--- /dev/null
+From adfab6b39202481bb43286fff94def4953793fdb Mon Sep 17 00:00:00 2001
+From: Jeremy Linton <jeremy.linton@arm.com>
+Date: Wed, 7 May 2025 21:30:25 -0500
+Subject: ACPI: PPTT: Fix processor subtable walk
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+commit adfab6b39202481bb43286fff94def4953793fdb upstream.
+
+The original PPTT code had a bug where the processor subtable length
+was not correctly validated when encountering a truncated
+acpi_pptt_processor node.
+
+Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of
+sizeof() calls") attempted to fix this by validating the size is as
+large as the acpi_pptt_processor node structure. This introduced a
+regression where the last processor node in the PPTT table is ignored
+if it doesn't contain any private resources. That results errors like:
+
+ ACPI PPTT: PPTT table found, but unable to locate core XX (XX)
+ ACPI: SPE must be homogeneous
+
+Furthermore, it fails in a common case where the node length isn't
+equal to the acpi_pptt_processor structure size, leaving the original
+bug in a modified form.
+
+Correct the regression by adjusting the loop termination conditions as
+suggested by the bug reporters. An additional check performed after
+the subtable node type is detected, validates the acpi_pptt_processor
+node is fully contained in the PPTT table. Repeating the check in
+acpi_pptt_leaf_node() is largely redundant as the node is already
+known to be fully contained in the table.
+
+The case where a final truncated node's parent property is accepted,
+but the node itself is rejected should not be considered a bug.
+
+Fixes: 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls")
+Reported-by: Maximilian Heyne <mheyne@amazon.de>
+Closes: https://lore.kernel.org/linux-acpi/20250506-draco-taped-15f475cd@mheyne-amazon/
+Reported-by: Yicong Yang <yangyicong@hisilicon.com>
+Closes: https://lore.kernel.org/linux-acpi/20250507035124.28071-1-yangyicong@huawei.com/
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Tested-by: Yicong Yang <yangyicong@hisilicon.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Maximilian Heyne <mheyne@amazon.de>
+Cc: All applicable <stable@vger.kernel.org> # 7ab4f0e37a0f4: ACPI PPTT: Fix coding mistakes ...
+Link: https://patch.msgid.link/20250508023025.1301030-1-jeremy.linton@arm.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/pptt.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -219,16 +219,18 @@ static int acpi_pptt_leaf_node(struct ac
+ sizeof(struct acpi_table_pptt));
+ proc_sz = sizeof(struct acpi_pptt_processor);
+
+- while ((unsigned long)entry + proc_sz < table_end) {
++ /* ignore subtable types that are smaller than a processor node */
++ while ((unsigned long)entry + proc_sz <= table_end) {
+ cpu_node = (struct acpi_pptt_processor *)entry;
++
+ if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&
+ cpu_node->parent == node_entry)
+ return 0;
+ if (entry->length == 0)
+ return 0;
++
+ entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry,
+ entry->length);
+-
+ }
+ return 1;
+ }
+@@ -261,15 +263,18 @@ static struct acpi_pptt_processor *acpi_
+ proc_sz = sizeof(struct acpi_pptt_processor);
+
+ /* find the processor structure associated with this cpuid */
+- while ((unsigned long)entry + proc_sz < table_end) {
++ while ((unsigned long)entry + proc_sz <= table_end) {
+ cpu_node = (struct acpi_pptt_processor *)entry;
+
+ if (entry->length == 0) {
+ pr_warn("Invalid zero length subtable\n");
+ break;
+ }
++ /* entry->length may not equal proc_sz, revalidate the processor structure length */
+ if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&
+ acpi_cpu_id == cpu_node->acpi_processor_id &&
++ (unsigned long)entry + entry->length <= table_end &&
++ entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) &&
+ acpi_pptt_leaf_node(table_hdr, cpu_node)) {
+ return (struct acpi_pptt_processor *)entry;
+ }
--- /dev/null
+From 9e000f1b7f31684cc5927e034360b87ac7919593 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Wed, 14 May 2025 17:24:44 +0800
+Subject: ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit 9e000f1b7f31684cc5927e034360b87ac7919593 upstream.
