From: Greg Kroah-Hartman Date: Mon, 1 Dec 2025 15:16:21 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v5.4.302~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=47c5487776fbacd6929ee764d9ac1555bc595e64;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: iio-accel-bmc150-fix-irq-assumption-regression.patch iio-accel-fix-adxl355-startup-race-condition.patch iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch iio-adc-rtq6056-correct-the-sign-bit-index.patch iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch iio-buffer-dma-support-getting-the-dma-channel.patch iio-buffer-dmaengine-enable-.get_dma_dev.patch iio-buffer-support-getting-dma-channel-from-the-buffer.patch iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch revert-drm-amd-display-move-setup_stream_attribute.patch revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch --- diff --git a/queue-6.12/iio-accel-bmc150-fix-irq-assumption-regression.patch b/queue-6.12/iio-accel-bmc150-fix-irq-assumption-regression.patch new file mode 100644 index 0000000000..40019b2050 --- /dev/null +++ b/queue-6.12/iio-accel-bmc150-fix-irq-assumption-regression.patch @@ -0,0 +1,78 @@ +From 3aa385a9c75c09b59dcab2ff76423439d23673ab Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 3 Nov 2025 10:36:18 +0100 +Subject: iio: accel: bmc150: Fix irq assumption regression +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Walleij + +commit 3aa385a9c75c09b59dcab2ff76423439d23673ab upstream. + +The code in bmc150-accel-core.c unconditionally calls +bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, +such as on the runtime PM resume path giving a kernel +splat like this if the device has no interrupts: + +Unable to handle kernel NULL pointer dereference at virtual + address 00000001 when read + +PC is at bmc150_accel_set_interrupt+0x98/0x194 +LR is at __pm_runtime_resume+0x5c/0x64 +(...) +Call trace: +bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 +bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc +__iio_update_buffers from enable_store+0x84/0xc8 +enable_store from kernfs_fop_write_iter+0x154/0x1b4 + +This bug seems to have been in the driver since the beginning, +but it only manifests recently, I do not know why. + +Store the IRQ number in the state struct, as this is a common +pattern in other drivers, then use this to determine if we have +IRQ support or not. + +Cc: stable@vger.kernel.org +Signed-off-by: Linus Walleij +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/bmc150-accel-core.c | 5 +++++ + drivers/iio/accel/bmc150-accel.h | 1 + + 2 files changed, 6 insertions(+) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -529,6 +529,10 @@ static int bmc150_accel_set_interrupt(st + const struct bmc150_accel_interrupt_info *info = intr->info; + int ret; + ++ /* We do not always have an IRQ */ ++ if (data->irq <= 0) ++ return 0; ++ + if (state) { + if (atomic_inc_return(&intr->users) > 1) + return 0; +@@ -1702,6 +1706,7 @@ int bmc150_accel_core_probe(struct devic + } + + if (irq > 0) { ++ data->irq = irq; + ret = devm_request_threaded_irq(dev, irq, + bmc150_accel_irq_handler, + bmc150_accel_irq_thread_handler, +--- a/drivers/iio/accel/bmc150-accel.h ++++ b/drivers/iio/accel/bmc150-accel.h +@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id { + + struct bmc150_accel_data { + struct regmap *regmap; ++ int irq; + struct regulator_bulk_data regulators[2]; + struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; + struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; diff --git a/queue-6.12/iio-accel-fix-adxl355-startup-race-condition.patch b/queue-6.12/iio-accel-fix-adxl355-startup-race-condition.patch new file mode 100644 index 0000000000..dae0f536cc --- /dev/null +++ b/queue-6.12/iio-accel-fix-adxl355-startup-race-condition.patch @@ -0,0 +1,95 @@ +From c92c1bc408e9e11ae3c7011b062fdd74c09283a3 Mon Sep 17 00:00:00 2001 +From: Valek Andrej +Date: Tue, 14 Oct 2025 09:13:44 +0200 +Subject: iio: accel: fix ADXL355 startup race condition + +From: Valek Andrej + +commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 upstream. + +There is an race-condition where device is not full working after SW reset. +Therefore it's necessary to wait some time after reset and verify shadow +registers values by reading and comparing the values before/after reset. +This mechanism is described in datasheet at least from revision D. + +Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355") +Signed-off-by: Valek Andrej +Signed-off-by: Kessler Markus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl355_core.c | 44 ++++++++++++++++++++++++++++++++++----- + 1 file changed, 39 insertions(+), 5 deletions(-) + +--- a/drivers/iio/accel/adxl355_core.c ++++ b/drivers/iio/accel/adxl355_core.c +@@ -56,6 +56,8 @@ + #define ADXL355_POWER_CTL_DRDY_MSK BIT(2) + #define ADXL355_SELF_TEST_REG 0x2E + #define ADXL355_RESET_REG 0x2F ++#define ADXL355_BASE_ADDR_SHADOW_REG 0x50 ++#define ADXL355_SHADOW_REG_COUNT 5 + + #define ADXL355_DEVID_AD_VAL 0xAD + #define