From: Sasha Levin Date: Wed, 7 May 2025 15:36:17 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.15.182~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9fdc8c0cc0592b33026374b932f770f1f7642506;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm64-dts-rockchip-fix-iface-clock-name-on-px30-iomm.patch b/queue-5.4/arm64-dts-rockchip-fix-iface-clock-name-on-px30-iomm.patch new file mode 100644 index 0000000000..105f8c92a4 --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-fix-iface-clock-name-on-px30-iomm.patch @@ -0,0 +1,45 @@ +From 935138f6a4616e7ec9e257f5ab294549a5a581ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2019 10:26:47 +0200 +Subject: arm64: dts: rockchip: fix iface clock-name on px30 iommus + +From: Heiko Stuebner + +[ Upstream commit 8e57eed2047b9361deb8c5dc4cc3d4e679c5ce50 ] + +The iommu clock names are aclk+iface not aclk+hclk as in the vendor kernel, +so fix that in the px30.dtsi + +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20190917082659.25549-1-heiko@sntech.de +Stable-dep-of: 8dee308e4c01 ("iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi +index 652998c836406..aff72ebfc68d0 100644 +--- a/arch/arm64/boot/dts/rockchip/px30.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi +@@ -839,7 +839,7 @@ + interrupts = ; + interrupt-names = "vopb_mmu"; + clocks = <&cru ACLK_VOPB>, <&cru HCLK_VOPB>; +- clock-names = "aclk", "hclk"; ++ clock-names = "aclk", "iface"; + power-domains = <&power PX30_PD_VO>; + #iommu-cells = <0>; + status = "disabled"; +@@ -871,7 +871,7 @@ + interrupts = ; + interrupt-names = "vopl_mmu"; + clocks = <&cru ACLK_VOPL>, <&cru HCLK_VOPL>; +- clock-names = "aclk", "hclk"; ++ clock-names = "aclk", "iface"; + power-domains = <&power PX30_PD_VO>; + #iommu-cells = <0>; + status = "disabled"; +-- +2.39.5 + diff --git a/queue-5.4/cpufreq-intel_pstate-fold-intel_pstate_max_within_li.patch b/queue-5.4/cpufreq-intel_pstate-fold-intel_pstate_max_within_li.patch new file mode 100644 index 0000000000..623402f18e --- /dev/null +++ b/queue-5.4/cpufreq-intel_pstate-fold-intel_pstate_max_within_li.patch @@ -0,0 +1,61 @@ +From 540f1c0954a14a97077fd906cfe6bf8cc0aebe64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 18:01:58 +0100 +Subject: cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into + caller + +From: Rafael J. Wysocki + +[ Upstream commit 032c5565eb80edb6f2faeb31939540c897987119 ] + +Fold intel_pstate_max_within_limits() into its only caller. + +No functional impact. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Srinivas Pandruvada +Stable-dep-of: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 764ecccdfa8ad..28a038b2189f7 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1537,14 +1537,6 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu) + intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate); + } + +-static void intel_pstate_max_within_limits(struct cpudata *cpu) +-{ +- int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio); +- +- update_turbo_state(); +- intel_pstate_set_pstate(cpu, pstate); +-} +- + static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) + { + cpu->pstate.min_pstate = pstate_funcs.get_min(); +@@ -2107,12 +2099,15 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy) + intel_pstate_update_perf_limits(cpu, policy->min, policy->max); + + if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) { ++ int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio); ++ + /* + * NOHZ_FULL CPUs need this as the governor callback may not + * be invoked on them. + */ + intel_pstate_clear_update_util_hook(policy->cpu); +- intel_pstate_max_within_limits(cpu); ++ update_turbo_state(); ++ intel_pstate_set_pstate(cpu, pstate); + } else { + intel_pstate_set_update_util_hook(policy->cpu); + } +-- +2.39.5 + diff --git a/queue-5.4/cpufreq-intel_pstate-revise-global-turbo-disable-che.patch b/queue-5.4/cpufreq-intel_pstate-revise-global-turbo-disable-che.patch new file mode 100644 index 0000000000..c32e8ba883 --- /dev/null +++ b/queue-5.4/cpufreq-intel_pstate-revise-global-turbo-disable-che.patch @@ -0,0 +1,69 @@ +From 