+
+The function snd_es1968_capture_open() calls the function
+snd_pcm_hw_constraint_pow2(), but does not check its return
+value. A proper implementation can be found in snd_cx25821_pcm_open().
+
+Add error handling for snd_pcm_hw_constraint_pow2() and propagate its
+error code.
+
+Fixes: b942cf815b57 ("[ALSA] es1968 - Fix stuttering capture")
+Cc: stable@vger.kernel.org # v2.6.22
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20250514092444.331-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/es1968.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/es1968.c
++++ b/sound/pci/es1968.c
+@@ -1569,7 +1569,7 @@ static int snd_es1968_capture_open(struc
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ struct es1968 *chip = snd_pcm_substream_chip(substream);
+ struct esschan *es;
+- int apu1, apu2;
++ int err, apu1, apu2;
+
+ apu1 = snd_es1968_alloc_apu_pair(chip, ESM_APU_PCM_CAPTURE);
+ if (apu1 < 0)
+@@ -1613,7 +1613,9 @@ static int snd_es1968_capture_open(struc
+ runtime->hw = snd_es1968_capture;
+ runtime->hw.buffer_bytes_max = runtime->hw.period_bytes_max =
+ calc_available_memory_size(chip) - 1024; /* keep MIXBUF size */
+- snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES);
++ err = snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES);
++ if (err < 0)
++ return err;
+
+ spin_lock_irq(&chip->substream_lock);
+ list_add(&es->list, &chip->substream_list);
--- /dev/null
+From 2b24eb060c2bb9ef79e1d3bcf633ba1bc95215d6 Mon Sep 17 00:00:00 2001
+From: Christian Heusel <christian@heusel.eu>
+Date: Mon, 12 May 2025 22:23:37 +0200
+Subject: ALSA: usb-audio: Add sample rate quirk for Audioengine D1
+
+From: Christian Heusel <christian@heusel.eu>
+
+commit 2b24eb060c2bb9ef79e1d3bcf633ba1bc95215d6 upstream.
+
+A user reported on the Arch Linux Forums that their device is emitting
+the following message in the kernel journal, which is fixed by adding
+the quirk as submitted in this patch:
+
+ > kernel: usb 1-2: current rate 8436480 is different from the runtime rate 48000
+
+There also is an entry for this product line added long time ago.
+Their specific device has the following ID:
+
+ $ lsusb | grep Audio
+ Bus 001 Device 002: ID 1101:0003 EasyPass Industrial Co., Ltd Audioengine D1
+
+Link: https://bbs.archlinux.org/viewtopic.php?id=305494
+Fixes: 93f9d1a4ac593 ("ALSA: usb-audio: Apply sample rate quirk for Audioengine D1")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Heusel <christian@heusel.eu>
+Link: https://patch.msgid.link/20250512-audioengine-quirk-addition-v1-1-4c370af6eff7@heusel.eu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1845,6 +1845,8 @@ static const struct usb_audio_quirk_flag
+ QUIRK_FLAG_FIXED_RATE),
+ DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */
+ QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
++ DEVICE_FLG(0x1101, 0x0003, /* Audioengine D1 */
++ QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */
+ QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
--- /dev/null
+From 7b9938a14460e8ec7649ca2e80ac0aae9815bf02 Mon Sep 17 00:00:00 2001
+From: Nicolas Chauvet <kwizart@gmail.com>
+Date: Thu, 15 May 2025 12:21:32 +0200
+Subject: ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
+
+From: Nicolas Chauvet <kwizart@gmail.com>
+
+commit 7b9938a14460e8ec7649ca2e80ac0aae9815bf02 upstream.
+
+Microdia JP001 does not support reading the sample rate which leads to
+many lines of "cannot get freq at ep 0x84".
+This patch adds the USB ID to quirks.c and avoids those error messages.
