From 316dca263b2798a29c30f980fe3c955f53bcd8fa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 24 Mar 2025 09:00:07 -0700 Subject: [PATCH] 5.4-stable patches added patches: arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch i2c-omap-fix-irq-storms.patch mmc-atmel-mci-add-missing-clk_disable_unprepare.patch --- ...-smp-enforce-shmobile_smp_-alignment.patch | 42 +++++++ ...n-maximum-aggregation-size-during-rx.patch | 56 +++++++++ ...ed-size-issue-in-radeon_vce_cs_parse.patch | 44 +++++++ ...hat-have-errors-flagged-in-its-fence.patch | 68 +++++++++++ queue-5.4/i2c-omap-fix-irq-storms.patch | 112 ++++++++++++++++++ ...ci-add-missing-clk_disable_unprepare.patch | 39 ++++++ queue-5.4/series | 6 + 7 files changed, 367 insertions(+) create mode 100644 queue-5.4/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch create mode 100644 queue-5.4/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch create mode 100644 queue-5.4/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch create mode 100644 queue-5.4/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch create mode 100644 queue-5.4/i2c-omap-fix-irq-storms.patch create mode 100644 queue-5.4/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch diff --git a/queue-5.4/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch b/queue-5.4/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch new file mode 100644 index 0000000000..b8298def33 --- /dev/null +++ b/queue-5.4/arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch @@ -0,0 +1,42 @@ +From 379c590113ce46f605439d4887996c60ab8820cc Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 10 Mar 2025 14:12:20 +0100 +Subject: ARM: shmobile: smp: Enforce shmobile_smp_* alignment + +From: Geert Uytterhoeven + +commit 379c590113ce46f605439d4887996c60ab8820cc upstream. + +When the addresses of the shmobile_smp_mpidr, shmobile_smp_fn, and +shmobile_smp_arg variables are not multiples of 4 bytes, secondary CPU +bring-up fails: + + smp: Bringing up secondary CPUs ... + CPU1: failed to come online + CPU2: failed to come online + CPU3: failed to come online + smp: Brought up 1 node, 1 CPU + +Fix this by adding the missing alignment directive. + +Fixes: 4e960f52fce16a3b ("ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss") +Closes: https://lore.kernel.org/r/CAMuHMdU=QR-JLgEHKWpsr6SbaZRc-Hz9r91JfpP8c3n2G-OjqA@mail.gmail.com +Signed-off-by: Geert Uytterhoeven +Tested-by: Lad Prabhakar +Link: https://lore.kernel.org/c499234d559a0d95ad9472883e46077311051cd8.1741612208.git.geert+renesas@glider.be +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-shmobile/headsmp.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/mach-shmobile/headsmp.S ++++ b/arch/arm/mach-shmobile/headsmp.S +@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep) + .long shmobile_smp_arg - 1b + + .bss ++ .align 2 + .globl shmobile_smp_mpidr + shmobile_smp_mpidr: + .space NR_CPUS * 4 diff --git a/queue-5.4/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch b/queue-5.4/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch new file mode 100644 index 0000000000..bf65e90b0b --- /dev/null +++ b/queue-5.4/batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch @@ -0,0 +1,56 @@ +From 548b0c5de7619ef53bbde5590700693f2f6d2a56 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 2 Feb 2025 17:04:13 +0100 +Subject: batman-adv: Ignore own maximum aggregation size during RX + +From: Sven Eckelmann + +commit 548b0c5de7619ef53bbde5590700693f2f6d2a56 upstream. + +An OGMv1 and OGMv2 packet receive processing were not only limited by the +number of bytes in the received packet but also by the nodes maximum +aggregation packet size limit. But this limit is relevant for TX and not +for RX. It must not be enforced by batadv_(i)v_ogm_aggr_packet to avoid +loss of information in case of a different limit for sender and receiver. + +This has a minor side effect for B.A.T.M.A.N. IV because the +batadv_iv_ogm_aggr_packet is also used for the preprocessing for the TX. +But since the aggregation code itself will not allow more than +BATADV_MAX_AGGREGATION_BYTES bytes, this check was never triggering (in +this context) prior of removing it. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bat_iv_ogm.c | 3 +-- + net/batman-adv/bat_v_ogm.c | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -325,8 +325,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos, + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(ogm_packet->tvlv_len); + +- return (next_buff_pos <= packet_len) && +- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); ++ return next_buff_pos <= packet_len; + } + + /* send a batman ogm to a given interface */ +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -845,8 +845,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, i + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(ogm2_packet->tvlv_len); + +- return (next_buff_pos <= packet_len) && +- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); ++ return next_buff_pos <= packet_len; + } + + /** diff --git a/queue-5.4/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch b/queue-5.4/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch new file mode 100644 index 0000000000..3195f1a634 --- /dev/null +++ b/queue-5.4/drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch @@ -0,0 +1,44 @@ +From dd8689b52a24807c2d5ce0a17cb26dc87f75235c Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Tue, 11 Mar 2025 14:14:59 +0300 +Subject: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() + +From: Nikita Zhandarovich + +commit dd8689b52a24807c2d5ce0a17cb26dc87f75235c upstream. + +On the off chance that command stream passed from userspace via +ioctl() call to radeon_vce_cs_parse() is weirdly crafted and +first command to execute is to encode (case 0x03000001), the function +in question will attempt to call radeon_vce_cs_reloc() with size +argument that has not been properly initialized. Specifically, 'size' +will point to 'tmp' variable before the latter had a chance to be +assigned any value. + +Play it safe and init 'tmp' with 0, thus ensuring that +radeon_vce_cs_reloc() will catch an early error in cases like these. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 2fc5703abda2 ("drm/radeon: check VCE relocation buffer range v3") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_vce.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_vce.c ++++ b/drivers/gpu/drm/radeon/radeon_vce.c +@@ -558,7 +558,7 @@ int radeon_vce_cs_parse(struct radeon_cs + { + int session_idx = -1; + bool destroyed = false, created = false, allocated = false; +- uint32_t tmp, handle = 0; ++ uint32_t tmp = 0, handle = 0; + uint32_t *size = &tmp; + int i, r = 0; + diff --git a/queue-5.4/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch b/queue-5.4/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch new file mode 100644 index 0000000000..b1699992b8 --- /dev/null +++ b/queue-5.4/drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch @@ -0,0 +1,68 @@ +From 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ma=C3=ADra=20Canal?= +Date: Thu, 13 Mar 2025 11:43:26 -0300 +Subject: drm/v3d: Don't run jobs that have errors flagged in its fence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +commit 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 upstream. + +The V3D driver still relies on `drm_sched_increase_karma()` and +`drm_sched_resubmit_jobs()` for resubmissions when a timeout occurs. +The function `drm_sched_increase_karma()` marks the job as guilty, while +`drm_sched_resubmit_jobs()` sets an error (-ECANCELED) in the DMA fence of +that guilty job. + +Because of this, we must check whether the job’s DMA fence has been +flagged with an error before executing the job. Otherwise, the same guilty +job may be resubmitted indefinitely, causing repeated GPU resets. + +This patch adds a check for an error on the job's fence to prevent running +a guilty job that was previously flagged when the GPU timed out. + +Note that the CPU and CACHE_CLEAN queues do not require this check, as +their jobs are executed synchronously once the DRM scheduler starts them. + +Cc: stable@vger.kernel.org +Fixes: d223f98f0209 ("drm/v3d: Add support for compute shader dispatch.") +Fixes: 1584f16ca96e ("drm/v3d: Add support for submitting jobs to the TFU.") +Reviewed-by: Iago Toral Quiroga +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20250313-v3d-gpu-reset-fixes-v4-1-c1e780d8e096@igalia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/v3d/v3d_sched.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/v3d/v3d_sched.c ++++ b/drivers/gpu/drm/v3d/v3d_sched.c +@@ -188,11 +188,15 @@ v3d_tfu_job_run(struct drm_sched_job *sc + struct drm_device *dev = &v3d->drm; + struct dma_fence *fence; + ++ if (unlikely(job->base.base.s_fence->finished.error)) ++ return NULL; ++ ++ v3d->tfu_job = job; ++ + fence = v3d_fence_create(v3d, V3D_TFU); + if (IS_ERR(fence)) + return NULL; + +- v3d->tfu_job = job; + if (job->base.irq_fence) + dma_fence_put(job->base.irq_fence); + job->base.irq_fence = dma_fence_get(fence); +@@ -226,6 +230,9 @@ v3d_csd_job_run(struct drm_sched_job *sc + struct dma_fence *fence; + int i; + ++ if (unlikely(job->base.base.s_fence->finished.error)) ++ return NULL; ++ + v3d->csd_job = job; + + v3d_invalidate_caches(v3d); diff --git a/queue-5.4/i2c-omap-fix-irq-storms.patch b/queue-5.4/i2c-omap-fix-irq-storms.patch new file mode 100644 index 0000000000..e21d321fca --- /dev/null +++ b/queue-5.4/i2c-omap-fix-irq-storms.patch @@ -0,0 +1,112 @@ +From 285df995f90e3d61d97f327d34b9659d92313314 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Fri, 28 Feb 2025 15:04:20 +0100 +Subject: i2c: omap: fix IRQ storms + +From: Andreas Kemnade + +commit 285df995f90e3d61d97f327d34b9659d92313314 upstream. + +On the GTA04A5 writing a reset command to the gyroscope causes IRQ +storms because NACK IRQs are enabled and therefore triggered but not +acked. + +Sending a reset command to the gyroscope by +i2cset 1 0x69 0x14 0xb6 +with an additional debug print in the ISR (not the thread) itself +causes + +[ 363.353515] i2c i2c-1: ioctl, cmd=0x720, arg=0xbe801b00 +[ 363.359039] omap_i2c 48072000.i2c: addr: 0x0069, len: 2, flags: 