36a552f2cc890b0b6ae0d97e1a8eb1c4a8cc1cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Sep 2023 11:02:07 -0700 +Subject: cpufreq: intel_pstate: Revise global turbo disable check + +From: Srinivas Pandruvada + +[ Upstream commit 37b6ddba967c601479bea418a7ac6ff16b6232b7 ] + +Setting global turbo flag based on CPU 0 P-state limits is problematic +as it limits max P-state request on every CPU on the system just based +on its P-state limits. + +There are two cases in which global.turbo_disabled flag is set: +- When the MSR_IA32_MISC_ENABLE_TURBO_DISABLE bit is set to 1 +in the MSR MSR_IA32_MISC_ENABLE. This bit can be only changed by +the system BIOS before power up. +- When the max non turbo P-state is same as max turbo P-state for CPU 0. + +The second check is not a valid to decide global turbo state based on +the CPU 0. CPU 0 max turbo P-state can be same as max non turbo P-state, +but for other CPUs this may not be true. + +There is no guarantee that max P-state limits are same for every CPU. This +is possible that during fusing max P-state for a CPU is constrained. Also +with the Intel Speed Select performance profile, CPU 0 may not be present +in all profiles. In this case the max non turbo and turbo P-state can be +set to the lowest possible P-state by the hardware when switched to +such profile. Since max non turbo and turbo P-state is same, +global.turbo_disabled flag will be set. + +Once global.turbo_disabled is set, any scaling max and min frequency +update for any CPU will result in its max P-state constrained to the max +non turbo P-state. + +Hence remove the check of max non turbo P-state equal to max turbo P-state +of CPU 0 to set global turbo disabled flag. + +Signed-off-by: Srinivas Pandruvada +[ rjw: Subject edit ] +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 06302eaa3e942..764ecccdfa8ad 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -487,13 +487,9 @@ static int intel_pstate_get_cppc_guranteed(int cpu) + static inline void update_turbo_state(void) + { + u64 misc_en; +- struct cpudata *cpu; + +- cpu = all_cpu_data[0]; + rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); +- global.turbo_disabled = +- (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || +- cpu->pstate.max_pstate == cpu->pstate.turbo_pstate); ++ global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE; + } + + static int min_perf_pct_min(void) +-- +2.39.5 + diff --git a/queue-5.4/cpufreq-intel_pstate-unchecked-msr-aceess-in-legacy-.patch b/queue-5.4/cpufreq-intel_pstate-unchecked-msr-aceess-in-legacy-.patch new file mode 100644 index 0000000000..51a838a0d4 --- /dev/null +++ b/queue-5.4/cpufreq-intel_pstate-unchecked-msr-aceess-in-legacy-.patch @@ -0,0 +1,65 @@ +From 2a8823c91429672fd1e5242c38c8389bdeca9299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 14:07:11 -0700 +Subject: cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode + +From: Srinivas Pandruvada + +[ Upstream commit ac4e04d9e378f5aa826c2406ad7871ae1b6a6fb9 ] + +When turbo mode is unavailable on a Skylake-X system, executing the +command: + + # echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo + +results in an unchecked MSR access error: + + WRMSR to 0x199 (attempted to write 0x0000000100001300). + +This issue was reproduced on an OEM (Original Equipment Manufacturer) +system and is not a common problem across all Skylake-X systems. + +This error occurs because the MSR 0x199 Turbo Engage Bit (bit 32) is set +when turbo mode is disabled. The issue arises when intel_pstate fails to +detect that turbo mode is disabled. Here intel_pstate relies on +MSR_IA32_MISC_ENABLE bit 38 to determine the status of turbo mode. +However, on this system, bit 38 is not set even when turbo mode is +disabled. + +According to the Intel Software Developer's Manual (SDM), the BIOS sets +this bit during platform initialization to enable or disable +opportunistic processor performance operations. Logically, this bit +should be set in such cases. However, the SDM also specifies that "OS +and applications must use CPUID leaf 06H to detect processors with +opportunistic processor performance operations enabled." + +Therefore, in