+
+usb 7-4: New USB device found, idVendor=0c45, idProduct=636b, bcdDevice= 1.00
+usb 7-4: New USB device strings: Mfr=2, Product=1, SerialNumber=3
+usb 7-4: Product: JP001
+usb 7-4: Manufacturer: JP001
+usb 7-4: SerialNumber: JP001
+usb 7-4: 3:1: cannot get freq at ep 0x84
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>
+Link: https://patch.msgid.link/20250515102132.73062-1-kwizart@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1837,6 +1837,8 @@ static const struct usb_audio_quirk_flag
+ QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */
+ QUIRK_FLAG_GET_SAMPLE_RATE),
++ DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */
++ QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */
+ QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */
--- /dev/null
+From 817bced19d1dbdd0b473580d026dc0983e30e17b Mon Sep 17 00:00:00 2001
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+Date: Fri, 4 Apr 2025 20:02:10 +0800
+Subject: dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
+
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+
+commit 817bced19d1dbdd0b473580d026dc0983e30e17b upstream.
+
+Memory allocated for engines is not freed if an error occurs during
+idxd_setup_engines(). To fix it, free the allocated memory in the
+reverse order of allocation before exiting the function in case of an
+error.
+
+Fixes: 75b911309060 ("dmaengine: idxd: fix engine conf_dev lifetime")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
+Link: https://lore.kernel.org/r/20250404120217.48772-3-xueshuai@linux.alibaba.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -289,6 +289,7 @@ static int idxd_setup_engines(struct idx
+ rc = dev_set_name(conf_dev, "engine%d.%d", idxd->id, engine->id);
+ if (rc < 0) {
+ put_device(conf_dev);
++ kfree(engine);
+ goto err;
+ }
+
+@@ -302,7 +303,10 @@ static int idxd_setup_engines(struct idx
+ engine = idxd->engines[i];
+ conf_dev = engine_confdev(engine);
+ put_device(conf_dev);
++ kfree(engine);
+ }
++ kfree(idxd->engines);
++
+ return rc;
+ }
+
--- /dev/null
+From aa6f4f945b10eac57aed46154ae7d6fada7fccc7 Mon Sep 17 00:00:00 2001
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+Date: Fri, 4 Apr 2025 20:02:11 +0800
+Subject: dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
+
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+
+commit aa6f4f945b10eac57aed46154ae7d6fada7fccc7 upstream.
+
+Memory allocated for groups is not freed if an error occurs during
+idxd_setup_groups(). To fix it, free the allocated memory in the reverse
+order of allocation before exiting the function in case of an error.
+
+Fixes: defe49f96012 ("dmaengine: idxd: fix group conf_dev lifetime")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
+Link: https://lore.kernel.org/r/20250404120217.48772-4-xueshuai@linux.alibaba.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -340,6 +340,7 @@ static int idxd_setup_groups(struct idxd
+ rc = dev_set_name(conf_dev, "group%d.%d", idxd->id, group->id);
+ if (rc < 0) {
+ put_device(conf_dev);
++ kfree(group);
+ goto err;
+ }
+
+@@ -359,7 +360,10 @@ static int idxd_setup_groups(struct idxd
+ while (--i >= 0) {
+ group = idxd->groups[i];
+ put_device(group_confdev(group));
++ kfree(group);
+ }
++ kfree(idxd->groups);
++
+ return rc;
+ }
+
--- /dev/null
+From fca280992af8c2fbd511bc43f65abb4a17363f2f Mon Sep 17 00:00:00 2001
+From: Ronald Wahl <ronald.wahl@legrand.com>
+Date: Mon, 14 Apr 2025 19:31:13 +0200
+Subject: dmaengine: ti: k3-udma: Add missing locking
+
+From: Ronald Wahl <ronald.wahl@legrand.com>
+
+commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream.
+
+Recent kernels complain about a missing lock in k3-udma.c when the lock
+validator is enabled:
+
+[ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238
+[ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28
+[ 4.144867] Hardware name: pp-v12 (DT)
+[ 4.148648] Workqueue: events udma_check_tx_completion
+[ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 4.160834] pc : udma_start.isra.0+0x34/0x238
+[ 4.165227] lr : udma_start.isra.0+0x30/0x238
+[ 4.169618] sp : ffffffc083cabcf0
+[ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005
+[ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000
+[ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670
+[ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030
+[ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048
+[ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001
+[ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68
+[ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8
+[ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000
+[ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000
+[ 4.244986] Call trace:
+[ 4.247463] udma_start.isra.0+0x34/0x238
+[ 4.251509] udma_check_tx_completion+0xd0/0xdc
+[ 4.256076] process_one_work+0x244/0x3fc
+[ 4.260129] process_scheduled_works+0x6c/0x74
+[ 4.264610] worker_thread+0x150/0x1dc
+[ 4.268398] kthread+0xd8/0xe8
+[ 4.271492] ret_from_fork+0x10/0x20
+[ 4.275107] irq event stamp: 220
+[ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50
+[ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50
+[ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc
+[ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28
+[ 4.311559] ---[ end trace 0000000000000000 ]---
+
+This commit adds the missing locking.
