--- /dev/null
+From 995b8d778f3b01b7002ca4dacdeddd18cb462339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 16:46:11 +0900
+Subject: ksmbd: fix stream write failure
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 1f4bbedd4e5a69b01cde2cc21d01151ab2d0884f ]
+
+If there is no stream data in file, v_len is zero.
+So, If position(*pos) is zero, stream write will fail
+due to stream write position validation check.
+This patch reorganize stream write position validation.
+
+Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos")
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/vfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
+index cf1b241a15789..fa647b75fba8a 100644
+--- a/fs/smb/server/vfs.c
++++ b/fs/smb/server/vfs.c
+@@ -423,10 +423,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
+ ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
+ *pos, count);
+
++ if (*pos >= XATTR_SIZE_MAX) {
++ pr_err("stream write position %lld is out of bounds\n", *pos);
++ return -EINVAL;
++ }
++
+ size = *pos + count;
+ if (size > XATTR_SIZE_MAX) {
+ size = XATTR_SIZE_MAX;
+- count = (*pos + count) - XATTR_SIZE_MAX;
++ count = XATTR_SIZE_MAX - *pos;
+ }
+
+ v_len = ksmbd_vfs_getcasexattr(user_ns,
+@@ -440,13 +445,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
+ goto out;
+ }
+
+- if (v_len <= *pos) {
+- pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
+- *pos, v_len);
+- err = -EINVAL;
+- goto out;
+- }
+-
+ if (v_len < size) {
+ wbuf = kvzalloc(size, GFP_KERNEL);
+ if (!wbuf) {
+--
+2.39.5
+
--- /dev/null
+From 27a4fc1592a044bf018119fb1b5975929b17c6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 15:58:48 +0200
+Subject: Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC
+ connection"
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 573f99c7585f597630f14596550c79e73ffaeef4 ]
+
+This reverts commit 531fdbeedeb89bd32018a35c6e137765c9cc9e97.
+
+Hardware that uses I2C wasn't designed with high speeds in mind, so
+communication with PMIC via RSB can intermittently fail. Go back to I2C
+as higher speed and efficiency isn't worth the trouble.
+
+Fixes: 531fdbeedeb8 ("arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection")
+Link: https://github.com/LibreELEC/LibreELEC.tv/issues/7731
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250413135848.67283-1-jernej.skrabec@gmail.com
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/allwinner/sun50i-h6-beelink-gs1.dts | 38 +++++++++----------
+ .../dts/allwinner/sun50i-h6-orangepi-3.dts | 14 +++----
+ .../dts/allwinner/sun50i-h6-orangepi.dtsi | 22 +++++------
+ 3 files changed, 37 insertions(+), 37 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+index 381d58cea092d..c854c7e310519 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+@@ -151,28 +151,12 @@
+ vcc-pg-supply = <®_aldo1>;
+ };
+
+-&r_ir {
+- linux,rc-map-name = "rc-beelink-gs1";
+- status = "okay";
+-};
+-
+-&r_pio {
+- /*
+- * FIXME: We can't add that supply for now since it would
+- * create a circular dependency between pinctrl, the regulator
+- * and the RSB Bus.
+- *
+- * vcc-pl-supply = <®_aldo1>;
+- */
+- vcc-pm-supply = <®_aldo1>;
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -290,6 +274,22 @@
+ };
+ };
+
++&r_ir {
++ linux,rc-map-name = "rc-beelink-gs1";
++ status = "okay";
++};
++
++&r_pio {
++ /*
++ * PL0 and PL1 are used for PMIC I2C
++ * don't enable the pl-supply else
++ * it will fail at boot
++ *
++ * vcc-pl-supply = <®_aldo1>;
++ */
++ vcc-pm-supply = <®_aldo1>;
++};
++
+ &spdif {
+ pinctrl-names = "default";
+ pinctrl-0 = <&spdif_tx_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
+index 6fc65e8db2206..8c476e089185b 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
+@@ -175,16 +175,12 @@
+ vcc-pg-supply = <®_vcc_wifi_io>;
+ };
+
+-&r_ir {
+- status = "okay";
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -295,6 +291,10 @@
+ };
+ };
+
++&r_ir {
++ status = "okay";
++};
++
+ &rtc {
+ clocks = <&ext_osc32k>;
+ };
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
+index 92745128fcfeb..4ec4996592bef 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
+@@ -112,20 +112,12 @@
+ vcc-pg-supply = <®_aldo1>;
+ };
+
+-&r_ir {
+- status = "okay";
+-};
+-
+-&r_pio {
+- vcc-pm-supply = <®_bldo3>;
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -240,6 +232,14 @@
+ };
+ };
+
++&r_ir {
++ status = "okay";
++};
++
++&r_pio {
++ vcc-pm-supply = <®_bldo3>;
++};
++
+ &rtc {
+ clocks = <&ext_osc32k>;
+ };
+--
+2.39.5
+
input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch
memcg-always-call-cond_resched-after-fn.patch
mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch
+revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch
+ksmbd-fix-stream-write-failure.patch
+spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch
+spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch
+spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch
--- /dev/null
+From 76bbe1943f3f1431adb5a01a7bc0b0fb11ac6a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:31 +0100
+Subject: spi: spi-fsl-dspi: Halt the module after a new message transfer
+
+From: Bogdan-Gabriel Roman <bogdan-gabriel.roman@nxp.com>
+
+[ Upstream commit 8a30a6d35a11ff5ccdede7d6740765685385a917 ]
+
+The XSPI mode implementation in this driver still uses the EOQ flag to
+signal the last word in a transmission and deassert the PCS signal.