ADXL355_DEVID_MST_VAL 0x1D +@@ -294,7 +296,12 @@ static void adxl355_fill_3db_frequency_t + static int adxl355_setup(struct adxl355_data *data) + { + unsigned int regval; ++ int retries = 5; /* the number is chosen based on empirical reasons */ + int ret; ++ u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL); ++ ++ if (!shadow_regs) ++ return -ENOMEM; + + ret = regmap_read(data->regmap, ADXL355_DEVID_AD_REG, ®val); + if (ret) +@@ -321,14 +328,41 @@ static int adxl355_setup(struct adxl355_ + if (regval != ADXL355_PARTID_VAL) + dev_warn(data->dev, "Invalid DEV ID 0x%02x\n", regval); + +- /* +- * Perform a software reset to make sure the device is in a consistent +- * state after start-up. +- */ +- ret = regmap_write(data->regmap, ADXL355_RESET_REG, ADXL355_RESET_CODE); ++ /* Read shadow registers to be compared after reset */ ++ ret = regmap_bulk_read(data->regmap, ++ ADXL355_BASE_ADDR_SHADOW_REG, ++ shadow_regs, ADXL355_SHADOW_REG_COUNT); + if (ret) + return ret; + ++ do { ++ if (--retries == 0) { ++ dev_err(data->dev, "Shadow registers mismatch\n"); ++ return -EIO; ++ } ++ ++ /* ++ * Perform a software reset to make sure the device is in a consistent ++ * state after start-up. ++ */ ++ ret = regmap_write(data->regmap, ADXL355_RESET_REG, ++ ADXL355_RESET_CODE); ++ if (ret) ++ return ret; ++ ++ /* Wait at least 5ms after software reset */ ++ usleep_range(5000, 10000); ++ ++ /* Read shadow registers for comparison */ ++ ret = regmap_bulk_read(data->regmap, ++ ADXL355_BASE_ADDR_SHADOW_REG, ++ data->buffer.buf, ++ ADXL355_SHADOW_REG_COUNT); ++ if (ret) ++ return ret; ++ } while (memcmp(shadow_regs, data->buffer.buf, ++ ADXL355_SHADOW_REG_COUNT)); ++ + ret = regmap_update_bits(data->regmap, ADXL355_POWER_CTL_REG, + ADXL355_POWER_CTL_DRDY_MSK, + FIELD_PREP(ADXL355_POWER_CTL_DRDY_MSK, 1)); diff --git a/queue-6.12/iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch b/queue-6.12/iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch new file mode 100644 index 0000000000..ba8ce0f8a8 --- /dev/null +++ b/queue-6.12/iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch @@ -0,0 +1,40 @@ +From bd886cdcbf9e746f61c74035a3acd42e9108e115 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Fri, 10 Oct 2025 10:44:45 -0500 +Subject: iio: adc: ad7280a: fix ad7280_store_balance_timer() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Lechner + +commit bd886cdcbf9e746f61c74035a3acd42e9108e115 upstream. + +Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places. + +iio_str_to_fixpoint() has a bit of an unintuitive API where the +fract_mult parameter is the multiplier of the first decimal place as if +it was already an integer. So to get 3 decimal places, fract_mult must +be 100 rather than 1000. + +Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming") +Signed-off-by: David Lechner +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7280a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7280a.c ++++ b/drivers/iio/adc/ad7280a.c +@@ -541,7 +541,7 @@ static ssize_t ad7280_store_balance_time + int val, val2; + int ret; + +- ret = iio_str_to_fixpoint(buf, 1000, &val, &val2); ++ ret = iio_str_to_fixpoint(buf, 100, &val, &val2); + if (ret) + return ret; + diff --git a/queue-6.12/iio-adc-rtq6056-correct-the-sign-bit-index.patch b/queue-6.12/iio-adc-rtq6056-correct-the-sign-bit-index.patch new file mode 100644 index 0000000000..7c63a609bb --- /dev/null +++ b/queue-6.12/iio-adc-rtq6056-correct-the-sign-bit-index.patch @@ -0,0 +1,34 @@ +From 9b45744bf09fc2a3287e05287141d6e123c125a7 Mon Sep 17 00:00:00 2001 +From: ChiYuan Huang +Date: Thu, 18 Sep 2025 11:10:59 +0800 +Subject: iio: adc: rtq6056: Correct the sign bit index + +From: ChiYuan Huang + +commit 9b45744bf09fc2a3287e05287141d6e123c125a7 upstream. + +The vshunt/current reported register is a signed 16bit integer. The +sign bit index should be '15', not '16'. + +Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support") +Reported-by: Andy Hsu +Signed-off-by: ChiYuan Huang +Reviewed-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/rtq6056.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/rtq6056.c ++++ b/drivers/iio/adc/rtq6056.c +@@ -300,7 +300,7 @@ static int rtq6056_adc_read_channel(stru + return IIO_VAL_INT; + case RTQ6056_REG_SHUNTVOLT: + case RTQ6056_REG_CURRENT: +- *val = sign_extend32(regval, 16); ++ *val = sign_extend32(regval, 15); + return IIO_VAL_INT; + default: + return -EINVAL; diff --git a/queue-6.12/iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch b/queue-6.12/iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch new file mode 100644 index 0000000000..953f77d0fc --- /dev/null +++ b/queue-6.12/iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch @@ -0,0 +1,43 @@ +From 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Thu, 2 Oct 2025 13:22:49 +0200 +Subject: iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Olivier Moysan + +commit 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de upstream. + +Initially st,adc-alt-channel property was