+
+Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Vignesh Raghavendra <vigneshr@ti.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: dmaengine@vger.kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Ronald Wahl <ronald.wahl@legrand.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20250414173113.80677-1-rwahl@gmx.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/dma/ti/k3-udma.c
++++ b/drivers/dma/ti/k3-udma.c
+@@ -1082,8 +1082,11 @@ static void udma_check_tx_completion(str
+ u32 residue_diff;
+ ktime_t time_diff;
+ unsigned long delay;
++ unsigned long flags;
+
+ while (1) {
++ spin_lock_irqsave(&uc->vc.lock, flags);
++
+ if (uc->desc) {
+ /* Get previous residue and time stamp */
+ residue_diff = uc->tx_drain.residue;
+@@ -1118,6 +1121,8 @@ static void udma_check_tx_completion(str
+ break;
+ }
+
++ spin_unlock_irqrestore(&uc->vc.lock, flags);
++
+ usleep_range(ktime_to_us(delay),
+ ktime_to_us(delay) + 10);
+ continue;
+@@ -1134,6 +1139,8 @@ static void udma_check_tx_completion(str
+
+ break;
+ }
++
++ spin_unlock_irqrestore(&uc->vc.lock, flags);
+ }
+
+ static irqreturn_t udma_ring_irq_handler(int irq, void *data)
--- /dev/null
+From 8ca9590c39b69b55a8de63d2b21b0d44f523b43a Mon Sep 17 00:00:00 2001
+From: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+Date: Thu, 17 Apr 2025 13:25:21 +0530
+Subject: dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
+
+From: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+
+commit 8ca9590c39b69b55a8de63d2b21b0d44f523b43a upstream.
+
+Currently, a local dma_cap_mask_t variable is used to store device
+cap_mask within udma_of_xlate(). However, the DMA_PRIVATE flag in
+the device cap_mask can get cleared when the last channel is released.
+This can happen right after storing the cap_mask locally in
+udma_of_xlate(), and subsequent dma_request_channel() can fail due to
+mismatch in the cap_mask. Fix this by removing the local dma_cap_mask_t
+variable and directly using the one from the dma_device structure.
+
+Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Signed-off-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+Link: https://lore.kernel.org/r/20250417075521.623651-1-y-abhilashchandra@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/dma/ti/k3-udma.c
++++ b/drivers/dma/ti/k3-udma.c
+@@ -4210,7 +4210,6 @@ static struct dma_chan *udma_of_xlate(st
+ struct of_dma *ofdma)
+ {
+ struct udma_dev *ud = ofdma->of_dma_data;
+- dma_cap_mask_t mask = ud->ddev.cap_mask;
+ struct udma_filter_param filter_param;
+ struct dma_chan *chan;
+
+@@ -4242,7 +4241,7 @@ static struct dma_chan *udma_of_xlate(st
+ }
+ }
+
+- chan = __dma_request_channel(&mask, udma_dma_filter_fn, &filter_param,
++ chan = __dma_request_channel(&ud->ddev.cap_mask, udma_dma_filter_fn, &filter_param,
+ ofdma->of_node);
+ if (!chan) {
+ dev_err(ud->dev, "get channel fail in %s.\n", __func__);
--- /dev/null
+From 11aff32439df6ca5b3b891b43032faf88f4a6a29 Mon Sep 17 00:00:00 2001
+From: pengdonglin <pengdonglin@xiaomi.com>
+Date: Mon, 12 May 2025 17:42:46 +0800
+Subject: ftrace: Fix preemption accounting for stacktrace filter command
+
+From: pengdonglin <pengdonglin@xiaomi.com>
+
+commit 11aff32439df6ca5b3b891b43032faf88f4a6a29 upstream.