addition to checking MSR_IA32_MISC_ENABLE bit 38, verify +that CPUID.06H:EAX[1] is 0 to accurately determine if turbo mode is +disabled. + +Fixes: 4521e1a0ce17 ("cpufreq: intel_pstate: Reflect current no_turbo state correctly") +Signed-off-by: Srinivas Pandruvada +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 28a038b2189f7..89e96d2da06c3 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -488,6 +488,9 @@ static inline void update_turbo_state(void) + { + u64 misc_en; + ++ if (!cpu_feature_enabled(X86_FEATURE_IDA)) ++ return true; ++ + rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); + global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE; + } +-- +2.39.5 + diff --git a/queue-5.4/iommu-amd-fix-potential-buffer-overflow-in-parse_ivr.patch b/queue-5.4/iommu-amd-fix-potential-buffer-overflow-in-parse_ivr.patch new file mode 100644 index 0000000000..c03856d512 --- /dev/null +++ b/queue-5.4/iommu-amd-fix-potential-buffer-overflow-in-parse_ivr.patch @@ -0,0 +1,57 @@ +From 3ba3375e305e72d05d030dcaa63a7d7eea2f403f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Mar 2025 09:22:44 +0000 +Subject: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid + +From: Pavel Paklov + +[ Upstream commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c ] + +There is a string parsing logic error which can lead to an overflow of hid +or uid buffers. Comparing ACPIID_LEN against a total string length doesn't +take into account the lengths of individual hid and uid buffers so the +check is insufficient in some cases. For example if the length of hid +string is 4 and the length of the uid string is 260, the length of str +will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer +which size is 256. + +The same applies to the hid string with length 13 and uid string with +length 250. + +Check the length of hid and uid strings separately to prevent +buffer overflow. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") +Cc: stable@vger.kernel.org +Signed-off-by: Pavel Paklov +Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 0abb714fdbf10..de29512c75ccc 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -3124,6 +3124,14 @@ static int __init parse_ivrs_acpihid(char *str) + while (*uid == '0' && *(uid + 1)) + uid++; + ++ if (strlen(hid) >= ACPIHID_HID_LEN) { ++ pr_err("Invalid command line: hid is too long\n"); ++ return 1; ++ } else if (strlen(uid) >= ACPIHID_UID_LEN) { ++ pr_err("Invalid command line: uid is too long\n"); ++ return 1; ++ } ++ + i = early_acpihid_map_size++; + memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); + memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); +-- +2.39.5 + diff --git a/queue-5.4/irqchip-gic-v2m-add-const-to-of_device_id.patch b/queue-5.4/irqchip-gic-v2m-add-const-to-of_device_id.patch new file mode 100644 index 0000000000..1c5d2102a3 --- /dev/null +++ b/queue-5.4/irqchip-gic-v2m-add-const-to-of_device_id.patch @@ -0,0 +1,36 @@ +From bdc58e2d116d51da2a0983fd62ea551053949203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Dec 2021 21:24:53 +0800 +Subject: irqchip/gic-v2m: Add const to of_device_id + +From: Xiang wangx + +[ Upstream commit c10f2f8b5d8027c1ea77f777f2d16cb9043a6c09 ] + +struct of_device_id should normally be const. + +Signed-off-by: Xiang wangx +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20211209132453.25623-1-wangxiang@cdjrlc.com +Stable-dep-of: 3318dc299b07 ("irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()") +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v2m.