73aba0bc7a941a443cd7faf4cf7fb0.1743195250.git.soyer@irl.hu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_video.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -648,6 +648,13 @@ acpi_video_device_EDID(struct acpi_video + + obj = buffer.pointer; + ++ /* ++ * Some buggy implementations incorrectly return the EDID buffer in an ACPI package. ++ * In this case, extract the buffer from the package. ++ */ ++ if (obj && obj->type == ACPI_TYPE_PACKAGE && obj->package.count == 1) ++ obj = &obj->package.elements[0]; ++ + if (obj && obj->type == ACPI_TYPE_BUFFER) { + *edid = kmemdup(obj->buffer.pointer, obj->buffer.length, GFP_KERNEL); + ret = *edid ? obj->buffer.length : -ENOMEM; +@@ -657,7 +664,7 @@ acpi_video_device_EDID(struct acpi_video + ret = -EFAULT; + } + +- kfree(obj); ++ kfree(buffer.pointer); + return ret; + } + diff --git a/queue-6.14/arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch b/queue-6.14/arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch new file mode 100644 index 0000000000..acfad7cecd --- /dev/null +++ b/queue-6.14/arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch @@ -0,0 +1,71 @@ +From e7607f7d6d81af71dcc5171278aadccc94d277cd Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 20 Mar 2025 22:33:49 +0100 +Subject: ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE + +From: Nathan Chancellor + +commit e7607f7d6d81af71dcc5171278aadccc94d277cd upstream. + +ld.lld prior to 21.0.0 does not support using the KEEP keyword within an +overlay description, which may be needed to avoid discarding necessary +sections within an overlay with '--gc-sections', which can be enabled +for the kernel via CONFIG_LD_DEAD_CODE_DATA_ELIMINATION. + +Disallow CONFIG_LD_DEAD_CODE_DATA_ELIMINATION without support for KEEP +within OVERLAY and introduce a macro, OVERLAY_KEEP, that can be used to +conditionally add KEEP when it is properly supported to avoid breaking +old versions of ld.lld. + +Cc: stable@vger.kernel.org +Link: https://github.com/llvm/llvm-project/commit/381599f1fe973afad3094e55ec99b1620dba7d8c +Reviewed-by: Linus Walleij +Signed-off-by: Nathan Chancellor +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/Kconfig | 2 +- + arch/arm/include/asm/vmlinux.lds.h | 6 ++++++ + init/Kconfig | 5 +++++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -121,7 +121,7 @@ config ARM + select HAVE_KERNEL_XZ + select HAVE_KPROBES if !XIP_KERNEL && !CPU_ENDIAN_BE32 && !CPU_V7M + select HAVE_KRETPROBES if HAVE_KPROBES +- select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_IS_LLD) ++ select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_CAN_USE_KEEP_IN_OVERLAY) + select HAVE_MOD_ARCH_SPECIFIC + select HAVE_NMI + select HAVE_OPTPROBES if !THUMB2_KERNEL +--- a/arch/arm/include/asm/vmlinux.lds.h ++++ b/arch/arm/include/asm/vmlinux.lds.h +@@ -34,6 +34,12 @@ + #define NOCROSSREFS + #endif + ++#ifdef CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY ++#define OVERLAY_KEEP(x) KEEP(x) ++#else ++#define OVERLAY_KEEP(x) x ++#endif ++ + /* Set start/end symbol names to the LMA for the section */ + #define ARM_LMA(sym, section) \ + sym##_start = LOADADDR(section); \ +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -129,6 +129,11 @@ config CC_HAS_COUNTED_BY + # https://github.com/llvm/llvm-project/pull/112636 + depends on !(CC_IS_CLANG && CLANG_VERSION < 190103) + ++config LD_CAN_USE_KEEP_IN_OVERLAY ++ # ld.lld prior to 21.0.0 did not support KEEP within an overlay description ++ # https://github.com/llvm/llvm-project/pull/130661 ++ def_bool LD_IS_BFD || LLD_VERSION >= 210000 ++ + config RUSTC_HAS_COERCE_POINTEE + def_bool RUSTC_VERSION >= 108400 + diff --git a/queue-6.14/arm-9444-1-add-keep-keyword-to-arm_vectors.patch b/queue-6.14/arm-9444-1-add-keep-keyword-to-arm_vectors.patch new file mode 100644 index 0000000000..e971473fc8 --- /dev/null +++ b/queue-6.14/arm-9444-1-add-keep-keyword-to-arm_vectors.patch @@ -0,0 +1,48 @@ +From c3d944a367c0d9e4e125c7006e52f352e75776dc Mon Sep 17 00:00:00 2001 +From: Christian Eggers +Date: Thu, 20 Mar 2025 