+
+The preemption count of the stacktrace filter command to trace ksys_read
+is consistently incorrect:
+
+$ echo ksys_read:stacktrace > set_ftrace_filter
+
+ <...>-453 [004] ...1. 38.308956: <stack trace>
+=> ksys_read
+=> do_syscall_64
+=> entry_SYSCALL_64_after_hwframe
+
+The root cause is that the trace framework disables preemption when
+invoking the filter command callback in function_trace_probe_call:
+
+ preempt_disable_notrace();
+ probe_ops->func(ip, parent_ip, probe_opsbe->tr, probe_ops, probe->data);
+ preempt_enable_notrace();
+
+Use tracing_gen_ctx_dec() to account for the preempt_disable_notrace(),
+which will output the correct preemption count:
+
+$ echo ksys_read:stacktrace > set_ftrace_filter
+
+ <...>-410 [006] ..... 31.420396: <stack trace>
+=> ksys_read
+=> do_syscall_64
+=> entry_SYSCALL_64_after_hwframe
+
+Cc: stable@vger.kernel.org
+Fixes: 36590c50b2d07 ("tracing: Merge irqflags + preempt counter.")
+Link: https://lore.kernel.org/20250512094246.1167956-2-dolinux.peng@gmail.com
+Signed-off-by: pengdonglin <dolinux.peng@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_functions.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/kernel/trace/trace_functions.c
++++ b/kernel/trace/trace_functions.c
+@@ -568,11 +568,7 @@ ftrace_traceoff(unsigned long ip, unsign
+
+ static __always_inline void trace_stack(struct trace_array *tr)
+ {
+- unsigned int trace_ctx;
+-
+- trace_ctx = tracing_gen_ctx();
+-
+- __trace_stack(tr, trace_ctx, FTRACE_STACK_SKIP);
++ __trace_stack(tr, tracing_gen_ctx_dec(), FTRACE_STACK_SKIP);
+ }
+
+ static void
--- /dev/null
+From e333332657f615ac2b55aa35565c4a882018bbe9 Mon Sep 17 00:00:00 2001
+From: pengdonglin <pengdonglin@xiaomi.com>
+Date: Mon, 12 May 2025 17:42:45 +0800
+Subject: ftrace: Fix preemption accounting for stacktrace trigger command
+
+From: pengdonglin <pengdonglin@xiaomi.com>
+
+commit e333332657f615ac2b55aa35565c4a882018bbe9 upstream.
+
+When using the stacktrace trigger command to trace syscalls, the
+preemption count was consistently reported as 1 when the system call
+event itself had 0 (".").
+
+For example:
+
+root@ubuntu22-vm:/sys/kernel/tracing/events/syscalls/sys_enter_read
+$ echo stacktrace > trigger
+$ echo 1 > enable
+
+ sshd-416 [002] ..... 232.864910: sys_read(fd: a, buf: 556b1f3221d0, count: 8000)
+ sshd-416 [002] ...1. 232.864913: <stack trace>
+ => ftrace_syscall_enter
+ => syscall_trace_enter
+ => do_syscall_64
+ => entry_SYSCALL_64_after_hwframe
+
+The root cause is that the trace framework disables preemption in __DO_TRACE before
+invoking the trigger callback.