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c +index 11efd6c6b111b..5cb9539111d7a 100644 +--- a/drivers/irqchip/irq-gic-v2m.c ++++ b/drivers/irqchip/irq-gic-v2m.c +@@ -407,7 +407,7 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode, + return ret; + } + +-static struct of_device_id gicv2m_device_id[] = { ++static const struct of_device_id gicv2m_device_id[] = { + { .compatible = "arm,gic-v2m-frame", }, + {}, + }; +-- +2.39.5 + diff --git a/queue-5.4/irqchip-gic-v2m-mark-a-few-functions-__init.patch b/queue-5.4/irqchip-gic-v2m-mark-a-few-functions-__init.patch new file mode 100644 index 0000000000..a406811672 --- /dev/null +++ b/queue-5.4/irqchip-gic-v2m-mark-a-few-functions-__init.patch @@ -0,0 +1,72 @@ +From 20d78797303ac2d2e49810c562ac31859fe38832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 15:39:33 +0100 +Subject: irqchip/gic-v2m: Mark a few functions __init + +From: Thomas Gleixner + +[ Upstream commit d51a15af37ce8cf59e73de51dcdce3c9f4944974 ] + +They are all part of the init sequence. + +Signed-off-by: Thomas Gleixner +Acked-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221121140048.534395323@linutronix.de +Stable-dep-of: 3318dc299b07 ("irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()") +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v2m.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c +index 5cb9539111d7a..dbb15daf6ff1c 100644 +--- a/drivers/irqchip/irq-gic-v2m.c ++++ b/drivers/irqchip/irq-gic-v2m.c +@@ -262,7 +262,7 @@ static struct msi_domain_info gicv2m_pmsi_domain_info = { + .chip = &gicv2m_pmsi_irq_chip, + }; + +-static void gicv2m_teardown(void) ++static void __init gicv2m_teardown(void) + { + struct v2m_data *v2m, *tmp; + +@@ -277,7 +277,7 @@ static void gicv2m_teardown(void) + } + } + +-static int gicv2m_allocate_domains(struct irq_domain *parent) ++static __init int gicv2m_allocate_domains(struct irq_domain *parent) + { + struct irq_domain *inner_domain, *pci_domain, *plat_domain; + struct v2m_data *v2m; +@@ -407,7 +407,7 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode, + return ret; + } + +-static const struct of_device_id gicv2m_device_id[] = { ++static __initconst struct of_device_id gicv2m_device_id[] = { + { .compatible = "arm,gic-v2m-frame", }, + {}, + }; +@@ -457,7 +457,7 @@ static int __init gicv2m_of_init(struct fwnode_handle *parent_handle, + #ifdef CONFIG_ACPI + static int acpi_num_msi; + +-static struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) ++static __init struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) + { + struct v2m_data *data; + +@@ -472,7 +472,7 @@ static struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) + return data->fwnode; + } + +-static bool acpi_check_amazon_graviton_quirks(void) ++static __init bool acpi_check_amazon_graviton_quirks(void) + { + static struct acpi_table_madt *madt; + acpi_status status; +-- +2.39.5 + diff --git a/queue-5.4/irqchip-gic-v2m-prevent-use-after-free-of-gicv2m_get.patch b/queue-5.4/irqchip-gic-v2m-prevent-use-after-free-of-gicv2m_get.patch new file mode 100644 index 0000000000..b1b7cd542b --- /dev/null +++ b/queue-5.4/irqchip-gic-v2m-prevent-use-after-free-of-gicv2m_get.patch @@ -0,0 +1,51 @@ +From 74aceeac7460c90068c47f0af5b9dd3b25079a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 17:16:16 +0100 +Subject: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() + +From: Suzuki K Poulose + +[ Upstream commit 3318dc299b072a0511d6dfd8367f3304fb6d9827 ] + +With ACPI in place, gicv2m_get_fwnode() is registered with the pci +subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime +during a PCI host bridge probe. But, the call back is wrongly marked as +__init, causing it to be freed, while being registered with the PCI +subsystem and could trigger: + + Unable to handle kernel paging request at virtual address ffff8000816c0400 + gicv2m_get_fwnode+0x0/0x58 (P) + pci_set_bus_msi_domain+0x74/0x88 + pci_register_host_bridge+0x194/0x548 + +This is easily reproducible on a Juno board with ACPI boot. + +Retain the function for later use. + +Fixes: 0644b3daca28 ("irqchip/gic-v2m: acpi: Introducing GICv2m ACPI support") +Signed-off-by: Suzuki K Poulose +Signed-off-by: Thomas Gleixner +Signed-off-by: Ingo Molnar +Reviewed-by: Marc Zyngier +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v2m.