defined as an enum in the DFSDM +binding. The DFSDM binding has been changed to use the new IIO backend +framework, along with the adoption of IIO generic channels. +In this new binding st,adc-alt-channel is defined as a boolean property, +but it is still handled has an enum in DFSDM driver. +Fix st,adc-alt-channel property handling in DFSDM driver. + +Fixes: 3208fa0cd919 ("iio: adc: stm32-dfsdm: adopt generic channels bindings") +Signed-off-by: Olivier Moysan +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/stm32-dfsdm-adc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -721,9 +721,8 @@ static int stm32_dfsdm_generic_channel_p + } + df_ch->src = val; + +- ret = fwnode_property_read_u32(node, "st,adc-alt-channel", &df_ch->alt_si); +- if (ret != -EINVAL) +- df_ch->alt_si = 0; ++ if (fwnode_property_present(node, "st,adc-alt-channel")) ++ df_ch->alt_si = 1; + + if (adc->dev_data->type == DFSDM_IIO) { + backend = devm_iio_backend_fwnode_get(&indio_dev->dev, NULL, node); diff --git a/queue-6.12/iio-buffer-dma-support-getting-the-dma-channel.patch b/queue-6.12/iio-buffer-dma-support-getting-the-dma-channel.patch new file mode 100644 index 0000000000..5dd80822ec --- /dev/null +++ b/queue-6.12/iio-buffer-dma-support-getting-the-dma-channel.patch @@ -0,0 +1,55 @@ +From f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Tue, 7 Oct 2025 10:15:22 +0100 +Subject: iio: buffer-dma: support getting the DMA channel +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +commit f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 upstream. + +Implement the .get_dma_dev() callback for DMA buffers by returning the +device that owns the DMA channel. This allows the core DMABUF +infrastructure to properly map DMA buffers using the correct device, +avoiding the need for bounce buffers on systems where memory is mapped +above the 32-bit range. + +The function returns the DMA queue's device, which is the actual device +responsible for DMA operations in buffer-dma implementations. + +Cc: stable@vger.kernel.org +Reviewed-by: David Lechner +Signed-off-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/buffer/industrialio-buffer-dma.c | 6 ++++++ + include/linux/iio/buffer-dma.h | 1 + + 2 files changed, 7 insertions(+) + +--- a/drivers/iio/buffer/industrialio-buffer-dma.c ++++ b/drivers/iio/buffer/industrialio-buffer-dma.c +@@ -786,6 +786,12 @@ out_end_signalling: + } + EXPORT_SYMBOL_NS_GPL(iio_dma_buffer_enqueue_dmabuf, IIO_DMA_BUFFER); + ++struct device *iio_dma_buffer_get_dma_dev(struct iio_buffer *buffer) ++{ ++ return iio_buffer_to_queue(buffer)->dev; ++} ++EXPORT_SYMBOL_NS_GPL(iio_dma_buffer_get_dma_dev, IIO_DMA_BUFFER); ++ + void iio_dma_buffer_lock_queue(struct iio_buffer *buffer) + { + struct iio_dma_buffer_queue *queue = iio_buffer_to_queue(buffer); +--- a/include/linux/iio/buffer-dma.h ++++ b/include/linux/iio/buffer-dma.h +@@ -174,5 +174,6 @@ int iio_dma_buffer_enqueue_dmabuf(struct + size_t size, bool cyclic); + void iio_dma_buffer_lock_queue(struct iio_buffer *buffer); + void iio_dma_buffer_unlock_queue(struct iio_buffer *buffer); ++struct device *iio_dma_buffer_get_dma_dev(struct iio_buffer *buffer); + + #endif diff --git a/queue-6.12/iio-buffer-dmaengine-enable-.get_dma_dev.patch b/queue-6.12/iio-buffer-dmaengine-enable-.get_dma_dev.patch new file mode 100644 index 0000000000..4df3714d70 --- /dev/null +++ b/queue-6.12/iio-buffer-dmaengine-enable-.get_dma_dev.patch @@ -0,0 +1,42 @@ +From 3db847df994d475db7812dde90376f2848bcd30a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Tue, 7 Oct 2025 10:15:23 +0100 +Subject: iio: buffer-dmaengine: enable .get_dma_dev() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +commit 3db847df994d475db7812dde90376f2848bcd30a upstream. + +Wire up the .get_dma_dev() callback to use the DMA buffer infrastructure's +implementation. This ensures that DMABUF operations use the correct DMA +device for mapping, which is essential for proper operation on systems +where memory is mapped above the 32-bit range. + +Without this callback, the core would fall back to using the IIO device's +parent, which may not have the appropriate DMA mask configuration for +high memory access. + +Fixes: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API") +Reviewed-by: David Lechner +Signed-off-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/buffer/industrialio-buffer-dmaengine.