0x0, stop: 1 +[ 363.366180] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x1110) +[ 363.371673] omap_i2c 48072000.i2c: IRQ (ISR = 0x0010) +[ 363.376892] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +[ 363.382263] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +[ 363.387664] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) +repeating till infinity +[...] +(0x2 = NACK, 0x100 = Bus free, which is not enabled) +Apparently no other IRQ bit gets set, so this stalls. + +Do not ignore enabled interrupts and make sure they are acked. +If the NACK IRQ is not needed, it should simply not enabled, but +according to the above log, caring about it is necessary unless +the Bus free IRQ is enabled and handled. The assumption that is +will always come with a ARDY IRQ, which was the idea behind +ignoring it, proves wrong. +It is true for simple reads from an unused address. + +To still avoid the i2cdetect trouble which is the reason for +commit c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"), +avoid doing much about NACK in omap_i2c_xfer_data() which is used +by both IRQ mode and polling mode, so also the false detection fix +is extended to polling usage and IRQ storms are avoided. + +By changing this, the hardirq handler is not needed anymore to filter +stuff. + +The mentioned gyro reset now just causes a -ETIMEDOUT instead of +hanging the system. + +Fixes: c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"). +CC: stable@kernel.org +Signed-off-by: Andreas Kemnade +Tested-by: Nishanth Menon +Reviewed-by: Aniket Limaye +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250228140420.379498-1-andreas@kemnade.info +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-omap.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1049,23 +1049,6 @@ static int omap_i2c_transmit_data(struct + return 0; + } + +-static irqreturn_t +-omap_i2c_isr(int irq, void *dev_id) +-{ +- struct omap_i2c_dev *omap = dev_id; +- irqreturn_t ret = IRQ_HANDLED; +- u16 mask; +- u16 stat; +- +- stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG); +- mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK; +- +- if (stat & mask) +- ret = IRQ_WAKE_THREAD; +- +- return ret; +-} +- + static int omap_i2c_xfer_data(struct omap_i2c_dev *omap) + { + u16 bits; +@@ -1096,8 +1079,13 @@ static int omap_i2c_xfer_data(struct oma + } + + if (stat & OMAP_I2C_STAT_NACK) { +- err |= OMAP_I2C_STAT_NACK; ++ omap->cmd_err |= OMAP_I2C_STAT_NACK; + omap_i2c_ack_stat(omap, OMAP_I2C_STAT_NACK); ++ ++ if (!(stat & ~OMAP_I2C_STAT_NACK)) { ++ err = -EAGAIN; ++ break; ++ } + } + + if (stat & OMAP_I2C_STAT_AL) { +@@ -1480,7 +1468,7 @@ omap_i2c_probe(struct platform_device *p + IRQF_NO_SUSPEND, pdev->name, omap); + else + r = devm_request_threaded_irq(&pdev->dev, omap->irq, +- omap_i2c_isr, omap_i2c_isr_thread, ++ NULL, omap_i2c_isr_thread, + IRQF_NO_SUSPEND | IRQF_ONESHOT, + pdev->name, omap); + diff --git a/queue-5.4/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch b/queue-5.4/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch new file mode 100644 index 0000000000..a6d8dd605a --- /dev/null +++ b/queue-5.4/mmc-atmel-mci-add-missing-clk_disable_unprepare.patch @@ -0,0 +1,39 @@ +From e51a349d2dcf1df8422dabb90b2f691dc7df6f92 Mon Sep 17 00:00:00 2001 +From: Gu Bowen +Date: Tue, 25 Feb 2025 10:28:56 +0800 +Subject: mmc: atmel-mci: Add missing clk_disable_unprepare() + +From: Gu Bowen + +commit e51a349d2dcf1df8422dabb90b2f691dc7df6f92 upstream. + +The error path when atmci_configure_dma() set dma fails in atmci driver +does not correctly disable the clock. +Add the missing clk_disable_unprepare() to the error path for pair with +clk_prepare_enable(). + +Fixes: 467e081d23e6 ("mmc: atmel-mci: use probe deferring if dma controller is not ready yet") +Signed-off-by: Gu Bowen +Acked-by: Aubin Constans +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250225022856.3452240-1-gubowen5@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/atmel-mci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -2502,8 +2502,10 @@ static int atmci_probe(struct platform_d + /* Get MCI capabilities and set operations according to it */ + atmci_get_cap(host); + ret = atmci_configure_dma(host); +- if (ret == -EPROBE_DEFER) ++ if (ret == -EPROBE_DEFER) { ++ clk_disable_unprepare(host->mck); + goto err_dma_probe_defer; ++ } + if (ret == 0) { + host->prepare_data = &atmci_prepare_data_dma; + host->submit_data = &atmci_submit_data_dma; diff --git a/queue-5.4/series b/queue-5.4/series index cd80231201..d5e345ee13 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -57,3 +57,9 @@ ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch net-atm-fix-use-after-free-in-lec_send.patch net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch +i2c-omap-fix-irq-storms.patch +drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch +mmc-atmel-mci-add-missing-clk_disable_unprepare.patch +arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch +batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch +drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch -- 2.47.3