+However, at speeds lower than ~200kHZ, the PCS signal seems to remain
+asserted even when SR[EOQF] = 1 indicates the end of a transmission.
+This is a problem for target devices which require the deassertation of
+the PCS signal between transfers.
+
+Hence, this commit 'forces' the deassertation of the PCS by stopping the
+module through MCR[HALT] after completing a new transfer. According to
+the reference manual, the module stops or transitions from the Running
+state to the Stopped state after the current frame, when any one of the
+following conditions exist:
+- The value of SR[EOQF] = 1.
+- The chip is in Debug mode and the value of MCR[FRZ] = 1.
+- The value of MCR[HALT] = 1.
+
+This shouldn't be done if the last transfer in the message has cs_change
+set.
+
+Fixes: ea93ed4c181b ("spi: spi-fsl-dspi: Use EOQ for last word in buffer even for XSPI mode")
+Signed-off-by: Bogdan-Gabriel Roman <bogdan-gabriel.roman@nxp.com>
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-2-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 3f9609edac944..93cdc52f0fb06 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -61,6 +61,7 @@
+ #define SPI_SR_TFIWF BIT(18)
+ #define SPI_SR_RFDF BIT(17)
+ #define SPI_SR_CMDFFF BIT(16)
++#define SPI_SR_TXRXS BIT(30)
+ #define SPI_SR_CLEAR (SPI_SR_TCFQF | \
+ SPI_SR_TFUF | SPI_SR_TFFF | \
+ SPI_SR_CMDTCF | SPI_SR_SPEF | \
+@@ -907,9 +908,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ struct spi_device *spi = message->spi;
+ struct spi_transfer *transfer;
+ int status = 0;
++ u32 val = 0;
++ bool cs_change = false;
+
+ message->actual_length = 0;
+
++ /* Put DSPI in running mode if halted. */
++ regmap_read(dspi->regmap, SPI_MCR, &val);
++ if (val & SPI_MCR_HALT) {
++ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, 0);
++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 &&
++ !(val & SPI_SR_TXRXS))
++ ;
++ }
++
+ list_for_each_entry(transfer, &message->transfers, transfer_list) {
+ dspi->cur_transfer = transfer;
+ dspi->cur_msg = message;
+@@ -934,6 +946,7 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ dspi->tx_cmd |= SPI_PUSHR_CMD_CONT;
+ }
+
++ cs_change = transfer->cs_change;
+ dspi->tx = transfer->tx_buf;
+ dspi->rx = transfer->rx_buf;
+ dspi->len = transfer->len;
+@@ -966,6 +979,15 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ spi_transfer_delay_exec(transfer);
+ }
+
++ if (status || !cs_change) {
++ /* Put DSPI in stop mode */
++ regmap_update_bits(dspi->regmap, SPI_MCR,
++ SPI_MCR_HALT, SPI_MCR_HALT);
++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 &&
++ val & SPI_SR_TXRXS)
++ ;
++ }
++
+ message->status = status;
+ spi_finalize_current_message(ctlr);
+
+@@ -1206,6 +1228,8 @@ static int dspi_init(struct fsl_dspi *dspi)
+ if (!spi_controller_is_slave(dspi->ctlr))
+ mcr |= SPI_MCR_MASTER;
+
++ mcr |= SPI_MCR_HALT;
++
+ regmap_write(dspi->regmap, SPI_MCR, mcr);
+ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
+
+--
+2.39.5
+
--- /dev/null
+From a125a7978836ad12ebf3dea07d2768f23f298942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:32 +0100
+Subject: spi: spi-fsl-dspi: Reset SR flags before sending a new message
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 7aba292eb15389073c7f3bd7847e3862dfdf604d ]
+
+If, in a previous transfer, the controller sends more data than expected
+by the DSPI target, SR.RFDF (RX FIFO is not empty) will remain asserted.