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c +index dbb15daf6ff1c..2468b285c77c2 100644 +--- a/drivers/irqchip/irq-gic-v2m.c ++++ b/drivers/irqchip/irq-gic-v2m.c +@@ -457,7 +457,7 @@ static int __init gicv2m_of_init(struct fwnode_handle *parent_handle, + #ifdef CONFIG_ACPI + static int acpi_num_msi; + +-static __init struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) ++static struct fwnode_handle *gicv2m_get_fwnode(struct device *dev) + { + struct v2m_data *data; + +-- +2.39.5 + diff --git a/queue-5.4/serial-msm-configure-correct-working-mode-before-sta.patch b/queue-5.4/serial-msm-configure-correct-working-mode-before-sta.patch new file mode 100644 index 0000000000..fc3df11d8c --- /dev/null +++ b/queue-5.4/serial-msm-configure-correct-working-mode-before-sta.patch @@ -0,0 +1,60 @@ +From cd32bfe2999d38f1d98169cccf751654239fd616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 19:22:47 +0200 +Subject: serial: msm: Configure correct working mode before starting earlycon + +From: Stephan Gerhold + +[ Upstream commit 7094832b5ac861b0bd7ed8866c93cb15ef619996 ] + +The MSM UART DM controller supports different working modes, e.g. DMA or +the "single-character mode", where all reads/writes operate on a single +character rather than 4 chars (32-bit) at once. When using earlycon, +__msm_console_write() always writes 4 characters at a time, but we don't +know which mode the bootloader was using and we don't set the mode either. + +This causes garbled output if the bootloader was using the single-character +mode, because only every 4th character appears in the serial console, e.g. + + "[ 00oni pi 000xf0[ 00i s 5rm9(l)l s 1 1 SPMTA 7:C 5[ 00A ade k d[ + 00ano:ameoi .Q1B[ 00ac _idaM00080oo'" + +If the bootloader was using the DMA ("DM") mode, output would likely fail +entirely. Later, when the full serial driver probes, the port is +re-initialized and output works as expected. + +Fix this also for earlycon by clearing the DMEN register and +reset+re-enable the transmitter to apply the change. This ensures the +transmitter is in the expected state before writing any output. + +Cc: stable +Fixes: 0efe72963409 ("tty: serial: msm: Add earlycon support") +Signed-off-by: Stephan Gerhold +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250408-msm-serial-earlycon-v1-1-429080127530@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/msm_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index aac96659694d6..202893877165b 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1723,6 +1723,12 @@ msm_serial_early_console_setup_dm(struct earlycon_device *device, + if (!device->port.membase) + return -ENODEV; + ++ /* Disable DM / single-character modes */ ++ msm_write(&device->port, 0, UARTDM_DMEN); ++ msm_write(&device->port, MSM_UART_CR_CMD_RESET_RX, MSM_UART_CR); ++ msm_write(&device->port, MSM_UART_CR_CMD_RESET_TX, MSM_UART_CR); ++ msm_write(&device->port, MSM_UART_CR_TX_ENABLE, MSM_UART_CR); ++ + device->con->write = msm_serial_early_write_dm; + return 0; + } +-- +2.39.5 + diff --git a/queue-5.4/series b/queue-5.4/series index b5f7ad7aa0..0b2662cb71 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -20,3 +20,16 @@ net-fec-err007885-workaround-for-conventional-tx.patch pci-imx6-skip-controller_id-generation-logic-for-i.mx7d.patch of-module-add-buffer-overflow-check-in-of_modalias.patch sch_htb-make-htb_qlen_notify-idempotent.patch +irqchip-gic-v2m-add-const-to-of_device_id.patch +irqchip-gic-v2m-mark-a-few-functions-__init.patch +irqchip-gic-v2m-prevent-use-after-free-of-gicv2m_get.patch +usb-chipidea-imx-change-hsic-power-regulator-as-opti.patch +usb-chipidea-imx-refine-the-error-handling-for-hsic.patch +usb-chipidea-ci_hdrc_imx-use-dev_err_probe.patch +usb-chipidea-ci_hdrc_imx-implement-usb_phy_init-erro.patch +serial-msm-configure-correct-working-mode-before-sta.patch +cpufreq-intel_pstate-revise-global-turbo-disable-che.patch +cpufreq-intel_pstate-fold-intel_pstate_max_within_li.patch +cpufreq-intel_pstate-unchecked-msr-aceess-in-legacy-.patch +arm64-dts-rockchip-fix-iface-clock-name-on-px30-iomm.patch +iommu-amd-fix-potential-buffer-overflow-in-parse_ivr.patch diff --git a/queue-5.4/usb-chipidea-ci_hdrc_imx-implement-usb_phy_init-erro.patch b/queue-5.4/usb-chipidea-ci_hdrc_imx-implement-usb_phy_init-erro.patch new file mode 100644 index 0000000000..de058a8340 --- /dev/null +++ b/queue-5.4/usb-chipidea-ci_hdrc_imx-implement-usb_phy_init-erro.patch @@ -0,0 +1,74 @@ +From 1f84bbe8dd56749cca2d477a4d8437605cf3ea08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Mar 