+
+Use the tracing_gen_ctx_dec() that will accommodate for the increase of
+the preemption count in __DO_TRACE when calling the callback. The result
+is the accurate reporting of:
+
+ sshd-410 [004] ..... 210.117660: sys_read(fd: 4, buf: 559b725ba130, count: 40000)
+ sshd-410 [004] ..... 210.117662: <stack trace>
+ => ftrace_syscall_enter
+ => syscall_trace_enter
+ => do_syscall_64
+ => entry_SYSCALL_64_after_hwframe
+
+Cc: stable@vger.kernel.org
+Fixes: ce33c845b030c ("tracing: Dump stacktrace trigger to the corresponding instance")
+Link: https://lore.kernel.org/20250512094246.1167956-1-dolinux.peng@gmail.com
+Signed-off-by: pengdonglin <dolinux.peng@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_trigger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -1244,7 +1244,7 @@ stacktrace_trigger(struct event_trigger_
+ struct trace_event_file *file = data->private_data;
+
+ if (file)
+- __trace_stack(file->tr, tracing_gen_ctx(), STACK_SKIP);
++ __trace_stack(file->tr, tracing_gen_ctx_dec(), STACK_SKIP);
+ else
+ trace_dump_stack(STACK_SKIP);
+ }
--- /dev/null
+From b2ea5f49580c0762d17d80d8083cb89bc3acf74f Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Mon, 3 Mar 2025 15:27:39 +0800
+Subject: phy: Fix error handling in tegra_xusb_port_init
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit b2ea5f49580c0762d17d80d8083cb89bc3acf74f upstream.
+
+If device_add() fails, do not use device_unregister() for error
+handling. device_unregister() consists two functions: device_del() and
+put_device(). device_unregister() should only be called after
+device_add() succeeded because device_del() undoes what device_add()
+does if successful. Change device_unregister() to put_device() call
+before returning from the function.
+
+As comment of device_add() says, 'if device_add() succeeds, you should
+call device_del() when you want to get rid of it. If device_add() has
+not succeeded, use only put_device() to drop the reference count'.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250303072739.3874987-1-make24@iscas.ac.cn
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -542,16 +542,16 @@ static int tegra_xusb_port_init(struct t
+
+ err = dev_set_name(&port->dev, "%s-%u", name, index);
+ if (err < 0)
+- goto unregister;
++ goto put_device;
+
+ err = device_add(&port->dev);
+ if (err < 0)
+- goto unregister;
++ goto put_device;
+
+ return 0;
+
+-unregister:
+- device_unregister(&port->dev);
++put_device:
++ put_device(&port->dev);
+ return err;
+ }
+
--- /dev/null
+From 54c4c58713aaff76c2422ff5750e557ab3b100d7 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Date: Wed, 7 May 2025 15:50:28 +0300
+Subject: phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 54c4c58713aaff76c2422ff5750e557ab3b100d7 upstream.
+
+It has been observed on the Renesas RZ/G3S SoC that unbinding and binding
+the PHY driver leads to role autodetection failures. This issue occurs when
+PHY 3 is the first initialized PHY. PHY 3 does not have an interrupt
+associated with the USB2_INT_ENABLE register (as
+rcar_gen3_int_enable[3] = 0). As a result, rcar_gen3_init_otg() is called
+to initialize OTG without enabling PHY interrupts.
+
+To resolve this, add rcar_gen3_is_any_otg_rphy_initialized() and call it in
+role_store(), role_show(), and rcar_gen3_init_otg(). At the same time,
+rcar_gen3_init_otg() is only called when initialization for a PHY with
+interrupt bits is in progress. As a result, the
+struct rcar_gen3_phy::otg_initialized is no longer needed.