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c ++++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c +@@ -177,6 +177,8 @@ static const struct iio_buffer_access_fu + .lock_queue = iio_dma_buffer_lock_queue, + .unlock_queue = iio_dma_buffer_unlock_queue, + ++ .get_dma_dev = iio_dma_buffer_get_dma_dev, ++ + .modes = INDIO_BUFFER_HARDWARE, + .flags = INDIO_BUFFER_FLAG_FIXED_WATERMARK, + }; diff --git a/queue-6.12/iio-buffer-support-getting-dma-channel-from-the-buffer.patch b/queue-6.12/iio-buffer-support-getting-dma-channel-from-the-buffer.patch new file mode 100644 index 0000000000..f0b2f8ea78 --- /dev/null +++ b/queue-6.12/iio-buffer-support-getting-dma-channel-from-the-buffer.patch @@ -0,0 +1,128 @@ +From a514bb109eada64f798f1c86c17182229cc20fe7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Tue, 7 Oct 2025 10:15:21 +0100 +Subject: iio: buffer: support getting dma channel from the buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +commit a514bb109eada64f798f1c86c17182229cc20fe7 upstream. + +Add a new buffer accessor .get_dma_dev() in order to get the +struct device responsible for actually providing the dma channel. We +cannot assume that we can use the parent of the IIO device for mapping +the DMA buffer. This becomes important on systems (like the Xilinx/AMD +zynqMP Ultrascale) where memory (or part of it) is mapped above the +32 bit range. On such systems and given that a device by default has +a dma mask of 32 bits we would then need to rely on bounce buffers (to +swiotlb) for mapping memory above the dma mask limit. + +In the process, add an iio_buffer_get_dma_dev() helper function to get +the proper DMA device. + +Cc: stable@vger.kernel.org +Reviewed-by: David Lechner +Signed-off-by: Nuno Sá +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-buffer.c | 21 ++++++++++++++++----- + include/linux/iio/buffer_impl.h | 2 ++ + 2 files changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -1623,19 +1623,28 @@ static int iio_dma_resv_lock(struct dma_ + return 0; + } + ++static struct device *iio_buffer_get_dma_dev(const struct iio_dev *indio_dev, ++ struct iio_buffer *buffer) ++{ ++ if (buffer->access->get_dma_dev) ++ return buffer->access->get_dma_dev(buffer); ++ ++ return indio_dev->dev.parent; ++} ++ + static struct dma_buf_attachment * + iio_buffer_find_attachment(struct iio_dev_buffer_pair *ib, + struct dma_buf *dmabuf, bool nonblock) + { +- struct device *dev = ib->indio_dev->dev.parent; + struct iio_buffer *buffer = ib->buffer; ++ struct device *dma_dev = iio_buffer_get_dma_dev(ib->indio_dev, buffer); + struct dma_buf_attachment *attach = NULL; + struct iio_dmabuf_priv *priv; + + guard(mutex)(&buffer->dmabufs_mutex); + + list_for_each_entry(priv, &buffer->dmabufs, entry) { +- if (priv->attach->dev == dev ++ if (priv->attach->dev == dma_dev + && priv->attach->dmabuf == dmabuf) { + attach = priv->attach; + break; +@@ -1653,6 +1662,7 @@ static int iio_buffer_attach_dmabuf(stru + { + struct iio_dev *indio_dev = ib->indio_dev; + struct iio_buffer *buffer = ib->buffer; ++ struct device *dma_dev = iio_buffer_get_dma_dev(indio_dev, buffer); + struct dma_buf_attachment *attach; + struct iio_dmabuf_priv *priv, *each; + struct dma_buf *dmabuf; +@@ -1679,7 +1689,7 @@ static int iio_buffer_attach_dmabuf(stru + goto err_free_priv; + } + +- attach = dma_buf_attach(dmabuf, indio_dev->dev.parent); ++ attach = dma_buf_attach(dmabuf, dma_dev); + if (IS_ERR(attach)) { + err = PTR_ERR(attach); + goto err_dmabuf_put; +@@ -1719,7 +1729,7 @@ static int iio_buffer_attach_dmabuf(stru + * combo. If we do, refuse to attach. + */ + list_for_each_entry(each, &buffer->dmabufs, entry) { +- if (each->attach->dev == indio_dev->dev.parent ++ if (each->attach->dev == dma_dev + && each->attach->dmabuf == dmabuf) { + /* + * We unlocked the reservation object, so going through +@@ -1758,6 +1768,7 @@ static int iio_buffer_detach_dmabuf(stru + { + struct iio_buffer *buffer = ib->buffer; + struct iio_dev *indio_dev = ib->indio_dev; ++ struct device *dma_dev = iio_buffer_get_dma_dev(indio_dev, buffer); + struct iio_dmabuf_priv *priv; + struct dma_buf *dmabuf; + int dmabuf_fd, ret = -EPERM; +@@ -1772,7 +1783,7 @@ static int iio_buffer_detach_dmabuf(stru + guard(mutex)(&buffer->dmabufs_mutex); + + list_for_each_entry(priv, &buffer->dmabufs, entry) { +- if (priv->attach->dev == indio_dev->dev.parent ++ if (priv->attach->dev == dma_dev + && priv->attach->dmabuf == dmabuf) { + list_del(&priv->entry); + +--- a/include/linux/iio/buffer_impl.h ++++ b/include/linux/iio/buffer_impl.h +@@ -50,6 +50,7 @@ struct sg_table; + * @enqueue_dmabuf: called from userspace via ioctl to queue this DMABUF + * object to this buffer. Requires a valid DMABUF fd, that + * was previouly attached to this buffer. ++ * @get_dma_dev: called to get the DMA channel associated with this buffer. + * @lock_queue: called when the core needs to lock the buffer queue; + * it is used when enqueueing DMABUF objects. + * @unlock_queue: used to unlock a previously locked buffer queue +@@ -90,6 +91,7 @@ struct iio_buffer_access_funcs { + struct iio_dma_buffer_block *block, + struct dma_fence *fence, struct sg_table *sgt, + size_t size, bool cyclic); ++ struct device * (*get_dma_dev)(struct iio_buffer *buffer); + void (*lock_queue)(struct iio_buffer *buffer); + void (*unlock_queue)(struct iio_buffer *buffer); + diff --git a/queue-6.12/iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch b/queue-6.12/iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch new file mode 100644 index 0000000000..9c26efbdbf --- /dev/null +++ b/queue-6.12/iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch @@ -0,0 +1,46 @@ +From 