22:33:51 +0100 +Subject: ARM: 9444/1: add KEEP() keyword to ARM_VECTORS + +From: Christian Eggers + +commit c3d944a367c0d9e4e125c7006e52f352e75776dc upstream. + +Without this, the vectors are removed if LD_DEAD_CODE_DATA_ELIMINATION +is enabled. At startup, the CPU (silently) hangs in the undefined +instruction exception as soon as the first timer interrupt arrives. + +On my setup, the system also boots fine without the 2nd and 3rd KEEP() +statements, so I cannot tell whether these are actually required. + +[nathan: Use OVERLAY_KEEP() to avoid breaking old ld.lld versions] + +Cc: stable@vger.kernel.org +Fixes: ed0f94102251 ("ARM: 9404/1: arm32: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION") +Signed-off-by: Christian Eggers +Reviewed-by: Linus Walleij +Signed-off-by: Nathan Chancellor +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/vmlinux.lds.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm/include/asm/vmlinux.lds.h ++++ b/arch/arm/include/asm/vmlinux.lds.h +@@ -131,13 +131,13 @@ + __vectors_lma = .; \ + OVERLAY 0xffff0000 : NOCROSSREFS AT(__vectors_lma) { \ + .vectors { \ +- *(.vectors) \ ++ OVERLAY_KEEP(*(.vectors)) \ + } \ + .vectors.bhb.loop8 { \ +- *(.vectors.bhb.loop8) \ ++ OVERLAY_KEEP(*(.vectors.bhb.loop8)) \ + } \ + .vectors.bhb.bpiall { \ +- *(.vectors.bhb.bpiall) \ ++ OVERLAY_KEEP(*(.vectors.bhb.bpiall)) \ + } \ + } \ + ARM_LMA(__vectors, .vectors); \ diff --git a/queue-6.14/media-omap3isp-handle-arm-dma_iommu_mapping.patch b/queue-6.14/media-omap3isp-handle-arm-dma_iommu_mapping.patch new file mode 100644 index 0000000000..70dc477a1a --- /dev/null +++ b/queue-6.14/media-omap3isp-handle-arm-dma_iommu_mapping.patch @@ -0,0 +1,41 @@ +From 6bc076eec6f85f778f33a8242b438e1bd9fcdd59 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Mon, 28 Oct 2024 17:58:36 +0000 +Subject: media: omap3isp: Handle ARM dma_iommu_mapping + +From: Robin Murphy + +commit 6bc076eec6f85f778f33a8242b438e1bd9fcdd59 upstream. + +It's no longer practical for the OMAP IOMMU driver to trick +arm_setup_iommu_dma_ops() into ignoring its presence, so let's use the +same tactic as other IOMMU API users on 32-bit ARM and explicitly kick +the arch code's dma_iommu_mapping out of the way to avoid problems. + +Fixes: 4720287c7bf7 ("iommu: Remove struct iommu_ops *iommu from arch_setup_dma_ops()") +Cc: stable@vger.kernel.org +Signed-off-by: Robin Murphy +Tested-by: Sicelo A. Mhlongo +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/ti/omap3isp/isp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/platform/ti/omap3isp/isp.c ++++ b/drivers/media/platform/ti/omap3isp/isp.c +@@ -1961,6 +1961,13 @@ static int isp_attach_iommu(struct isp_d + struct dma_iommu_mapping *mapping; + int ret; + ++ /* We always want to replace any default mapping from the arch code */ ++ mapping = to_dma_iommu_mapping(isp->dev); ++ if (mapping) { ++ arm_iommu_detach_device(isp->dev); ++ arm_iommu_release_mapping(mapping); ++ } ++ + /* + * Create the ARM mapping, used by the ARM DMA mapping core to allocate + * VAs. This will allocate a corresponding IOMMU domain. diff --git a/queue-6.14/series b/queue-6.14/series index 4ce5b24d6e..af625b34bd 100644 --- a/queue-6.14/series +++ b/queue-6.14/series @@ -679,3 +679,14 @@ perf-x86-intel-apply-static-call-for-drain_pebs.patch perf-x86-intel-avoid-disable-pmu-if-cpuc-enabled-in-sample-read.patch uprobes-x86-harden-uretprobe-syscall-trampoline-check.patch bcachefs-bch2_ioctl_subvolume_destroy-fixes.patch +x86-kconfig-add-cmpxchg8b-support-back-to-geode-cpus.patch +x86-tsc-always-save-restore-tsc-sched_clock-on-suspend-resume.patch +x86-mm-fix-flush_tlb_range-when-used-for-zapping-normal-pmds.patch +acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch +wifi-mt76-mt7925-remove-unused-acpi-function-for-clc.patch +acpi-nfit-fix-narrowing-conversion-in-acpi_nfit_ctl.patch +acpi-resource-skip-irq-override-on-asus-vivobook-14-x1404vap.patch +acpi-video-handle-fetching-edid-as-acpi_type_package.patch +arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch +arm-9444-1-add-keep-keyword-to-arm_vectors.patch +media-omap3isp-handle-arm-dma_iommu_mapping.patch diff --git a/queue-6.14/wifi-mt76-mt7925-remove-unused-acpi-function-for-clc.patch b/queue-6.14/wifi-mt76-mt7925-remove-unused-acpi-function-for-clc.patch new file mode 100644 index 0000000000..e9fb8e2e3d --- /dev/null +++ b/queue-6.14/wifi-mt76-mt7925-remove-unused-acpi-function-for-clc.patch @@ -0,0 +1,33 @@ +From b4ea6fdfc08375aae59c7e7059653b9877171fe4 Mon Sep 17 00:00:00 2001 +From: Ming Yen Hsieh +Date: Tue, 4 Mar 2025 19:36:47 +0800 +Subject: wifi: mt76: mt7925: remove unused acpi function for clc + +From: Ming Yen Hsieh + +commit b4ea6fdfc08375aae59c7e7059653b9877171fe4 upstream. + +The code for handling ACPI configuration in CLC was copied from the mt7921 +driver but is not utilized in the mt7925 implementation. So removes the +unused functionality to clean up the codebase. + +Cc: stable@vger.kernel.org +Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") +Signed-off-by: Ming Yen Hsieh +Link: https://patch.msgid.link/20250304113649.867387-4-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -3155,7 +3155,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev * + + .idx = idx, + .env = env_cap, +- .acpi_conf = mt792x_acpi_get_flags(&dev->phy), + }; + int ret, valid_cnt = 0; + u8 i, *pos; diff --git a/queue-6.14/x86-kconfig-add-cmpxchg8b-support-back-to-geode-cpus.patch b/queue-6.14/x86-kconfig-add-cmpxchg8b-support-back-to-geode-cpus.patch new file mode 100644 index 0000000000..23122710c6 --- /dev/null +++ b/queue-6.14/x86-kconfig-add-cmpxchg8b-support-back-to-geode-cpus.patch @@ -0,0 +1,34 @@ +From 6ac43f2be982ea54b75206dccd33f4cf81bfdc39 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 26 Feb 2025 22:37:05 +0100 +Subject: x86/Kconfig: Add cmpxchg8b support back to Geode CPUs + +From: Arnd Bergmann + +commit 6ac43f2be982ea54b75206dccd33f4cf81bfdc39 upstream. + +An older cleanup of mine inadvertently removed geode-gx1 and geode-lx +from the list of CPUs that are known to support a working cmpxchg8b. + +Fixes: 88a2b4edda3d ("x86/Kconfig: Rework CONFIG_X86_PAE dependency") +Signed-off-by: Arnd Bergmann +Signed-off-by: Ingo Molnar +Cc: Linus Torvalds +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250226213714.4040853-2-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/Kconfig.cpu | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/Kconfig.cpu ++++ b/arch/x86/Kconfig.cpu +@@ -368,7 +368,7 @@ config X86_HAVE_PAE + + config X86_CMPXCHG64 + def_bool y +- depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 ++ depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 || MGEODEGX1 || MGEODE_LX + + # this should be set for all -march=.. options where the compiler + # generates cmov. diff --git a/queue-6.14/x86-mm-fix-flush_tlb_range-when-used-for-zapping-normal-pmds.patch b/queue-6.14/x86-mm-fix-flush_tlb_range-when-used-for-zapping-normal-pmds.patch new file mode 100644 index 0000000000..743b1b3be6 --- /dev/null +++ b/queue-6.14/x86-mm-fix-flush_tlb_range-when-used-for-zapping-normal-pmds.patch @@ -0,0 +1,55 @@ +From 3ef938c3503563bfc2ac15083557f880d29c2e64 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Fri, 3 Jan 2025 19:39:38 +0100 +Subject: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs + +From: Jann Horn + +commit 3ef938c3503563bfc2ac15083557f880d29c2e64 upstream. + +On the following path, flush_tlb_range() can be used for zapping normal +PMD entries (PMD entries that point to page tables) together with the PTE +entries in the pointed-to page table: + + collapse_pte_mapped_thp + pmdp_collapse_flush + flush_tlb_range + +The arm64 version of flush_tlb_range() has a comment describing that it can +be used for page table removal, and does not use any last-level +invalidation optimizations. Fix the X86 version by making it behave the +same way. + +Currently, X86 only uses this information for the following two purposes, +which I think means the issue doesn't have much impact: + + - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be + IPI'd to avoid issues with speculative page table walks. + - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. + +The patch "x86/mm: only invalidate final translations with INVLPGB" which +is currently under review (see +) +would probably be making the impact of this a lot worse. + +Fixes: 016c4d92cd16 ("x86/mm/tlb: Add freed_tables argument to flush_tlb_mm_range") +Signed-off-by: Jann Horn +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20250103-x86-collapse-flush-fix-v1-1-3c521856cfa6@google.