2025 13:26:56 +0300 +Subject: usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling + +From: Fedor Pchelkin + +[ Upstream commit 8c531e0a8c2d82509ad97c6d3a1e6217c7ed136d ] + +usb_phy_init() may return an error code if e.g. its implementation fails +to prepare/enable some clocks. And properly rollback on probe error path +by calling the counterpart usb_phy_shutdown(). + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: be9cae2479f4 ("usb: chipidea: imx: Fix ULPI on imx53") +Cc: stable +Signed-off-by: Fedor Pchelkin +Acked-by: Peter Chen +Link: https://lore.kernel.org/r/20250316102658.490340-4-pchelkin@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 0fd860da9267d..d4566b5ec348d 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -417,7 +417,11 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + of_usb_get_phy_mode(np) == USBPHY_INTERFACE_MODE_ULPI) { + pdata.flags |= CI_HDRC_OVERRIDE_PHY_CONTROL; + data->override_phy_control = true; +- usb_phy_init(pdata.usb_phy); ++ ret = usb_phy_init(pdata.usb_phy); ++ if (ret) { ++ dev_err(dev, "Failed to init phy\n"); ++ goto err_clk; ++ } + } + + if (pdata.flags & CI_HDRC_SUPPORTS_RUNTIME_PM) +@@ -426,7 +430,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + ret = imx_usbmisc_init(data->usbmisc_data); + if (ret) { + dev_err(dev, "usbmisc init failed, ret=%d\n", ret); +- goto err_clk; ++ goto phy_shutdown; + } + + data->ci_pdev = ci_hdrc_add_device(dev, +@@ -435,7 +439,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + if (IS_ERR(data->ci_pdev)) { + ret = PTR_ERR(data->ci_pdev); + dev_err_probe(dev, ret, "ci_hdrc_add_device failed\n"); +- goto err_clk; ++ goto phy_shutdown; + } + + ret = imx_usbmisc_init_post(data->usbmisc_data); +@@ -455,6 +459,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + + disable_device: + ci_hdrc_remove_device(data->ci_pdev); ++phy_shutdown: ++ if (data->override_phy_control) ++ usb_phy_shutdown(data->phy); + err_clk: + imx_disable_unprepare_clks(dev); + disable_hsic_regulator: +-- +2.39.5 + diff --git a/queue-5.4/usb-chipidea-ci_hdrc_imx-use-dev_err_probe.patch b/queue-5.4/usb-chipidea-ci_hdrc_imx-use-dev_err_probe.patch new file mode 100644 index 0000000000..a316c5a674 --- /dev/null +++ b/queue-5.4/usb-chipidea-ci_hdrc_imx-use-dev_err_probe.patch @@ -0,0 +1,72 @@ +From f25be66064ebfc2c6bcc7c05859a90bb797a4ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 14:05:22 +0200 +Subject: usb: chipidea: ci_hdrc_imx: use dev_err_probe() + +From: Alexander Stein + +[ Upstream commit 18171cfc3c236a1587dcad9adc27c6e781af4438 ] + +Use dev_err_probe() to simplify handling errors in ci_hdrc_imx_probe() + +Acked-by: Peter Chen +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20220614120522.1469957-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8c531e0a8c2d ("usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling") +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 23 +++++++---------------- + 1 file changed, 7 insertions(+), 16 deletions(-) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 034de11a1ac11..0fd860da9267d 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -342,12 +342,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + data->pinctrl = devm_pinctrl_get(dev); + if (PTR_ERR(data->pinctrl) == -ENODEV) + data->pinctrl = NULL; +- else if (IS_ERR(data->pinctrl)) { +- if (PTR_ERR(data->pinctrl) != -EPROBE_DEFER) +- dev_err(dev, "pinctrl get failed, err=%ld\n", +- PTR_ERR(data->pinctrl)); +- return PTR_ERR(data->pinctrl); +- } ++ else if (IS_ERR(data->pinctrl)) ++ return dev_err_probe(dev, PTR_ERR(data->pinctrl), ++ "pinctrl get failed\n"); + + pinctrl_hsic_idle = pinctrl_lookup_state(data->pinctrl, "idle"); + if (IS_ERR(pinctrl_hsic_idle)) { +@@ -377,13 +374,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { + /* no pad regualator is needed */ + data->hsic_pad_regulator = NULL; +- } else if (IS_ERR(data->hsic_pad_regulator)) { +- if (PTR_ERR(data->hsic_pad_regulator) != -EPROBE_DEFER) +- dev_err(dev, +- "Get HSIC pad regulator error: %ld\n", +- PTR_ERR(data->hsic_pad_regulator)); +- return