This is a note to let you know that I've just added the patch titled firmware: tegra: bpmp: Do only aligned access to IPC memory area to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: firmware-tegra-bpmp-do-only-aligned-access-to-ipc-memory-area.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From a4740b148a04dc60e14fe6a1dfe216d3bae214fd Mon Sep 17 00:00:00 2001 From: Timo Alho <talho@xxxxxxxxxx> Date: Wed, 22 Jun 2022 16:22:59 +0300 Subject: firmware: tegra: bpmp: Do only aligned access to IPC memory area From: Timo Alho <talho@xxxxxxxxxx> commit a4740b148a04dc60e14fe6a1dfe216d3bae214fd upstream. Use memcpy_toio and memcpy_fromio variants of memcpy to guarantee no unaligned access to IPC memory area. This is to allow the IPC memory to be mapped as Device memory to further suppress speculative reads from happening within the 64 kB memory area above the IPC memory when 64 kB memory pages are used. Signed-off-by: Timo Alho <talho@xxxxxxxxxx> Signed-off-by: Mikko Perttunen <mperttunen@xxxxxxxxxx> Signed-off-by: Thierry Reding <treding@xxxxxxxxxx> Cc: Jon Hunter <jonathanh@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/firmware/tegra/bpmp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/firmware/tegra/bpmp.c +++ b/drivers/firmware/tegra/bpmp.c @@ -201,7 +201,7 @@ static ssize_t __tegra_bpmp_channel_read int err; if (data && size > 0) - memcpy(data, channel->ib->data, size); + memcpy_fromio(data, channel->ib->data, size); err = tegra_bpmp_ack_response(channel); if (err < 0) @@ -245,7 +245,7 @@ static ssize_t __tegra_bpmp_channel_writ channel->ob->flags = flags; if (data && size > 0) - memcpy(channel->ob->data, data, size); + memcpy_toio(channel->ob->data, data, size); return tegra_bpmp_post_request(channel); } @@ -420,7 +420,7 @@ void tegra_bpmp_mrq_return(struct tegra_ channel->ob->code = code; if (data && size > 0) - memcpy(channel->ob->data, data, size); + memcpy_toio(channel->ob->data, data, size); err = tegra_bpmp_post_response(channel); if (WARN_ON(err < 0)) Patches currently in stable-queue which might be from talho@xxxxxxxxxx are queue-5.15/firmware-tegra-bpmp-do-only-aligned-access-to-ipc-memory-area.patch