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/tlbflush.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -242,7 +242,7 @@ void flush_tlb_multi(const struct cpumas + flush_tlb_mm_range((vma)->vm_mm, start, end, \ + ((vma)->vm_flags & VM_HUGETLB) \ + ? huge_page_shift(hstate_vma(vma)) \ +- : PAGE_SHIFT, false) ++ : PAGE_SHIFT, true) + + extern void flush_tlb_all(void); + extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, diff --git a/queue-6.14/x86-tsc-always-save-restore-tsc-sched_clock-on-suspend-resume.patch b/queue-6.14/x86-tsc-always-save-restore-tsc-sched_clock-on-suspend-resume.patch new file mode 100644 index 0000000000..7c9aeb0bc9 --- /dev/null +++ b/queue-6.14/x86-tsc-always-save-restore-tsc-sched_clock-on-suspend-resume.patch @@ -0,0 +1,73 @@ +From d90c9de9de2f1712df56de6e4f7d6982d358cabe Mon Sep 17 00:00:00 2001 +From: "Guilherme G. Piccoli" +Date: Sat, 15 Feb 2025 17:58:16 -0300 +Subject: x86/tsc: Always save/restore TSC sched_clock() on suspend/resume + +From: Guilherme G. Piccoli + +commit d90c9de9de2f1712df56de6e4f7d6982d358cabe upstream. + +TSC could be reset in deep ACPI sleep states, even with invariant TSC. + +That's the reason we have sched_clock() save/restore functions, to deal +with this situation. But what happens is that such functions are guarded +with a check for the stability of sched_clock - if not considered stable, +the save/restore routines aren't executed. + +On top of that, we have a clear comment in native_sched_clock() saying +that *even* with TSC unstable, we continue using TSC for sched_clock due +to its speed. + +In other words, if we have a situation of TSC getting detected as unstable, +it marks the sched_clock as unstable as well, so subsequent S3 sleep cycles +could bring bogus sched_clock values due to the lack of the save/restore +mechanism, causing warnings like this: + + [22.954918] ------------[ cut here ]------------ + [22.954923] Delta way too big! 18446743750843854390 ts=18446744072977390405 before=322133536015 after=322133536015 write stamp=18446744072977390405 + [22.954923] If you just came from a suspend/resume, + [22.954923] please switch to the trace global clock: + [22.954923] echo global > /sys/kernel/tracing/trace_clock + [22.954923] or add trace_clock=global to the kernel command line + [22.954937] WARNING: CPU: 2 PID: 5728 at kernel/trace/ring_buffer.c:2890 rb_add_timestamp+0x193/0x1c0 + +Notice that the above was reproduced even with "trace_clock=global". + +The fix for that is to _always_ save/restore the sched_clock on suspend +cycle _if TSC is used_ as sched_clock - only if we fallback to jiffies +the sched_clock_stable() check becomes relevant to save/restore the +sched_clock. + +Debugged-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Guilherme G. Piccoli +Signed-off-by: Ingo Molnar +Cc: stable@vger.kernel.org +Cc: Thomas Gleixner +Cc: Peter Zijlstra +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250215210314.351480-1-gpiccoli@igalia.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/tsc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -959,7 +959,7 @@ static unsigned long long cyc2ns_suspend + + void tsc_save_sched_clock_state(void) + { +- if (!sched_clock_stable()) ++ if (!static_branch_likely(&__use_tsc) && !sched_clock_stable()) + return; + + cyc2ns_suspend = sched_clock(); +@@ -979,7 +979,7 @@ void tsc_restore_sched_clock_state(void) + unsigned long flags; + int cpu; + +- if (!sched_clock_stable()) ++ if (!static_branch_likely(&__use_tsc) && !sched_clock_stable()) + return; + + local_irq_save(flags);