PTR_ERR(data->hsic_pad_regulator); +- } ++ } else if (IS_ERR(data->hsic_pad_regulator)) ++ return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), ++ "Get HSIC pad regulator error\n"); + + if (data->hsic_pad_regulator) { + ret = regulator_enable(data->hsic_pad_regulator); +@@ -441,9 +434,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + &pdata); + if (IS_ERR(data->ci_pdev)) { + ret = PTR_ERR(data->ci_pdev); +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "ci_hdrc_add_device failed, err=%d\n", +- ret); ++ dev_err_probe(dev, ret, "ci_hdrc_add_device failed\n"); + goto err_clk; + } + +-- +2.39.5 + diff --git a/queue-5.4/usb-chipidea-imx-change-hsic-power-regulator-as-opti.patch b/queue-5.4/usb-chipidea-imx-change-hsic-power-regulator-as-opti.patch new file mode 100644 index 0000000000..06cef69a1f --- /dev/null +++ b/queue-5.4/usb-chipidea-imx-change-hsic-power-regulator-as-opti.patch @@ -0,0 +1,35 @@ +From 6b3cf24f241e18a75aca6c83e83e188f5f03c4fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 08:40:46 +0800 +Subject: usb: chipidea: imx: change hsic power regulator as optional + +From: Peter Chen + +[ Upstream commit 7d5ec335f94e74e885ca2f6c97a3479fe9fe3b15 ] + +Not every platform needs this regulator. + +Signed-off-by: Peter Chen +Stable-dep-of: 8c531e0a8c2d ("usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling") +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 0fe545815c5ce..09a7bee7203c5 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -369,7 +369,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + return PTR_ERR(data->pinctrl_hsic_active); + } + +- data->hsic_pad_regulator = devm_regulator_get(dev, "hsic"); ++ data->hsic_pad_regulator = ++ devm_regulator_get_optional(dev, "hsic"); + if (PTR_ERR(data->hsic_pad_regulator) == -EPROBE_DEFER) { + return -EPROBE_DEFER; + } else if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { +-- +2.39.5 + diff --git a/queue-5.4/usb-chipidea-imx-refine-the-error-handling-for-hsic.patch b/queue-5.4/usb-chipidea-imx-refine-the-error-handling-for-hsic.patch new file mode 100644 index 0000000000..22d7d01d5c --- /dev/null +++ b/queue-5.4/usb-chipidea-imx-refine-the-error-handling-for-hsic.patch @@ -0,0 +1,58 @@ +From 461b880f6fe355f06ad7f1839c8e06cf9923e4c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 08:59:14 +0800 +Subject: usb: chipidea: imx: refine the error handling for hsic + +From: Peter Chen + +[ Upstream commit 3f4aad6e1a4c26a20700fb4f630e4e6c6831db47 ] + +- -EPROBE_DEFER is an error, but without need show error message +- If pintrol is not existed, as pintrol is NULL + +Signed-off-by: Peter Chen +Stable-dep-of: 8c531e0a8c2d ("usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling") +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 09a7bee7203c5..034de11a1ac11 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -340,8 +340,11 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + pdata.flags |= CI_HDRC_IMX_IS_HSIC; + data->usbmisc_data->hsic = 1; + data->pinctrl = devm_pinctrl_get(dev); +- if (IS_ERR(data->pinctrl)) { +- dev_err(dev, "pinctrl get failed, err=%ld\n", ++ if (PTR_ERR(data->pinctrl) == -ENODEV) ++ data->pinctrl = NULL; ++ else if (IS_ERR(data->pinctrl)) { ++ if (PTR_ERR(data->pinctrl) != -EPROBE_DEFER) ++ dev_err(dev, "pinctrl get failed, err=%ld\n", + PTR_ERR(data->pinctrl)); + return PTR_ERR(data->pinctrl); + } +@@ -371,13 +374,13 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + + data->hsic_pad_regulator = + devm_regulator_get_optional(dev, "hsic"); +- if (PTR_ERR(data->hsic_pad_regulator) == -EPROBE_DEFER) { +- return -EPROBE_DEFER; +- } else if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { ++ if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { + /* no pad regualator is needed */ + data->hsic_pad_regulator = NULL; + } else if (IS_ERR(data->hsic_pad_regulator)) { +- dev_err(dev, "Get HSIC pad regulator error: %ld\n", ++ if (PTR_ERR(data->hsic_pad_regulator) != -EPROBE_DEFER) ++ dev_err(dev, ++ "Get HSIC pad regulator error: %ld\n", + PTR_ERR(data->hsic_pad_regulator)); + return PTR_ERR(data->hsic_pad_regulator); + } +-- +2.39.5 +