21553258b94861a73d7f2cf15469d69240e1170d Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 10 Oct 2025 20:58:48 +0200 +Subject: iio:common:ssp_sensors: Fix an error handling path ssp_probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe JAILLET + +commit 21553258b94861a73d7f2cf15469d69240e1170d upstream. + +If an error occurs after a successful mfd_add_devices() call, it should be +undone by a corresponding mfd_remove_devices() call, as already done in the +remove function. + +Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") +Signed-off-by: Christophe JAILLET +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/ssp_sensors/ssp_dev.c ++++ b/drivers/iio/common/ssp_sensors/ssp_dev.c +@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device * + ret = spi_setup(spi); + if (ret < 0) { + dev_err(&spi->dev, "Failed to setup spi\n"); +- return ret; ++ goto err_setup_spi; + } + + data->fw_dl_state = SSP_FW_DL_STATE_NONE; +@@ -568,6 +568,8 @@ err_read_reg: + err_setup_irq: + mutex_destroy(&data->pending_lock); + mutex_destroy(&data->comm_lock); ++err_setup_spi: ++ mfd_remove_devices(&spi->dev); + + dev_err(&spi->dev, "Probe failed!\n"); + diff --git a/queue-6.12/iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch b/queue-6.12/iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch new file mode 100644 index 0000000000..d547a0da95 --- /dev/null +++ b/queue-6.12/iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch @@ -0,0 +1,46 @@ +From 7b8dc11c0a830caa0d890c603d597161c6c26095 Mon Sep 17 00:00:00 2001 +From: Dimitri Fedrau +Date: Thu, 16 Oct 2025 07:20:38 +0200 +Subject: iio: humditiy: hdc3020: fix units for temperature and humidity measurement + +From: Dimitri Fedrau + +commit 7b8dc11c0a830caa0d890c603d597161c6c26095 upstream. + +According to the ABI the units after application of scale and offset are +milli degrees for temperature measurements and milli percent for relative +humidity measurements. Currently the resulting units are degree celsius for +temperature measurements and percent for relative humidity measurements. +Change scale factor to fix this issue. + +Fixes: c9180b8e39be ("iio: humidity: Add driver for ti HDC302x humidity sensors") +Reported-by: Chris Lesiak +Suggested-by: Chris Lesiak +Reviewed-by: Javier Carrasco +Signed-off-by: Dimitri Fedrau +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/humidity/hdc3020.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/humidity/hdc3020.c b/drivers/iio/humidity/hdc3020.c +index ffb25596d3a8..8aa567d9aded 100644 +--- a/drivers/iio/humidity/hdc3020.c ++++ b/drivers/iio/humidity/hdc3020.c +@@ -301,9 +301,9 @@ static int hdc3020_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_SCALE: + *val2 = 65536; + if (chan->type == IIO_TEMP) +- *val = 175; ++ *val = 175 * MILLI; + else +- *val = 100; ++ *val = 100 * MILLI; + return IIO_VAL_FRACTIONAL; + + case IIO_CHAN_INFO_OFFSET: +-- +2.52.0 + diff --git a/queue-6.12/iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch b/queue-6.12/iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch new file mode 100644 index 0000000000..ccf50fceb0 --- /dev/null +++ b/queue-6.12/iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch @@ -0,0 +1,217 @@ +From cb372b4f46d4285e5d2c07ba734374151b8e34e7 Mon Sep 17 00:00:00 2001 +From: Dimitri Fedrau +Date: Thu, 16 Oct 2025 07:20:39 +0200 +Subject: iio: humditiy: hdc3020: fix units for thresholds and hysteresis + +From: Dimitri Fedrau + +commit cb372b4f46d4285e5d2c07ba734374151b8e34e7 upstream. + +According to the ABI the units after application of scale and offset are +milli degree celsius for temperature thresholds and milli percent for +relative humidity thresholds. Currently the resulting units are degree +celsius for temperature thresholds and hysteresis and percent for relative +humidity thresholds and hysteresis. Change scale factor to fix this issue. + +Fixes: 3ad0e7e5f0cb ("iio: humidity: hdc3020: add threshold events support") +Reported-by: Chris Lesiak +Reviewed-by: Javier Carrasco +Signed-off-by: Dimitri Fedrau +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/humidity/hdc3020.c | 69 ++++++++++++++++++++-------------- + 1 file changed, 41 insertions(+), 28 deletions(-) + +diff --git a/drivers/iio/humidity/hdc3020.c b/drivers/iio/humidity/hdc3020.c +index 8aa567d9aded..78b2c171c8da 100644 +--- a/drivers/iio/humidity/hdc3020.c ++++ b/drivers/iio/humidity/hdc3020.c +@@ -72,6 +72,9 @@ + #define HDC3020_MAX_TEMP_HYST_MICRO 164748607 + #define HDC3020_MAX_HUM_MICRO 99220264 + ++/* Divide 65535 from the datasheet by 5 to avoid overflows */ ++#define HDC3020_THRESH_FRACTION (65535 / 5) ++ + struct hdc3020_data { + struct i2c_client *client; + struct gpio_desc *reset_gpio; +@@ -376,15 +379,18 @@ static int hdc3020_thresh_get_temp(u16 thresh) + int temp; + + /* +- * Get the temperature threshold from 9 LSBs, shift them to get +- * the truncated temperature threshold representation and +- * calculate the threshold according to the formula in the +- * datasheet. Result