+When flushing the FIFOs at the beginning of a new transfer (writing 1
+into MCR.CLR_TXF and MCR.CLR_RXF), SR.RFDF should also be cleared.
+Otherwise, when running in target mode with DMA, if SR.RFDF remains
+asserted, the DMA callback will be fired before the controller sends any
+data.
+
+Take this opportunity to reset all Status Register fields.
+
+Fixes: 5ce3cc567471 ("spi: spi-fsl-dspi: Provide support for DSPI slave mode operation (Vybryd vf610)")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-3-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 93cdc52f0fb06..5374c6d44519a 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -956,6 +956,8 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF,
+ SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF);
+
++ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
++
+ spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer,
+ dspi->progress, !dspi->irq);
+
+--
+2.39.5
+
--- /dev/null
+From 5b32ce5d593f6120da8c000f40e85bc152c4f0e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:30 +0100
+Subject: spi: spi-fsl-dspi: restrict register range for regmap access
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 283ae0c65e9c592f4a1ba4f31917f5e766da7f31 ]
+
+DSPI registers are NOT continuous, some registers are reserved and
+accessing them from userspace will trigger external abort, add regmap
+register access table to avoid below abort.
+
+ For example on S32G:
+
+ # cat /sys/kernel/debug/regmap/401d8000.spi/registers
+
+ Internal error: synchronous external abort: 96000210 1 PREEMPT SMP
+ ...
+ Call trace:
+ regmap_mmio_read32le+0x24/0x48
+ regmap_mmio_read+0x48/0x70
+ _regmap_bus_reg_read+0x38/0x48
+ _regmap_read+0x68/0x1b0
+ regmap_read+0x50/0x78
+ regmap_read_debugfs+0x120/0x338
+
+Fixes: 1acbdeb92c87 ("spi/fsl-dspi: Convert to use regmap and add big-endian support")
+Co-developed-by: Xulin Sun <xulin.sun@windriver.com>
+Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-1-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 01930b52c4fb8..3f9609edac944 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ //
+ // Copyright 2013 Freescale Semiconductor, Inc.
+-// Copyright 2020 NXP
++// Copyright 2020-2025 NXP
+ //
+ // Freescale DSPI driver
+ // This file contains a driver for the Freescale DSPI
+@@ -1128,6 +1128,20 @@ static int dspi_resume(struct device *dev)
+
+ static SIMPLE_DEV_PM_OPS(dspi_pm, dspi_suspend, dspi_resume);
+
++static const struct regmap_range dspi_yes_ranges[] = {
++ regmap_reg_range(SPI_MCR, SPI_MCR),
++ regmap_reg_range(SPI_TCR, SPI_CTAR(3)),
++ regmap_reg_range(SPI_SR, SPI_TXFR3),
++ regmap_reg_range(SPI_RXFR0, SPI_RXFR3),
++ regmap_reg_range(SPI_CTARE(0), SPI_CTARE(3)),
++ regmap_reg_range(SPI_SREX, SPI_SREX),
++};
++
++static const struct regmap_access_table dspi_access_table = {
++ .yes_ranges = dspi_yes_ranges,
++ .n_yes_ranges = ARRAY_SIZE(dspi_yes_ranges),
++};
++
+ static const struct regmap_range dspi_volatile_ranges[] = {
+ regmap_reg_range(SPI_MCR, SPI_TCR),
+ regmap_reg_range(SPI_SR, SPI_SR),
+@@ -1145,6 +1159,8 @@ static const struct regmap_config dspi_regmap_config = {
+ .reg_stride = 4,
+ .max_register = 0x88,
+ .volatile_table = &dspi_volatile_table,
++ .rd_table = &dspi_access_table,
++ .wr_table = &dspi_access_table,
+ };
+
+ static const struct regmap_range dspi_xspi_volatile_ranges[] = {
+@@ -1166,6 +1182,8 @@ static const struct regmap_config dspi_xspi_regmap_config[] = {
+ .reg_stride = 4,
+ .max_register = 0x13c,
+ .volatile_table = &dspi_xspi_volatile_table,
++ .rd_table = &dspi_access_table,
++ .wr_table = &dspi_access_table,
+ },
+ {
+ .name = "pushr",
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