+
+Fixes: 549b6b55b005 ("phy: renesas: rcar-gen3-usb2: enable/disable independent irqs")
+Cc: stable@vger.kernel.org
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250507125032.565017-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 33 +++++++++++++------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -103,7 +103,6 @@ struct rcar_gen3_phy {
+ struct rcar_gen3_chan *ch;
+ u32 int_enable_bits;
+ bool initialized;
+- bool otg_initialized;
+ bool powered;
+ };
+
+@@ -311,16 +310,15 @@ static bool rcar_gen3_is_any_rphy_initia
+ return false;
+ }
+
+-static bool rcar_gen3_needs_init_otg(struct rcar_gen3_chan *ch)
++static bool rcar_gen3_is_any_otg_rphy_initialized(struct rcar_gen3_chan *ch)
+ {
+- int i;
+-
+- for (i = 0; i < NUM_OF_PHYS; i++) {
+- if (ch->rphys[i].otg_initialized)
+- return false;
++ for (enum rcar_gen3_phy_index i = PHY_INDEX_BOTH_HC; i <= PHY_INDEX_EHCI;
++ i++) {
++ if (ch->rphys[i].initialized)
++ return true;
+ }
+
+- return true;
++ return false;
+ }
+
+ static bool rcar_gen3_are_all_rphys_power_off(struct rcar_gen3_chan *ch)
+@@ -342,7 +340,7 @@ static ssize_t role_store(struct device
+ bool is_b_device;
+ enum phy_mode cur_mode, new_mode;
+
+- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch))
++ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch))
+ return -EIO;
+
+ if (sysfs_streq(buf, "host"))
+@@ -380,7 +378,7 @@ static ssize_t role_show(struct device *
+ {
+ struct rcar_gen3_chan *ch = dev_get_drvdata(dev);
+
+- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch))
++ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch))
+ return -EIO;
+
+ return sprintf(buf, "%s\n", rcar_gen3_is_host(ch) ? "host" :
+@@ -393,6 +391,9 @@ static void rcar_gen3_init_otg(struct rc
+ void __iomem *usb2_base = ch->base;
+ u32 val;
+
++ if (!ch->is_otg_channel || rcar_gen3_is_any_otg_rphy_initialized(ch))
++ return;
++
+ /* Should not use functions of read-modify-write a register */
+ val = readl(usb2_base + USB2_LINECTRL1);
+ val = (val & ~USB2_LINECTRL1_DP_RPD) | USB2_LINECTRL1_DPRPD_EN |
+@@ -456,12 +457,9 @@ static int rcar_gen3_phy_usb2_init(struc
+ writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET);
+ writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET);
+
+- /* Initialize otg part */
+- if (channel->is_otg_channel) {
+- if (rcar_gen3_needs_init_otg(channel))
+- rcar_gen3_init_otg(channel);
+- rphy->otg_initialized = true;
+- }
++ /* Initialize otg part (only if we initialize a PHY with IRQs). */
++ if (rphy->int_enable_bits)
++ rcar_gen3_init_otg(channel);
+
+ rphy->initialized = true;
+
+@@ -477,9 +475,6 @@ static int rcar_gen3_phy_usb2_exit(struc
+
+ rphy->initialized = false;
+
+- if (channel->is_otg_channel)
+- rphy->otg_initialized = false;
+-
+ val = readl(usb2_base + USB2_INT_ENABLE);
+ val &= ~rphy->int_enable_bits;
+ if (!rcar_gen3_is_any_rphy_initialized(channel))
--- /dev/null
+From 86e70849f4b2b4597ac9f7c7931f2a363774be25 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Date: Wed, 7 May 2025 15:50:32 +0300
+Subject: phy: renesas: rcar-gen3-usb2: Set timing registers only once
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 86e70849f4b2b4597ac9f7c7931f2a363774be25 upstream.
+
+phy-rcar-gen3-usb2 driver exports 4 PHYs. The timing registers are common
+to all PHYs. There is no need to set them every time a PHY is initialized.
+Set timing register only when the 1st PHY is initialized.
+
+Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250507125032.565017-6-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -454,8 +454,11 @@ static int rcar_gen3_phy_usb2_init(struc
+ val = readl(usb2_base + USB2_INT_ENABLE);
+ val |= USB2_INT_ENABLE_UCOM_INTEN | rphy->int_enable_bits;
+ writel(val, usb2_base + USB2_INT_ENABLE);
+- writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET);
+- writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET);
++
++ if (!rcar_gen3_is_any_rphy_initialized(channel)) {
++ writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET);
++ writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET);
++ }
+
+ /* Initialize otg part (only if we initialize a PHY with IRQs). */
+ if (rphy->int_enable_bits)
x86-its-fineibt-paranoid-vs-its.patch
dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch
btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch
+acpi-pptt-fix-processor-subtable-walk.patch
+alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch
+alsa-usb-audio-add-sample-rate-quirk-for-audioengine-d1.patch
+alsa-usb-audio-add-sample-rate-quirk-for-microdia-jp001-usb-camera.patch
+ftrace-fix-preemption-accounting-for-stacktrace-trigger-command.patch
+ftrace-fix-preemption-accounting-for-stacktrace-filter-command.patch
+tracing-samples-initialize-trace_array_printk-with-the-correct-function.patch
+phy-fix-error-handling-in-tegra_xusb_port_init.patch
+phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch
+phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch
+wifi-mt76-disable-napi-on-driver-removal.patch
+dmaengine-ti-k3-udma-add-missing-locking.patch
+dmaengine-ti-k3-udma-use-cap_mask-directly-from-dma_device-structure-instead-of-a-local-copy.patch
+dmaengine-idxd-fix-memory-leak-in-error-handling-path-of-idxd_setup_engines.patch
+dmaengine-idxd-fix-memory-leak-in-error-handling-path-of-idxd_setup_groups.patch
--- /dev/null
+From 1b0c192c92ea1fe2dcb178f84adf15fe37c3e7c8 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Fri, 9 May 2025 15:26:57 -0400
+Subject: tracing: samples: Initialize trace_array_printk() with the correct function
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 1b0c192c92ea1fe2dcb178f84adf15fe37c3e7c8 upstream.