is degree celsius scaled by 65535. ++ * Get the temperature threshold from 9 LSBs, shift them to get the ++ * truncated temperature threshold representation and calculate the ++ * threshold according to the explicit formula in the datasheet: ++ * T(C) = -45 + (175 * temp) / 65535. ++ * Additionally scale by HDC3020_THRESH_FRACTION to avoid precision loss ++ * when calculating threshold and hysteresis values. Result is degree ++ * celsius scaled by HDC3020_THRESH_FRACTION. + */ + temp = FIELD_GET(HDC3020_THRESH_TEMP_MASK, thresh) << + HDC3020_THRESH_TEMP_TRUNC_SHIFT; + +- return -2949075 + (175 * temp); ++ return -2949075 / 5 + (175 / 5 * temp); + } + + static int hdc3020_thresh_get_hum(u16 thresh) +@@ -394,13 +400,16 @@ static int hdc3020_thresh_get_hum(u16 thresh) + /* + * Get the humidity threshold from 7 MSBs, shift them to get the + * truncated humidity threshold representation and calculate the +- * threshold according to the formula in the datasheet. Result is +- * percent scaled by 65535. ++ * threshold according to the explicit formula in the datasheet: ++ * RH(%) = 100 * hum / 65535. ++ * Additionally scale by HDC3020_THRESH_FRACTION to avoid precision loss ++ * when calculating threshold and hysteresis values. Result is percent ++ * scaled by HDC3020_THRESH_FRACTION. + */ + hum = FIELD_GET(HDC3020_THRESH_HUM_MASK, thresh) << + HDC3020_THRESH_HUM_TRUNC_SHIFT; + +- return hum * 100; ++ return hum * 100 / 5; + } + + static u16 hdc3020_thresh_set_temp(int s_temp, u16 curr_thresh) +@@ -455,8 +464,8 @@ int hdc3020_thresh_clr(s64 s_thresh, s64 s_hyst, enum iio_event_direction dir) + else + s_clr = s_thresh + s_hyst; + +- /* Divide by 65535 to get units of micro */ +- return div_s64(s_clr, 65535); ++ /* Divide by HDC3020_THRESH_FRACTION to get units of micro */ ++ return div_s64(s_clr, HDC3020_THRESH_FRACTION); + } + + static int _hdc3020_write_thresh(struct hdc3020_data *data, u16 reg, u16 val) +@@ -507,7 +516,7 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + + clr = ret; + /* Scale value to include decimal part into calculations */ +- s_val = (val < 0) ? (val * 1000000 - val2) : (val * 1000000 + val2); ++ s_val = (val < 0) ? (val * 1000 - val2) : (val * 1000 + val2); + switch (chan->type) { + case IIO_TEMP: + switch (info) { +@@ -523,7 +532,8 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + /* Calculate old hysteresis */ + s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000; + s_clr = (s64)hdc3020_thresh_get_temp(clr) * 1000000; +- s_hyst = div_s64(abs(s_thresh - s_clr), 65535); ++ s_hyst = div_s64(abs(s_thresh - s_clr), ++ HDC3020_THRESH_FRACTION); + /* Set new threshold */ + thresh = reg_val; + /* Set old hysteresis */ +@@ -532,16 +542,17 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + case IIO_EV_INFO_HYSTERESIS: + /* + * Function hdc3020_thresh_get_temp returns temperature +- * in degree celsius scaled by 65535. Scale by 1000000 +- * to be able to subtract scaled hysteresis value. ++ * in degree celsius scaled by HDC3020_THRESH_FRACTION. ++ * Scale by 1000000 to be able to subtract scaled ++ * hysteresis value. + */ + s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000; + /* + * Units of s_val are in micro degree celsius, scale by +- * 65535 to get same units as s_thresh. ++ * HDC3020_THRESH_FRACTION to get same units as s_thresh. + */ + s_val = min(abs(s_val), HDC3020_MAX_TEMP_HYST_MICRO); +- s_hyst = (s64)s_val * 65535; ++ s_hyst = (s64)s_val * HDC3020_THRESH_FRACTION; + s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir); + s_clr = max(s_clr, HDC3020_MIN_TEMP_MICRO); + s_clr = min(s_clr, HDC3020_MAX_TEMP_MICRO); +@@ -565,7 +576,8 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + /* Calculate old hysteresis */ + s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000; + s_clr = (s64)hdc3020_thresh_get_hum(clr) * 1000000; +- s_hyst = div_s64(abs(s_thresh - s_clr), 65535); ++ s_hyst = div_s64(abs(s_thresh - s_clr), ++ HDC3020_THRESH_FRACTION); + /* Set new threshold */ + thresh = reg_val; + /* Try to set old hysteresis */ +@@ -574,15 +586,16 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev, + case IIO_EV_INFO_HYSTERESIS: + /* + * Function hdc3020_thresh_get_hum returns relative +- * humidity in percent scaled by 65535. Scale by 1000000 +- * to be able to subtract scaled hysteresis value. ++ * humidity in percent scaled by HDC3020_THRESH_FRACTION. ++ * Scale by 1000000 to be able to subtract scaled ++ * hysteresis value. + */ + s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000; + /* +- * Units of s_val are in micro percent, scale by 65535 +- * to get same units as s_thresh. ++ * Units of s_val are in micro percent, scale by ++ * HDC3020_THRESH_FRACTION to get same units as s_thresh. + */ +- s_hyst = (s64)s_val * 65535; ++ s_hyst = (s64)s_val * HDC3020_THRESH_FRACTION; + s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir); + s_clr = max(s_clr, 0); + s_clr = min(s_clr, HDC3020_MAX_HUM_MICRO); +@@ -630,7 +643,7 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev, + thresh = hdc3020_thresh_get_temp(ret); + switch (info) { + case IIO_EV_INFO_VALUE: +- *val = thresh; ++ *val = thresh * MILLI; + break; + case IIO_EV_INFO_HYSTERESIS: + ret = hdc3020_read_be16(data, reg_clr); +@@ -638,18 +651,18 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev, + return ret; + + clr = hdc3020_thresh_get_temp(ret); +- *val = abs(thresh - clr); ++ *val = abs(thresh - clr) * MILLI; + break; + default: + return -EOPNOTSUPP; + } +- *val2 = 65535; ++ *val2 = HDC3020_THRESH_FRACTION; + return IIO_VAL_FRACTIONAL; + case IIO_HUMIDITYRELATIVE: + thresh = hdc3020_thresh_get_hum(ret); + switch (info) { + case IIO_EV_INFO_VALUE: +- *val = thresh; ++ *val = thresh * MILLI; + break; + case IIO_EV_INFO_HYSTERESIS: + ret = hdc3020_read_be16(data, reg_clr); +@@ -657,12 +670,12 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev, + return ret; + + clr = hdc3020_thresh_get_hum(ret); +- *val = abs(thresh - clr); ++ *val = abs(thresh - clr) * MILLI; + break; + default: + return -EOPNOTSUPP; + } +- *val2 = 65535; ++ *val2 = HDC3020_THRESH_FRACTION; + return IIO_VAL_FRACTIONAL; + default: + return -EOPNOTSUPP; +-- +2.52.0 + diff --git a/queue-6.12/iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch b/queue-6.12/iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch new file mode 100644 index 0000000000..b9399664d4 --- /dev/null +++ b/queue-6.12/iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch @@ -0,0 +1,73 @@ +From 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a Mon Sep 17 00:00:00 2001 +From: Francesco Lavra +Date: Fri, 17 Oct 2025 19:32:08 +0200 +Subject: iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields + +From: Francesco Lavra + +commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream. + +The `decimator` and `batch` fields of struct st_lsm6dsx_settings +are arrays indexed by sensor type, not by sensor hardware +identifier; moreover, the `batch` field is only used for the +accelerometer and gyroscope. +Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to +ST_LSM6DSX_ID_MAX, and change the array size for `batch` from +ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id +definition so that the ST_LSM6DSX_ID_MAX value is usable within +the struct st_lsm6dsx_settings definition. + +Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO") +Signed-off-by: Francesco Lavra +Acked-by: Lorenzo Bianconi +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +@@ -270,6 +270,15 @@ struct st_lsm6dsx_event_settings { + u8 wakeup_src_x_mask; + }; + ++enum st_lsm6dsx_sensor_id { ++ ST_LSM6DSX_ID_GYRO, ++ ST_LSM6DSX_ID_ACC, ++ ST_LSM6DSX_ID_EXT0, ++ ST_LSM6DSX_ID_EXT1, ++ ST_LSM6DSX_ID_EXT2, ++ ST_LSM6DSX_ID_MAX ++}; ++ + enum st_lsm6dsx_ext_sensor_id { + ST_LSM6DSX_ID_MAGN, + }; +@@ -355,23 +364,14 @@ struct st_lsm6dsx_settings { + struct st_lsm6dsx_odr_table_entry odr_table[2]; + struct st_lsm6dsx_samples_to_discard samples_to_discard[2]; + struct st_lsm6dsx_fs_table_entry fs_table[2]; +- struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID]; +- struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID]; ++ struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX]; ++ struct st_lsm6dsx_reg batch[2]; + struct st_lsm6dsx_fifo_ops fifo_ops; + struct st_lsm6dsx_hw_ts_settings ts_settings; + struct st_lsm6dsx_shub_settings shub_settings; + struct st_lsm6dsx_event_settings event_settings; + }; + +-enum st_lsm6dsx_sensor_id { +- ST_LSM6DSX_ID_GYRO, +- ST_LSM6DSX_ID_ACC, +- ST_LSM6DSX_ID_EXT0, +- ST_LSM6DSX_ID_EXT1, +- ST_LSM6DSX_ID_EXT2, +- ST_LSM6DSX_ID_MAX, +-}; +- + enum st_lsm6dsx_fifo_mode { + ST_LSM6DSX_FIFO_BYPASS = 0x0, + ST_LSM6DSX_FIFO_CONT = 0x6, diff --git a/queue-6.12/mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch b/queue-6.12/mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch new file mode 100644 index 0000000000..d22380a3a4 --- /dev/null +++ b/queue-6.12/mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch @@ -0,0 +1,81 @@ +From 841ecc979b18d3227fad5e2d6a1e6f92688776b5 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Fri, 28 Nov 2025 16:53:46 +0000 +Subject: MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow + +From: Thomas Bogendoerfer + +commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream. + +Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+ +cores can have more than 64 TLB entries. Therefore allocate an array +for uniquification instead of placing too an small array on the stack. + +Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") +Co-developed-by: Maciej W. Rozycki +Signed-off-by: Maciej W. Rozycki +Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification +Cc: stable@vger.kernel.org # v6.17+ +Tested-by: Gregory CLEMENT +Tested-by: Klara Modin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/mm/tlb-r4k.