+
+When using trace_array_printk() on a created instance, the correct
+function to use to initialize it is:
+
+ trace_array_init_printk()
+
+Not
+
+ trace_printk_init_buffer()
+
+The former is a proper function to use, the latter is for initializing
+trace_printk() and causes the NOTICE banner to be displayed.
+
+Cc: stable@vger.kernel.org
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Divya Indi <divya.indi@oracle.com>
+Link: https://lore.kernel.org/20250509152657.0f6744d9@gandalf.local.home
+Fixes: 89ed42495ef4a ("tracing: Sample module to demonstrate kernel access to Ftrace instances.")
+Fixes: 38ce2a9e33db6 ("tracing: Add trace_array_init_printk() to initialize instance trace_printk() buffers")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ samples/ftrace/sample-trace-array.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/samples/ftrace/sample-trace-array.c
++++ b/samples/ftrace/sample-trace-array.c
+@@ -112,7 +112,7 @@ static int __init sample_trace_array_ini
+ /*
+ * If context specific per-cpu buffers havent already been allocated.
+ */
+- trace_printk_init_buffers();
++ trace_array_init_printk(tr);
+
+ simple_tsk = kthread_run(simple_thread, NULL, "sample-instance");
+ if (IS_ERR(simple_tsk)) {
--- /dev/null
+From 78ab4be549533432d97ea8989d2f00b508fa68d8 Mon Sep 17 00:00:00 2001
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+Date: Tue, 6 May 2025 14:55:39 +0300
+Subject: wifi: mt76: disable napi on driver removal
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+commit 78ab4be549533432d97ea8989d2f00b508fa68d8 upstream.
+
+A warning on driver removal started occurring after commit 9dd05df8403b
+("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
+deleting it in mt76_dma_cleanup().
+
+ WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
+ CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
+ Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
+ RIP: 0010:__netif_napi_del_locked+0xf0/0x100
+ Call Trace:
+ <TASK>
+ mt76_dma_cleanup+0x54/0x2f0 [mt76]
+ mt7921_pci_remove+0xd5/0x190 [mt7921e]
+ pci_device_remove+0x47/0xc0
+ device_release_driver_internal+0x19e/0x200
+ driver_detach+0x48/0x90
+ bus_remove_driver+0x6d/0xf0
+ pci_unregister_driver+0x2e/0xb0
+ __do_sys_delete_module.isra.0+0x197/0x2e0
+ do_syscall_64+0x7b/0x160
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Tested with mt7921e but the same pattern can be actually applied to other
+mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled
+in their *_dma_init() functions and only toggled off and on again inside
+their suspend/resume/reset paths. So it should be okay to disable tx
+napi in such a generic way.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: 2ac515a5d74f ("mt76: mt76x02: use napi polling for tx cleanup")
+Cc: stable@vger.kernel.org
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Tested-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Link: https://patch.msgid.link/20250506115540.19045-1-pchelkin@ispras.ru
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -684,6 +684,7 @@ void mt76_dma_cleanup(struct mt76_dev *d
+ int i;
+
+ mt76_worker_disable(&dev->tx_worker);
++ napi_disable(&dev->tx_napi);
+ netif_napi_del(&dev->tx_napi);
+
+ for (i = 0; i < ARRAY_SIZE(dev->phy.q_tx); i++) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