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c +index 3facf7cc6c7d..44a662536148 100644 +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -522,17 +523,26 @@ static int r4k_vpn_cmp(const void *a, const void *b) + * Initialise all TLB entries with unique values that do not clash with + * what we have been handed over and what we'll be using ourselves. + */ +-static void r4k_tlb_uniquify(void) ++static void __ref r4k_tlb_uniquify(void) + { +- unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE]; + int tlbsize = current_cpu_data.tlbsize; ++ bool use_slab = slab_is_available(); + int start = num_wired_entries(); ++ phys_addr_t tlb_vpn_size; ++ unsigned long *tlb_vpns; + unsigned long vpn_mask; + int cnt, ent, idx, i; + + vpn_mask = GENMASK(cpu_vmbits - 1, 13); + vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31; + ++ tlb_vpn_size = tlbsize * sizeof(*tlb_vpns); ++ tlb_vpns = (use_slab ? ++ kmalloc(tlb_vpn_size, GFP_KERNEL) : ++ memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns))); ++ if (WARN_ON(!tlb_vpns)) ++ return; /* Pray local_flush_tlb_all() is good enough. */ ++ + htw_stop(); + + for (i = start, cnt = 0; i < tlbsize; i++, cnt++) { +@@ -585,6 +595,10 @@ static void r4k_tlb_uniquify(void) + tlbw_use_hazard(); + htw_start(); + flush_micro_tlb(); ++ if (use_slab) ++ kfree(tlb_vpns); ++ else ++ memblock_free(tlb_vpns, tlb_vpn_size); + } + + /* +-- +2.52.0 + diff --git a/queue-6.12/mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch b/queue-6.12/mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch new file mode 100644 index 0000000000..7dff5ac699 --- /dev/null +++ b/queue-6.12/mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch @@ -0,0 +1,174 @@ +From 9f048fa487409e364cf866c957cf0b0d782ca5a3 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Thu, 13 Nov 2025 05:21:10 +0000 +Subject: MIPS: mm: Prevent a TLB shutdown on initial uniquification + +From: Maciej W. Rozycki + +commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream. + +Depending on the particular CPU implementation a TLB shutdown may occur +if multiple matching entries are detected upon the execution of a TLBP +or the TLBWI/TLBWR instructions. Given that we don't know what entries +we have been handed we need to be very careful with the initial TLB +setup and avoid all these instructions. + +Therefore read all the TLB entries one by one with the TLBR instruction, +bypassing the content addressing logic, and truncate any large pages in +place so as to avoid a case in the second step where an incoming entry +for a large page at a lower address overlaps with a replacement entry +chosen at another index. Then preinitialize the TLB using addresses +outside our usual unique range and avoiding clashes with any entries +received, before making the usual call to local_flush_tlb_all(). + +This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB +entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual +address). + +Signed-off-by: Maciej W. Rozycki +Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") +Cc: stable@vger.kernel.org +Reviewed-by: Jiaxun Yang +Tested-by: Jiaxun Yang # Boston I6400, M5150 sim +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 64 insertions(+), 38 deletions(-) + +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -508,55 +509,79 @@ static int __init set_ntlb(char *str) + + __setup("ntlb=", set_ntlb); + +-/* Initialise all TLB entries with unique values */ ++ ++/* Comparison function for EntryHi VPN fields. */ ++static int r4k_vpn_cmp(const void *a, const void *b) ++{ ++ long v = *(unsigned long *)a - *(unsigned long *)b; ++ int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0; ++ return s ? (v != 0) | v >> s : v; ++} ++ ++/* ++ * Initialise all TLB entries with unique values that do not clash with ++ * what we have been handed over and what we'll be using ourselves. ++ */ + static void r4k_tlb_uniquify(void) + { +- int entry = num_wired_entries(); ++ unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE]; ++ int tlbsize = current_cpu_data.tlbsize; ++ int start = num_wired_entries(); ++ unsigned long vpn_mask; ++ int cnt, ent, idx, i; ++ ++ vpn_mask = GENMASK(cpu_vmbits - 1, 13); ++ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31; + + htw_stop(); +- write_c0_entrylo0(0); +- write_c0_entrylo1(0); + +- while (entry < current_cpu_data.tlbsize) { +- unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data); +- unsigned long asid = 0; +- int idx; ++ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) { ++ unsigned long vpn; + +- /* Skip wired MMID to make ginvt_mmid work */ +- if (cpu_has_mmid) +- asid = MMID_KERNEL_WIRED + 1; ++ write_c0_index(i); ++ mtc0_tlbr_hazard(); ++ tlb_read(); ++ tlb_read_hazard(); ++ vpn = read_c0_entryhi(); ++ vpn &= vpn_mask & PAGE_MASK; ++ tlb_vpns[cnt] = vpn; + +- /* Check for match before using UNIQUE_ENTRYHI */ +- do { +- if (cpu_has_mmid) { +- write_c0_memorymapid(asid); +- write_c0_entryhi(UNIQUE_ENTRYHI(entry)); +- } else { +- write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid); +- } +- mtc0_tlbw_hazard(); +- tlb_probe(); +- tlb_probe_hazard(); +- idx = read_c0_index(); +- /* No match or match is on current entry */ +- if (idx < 0 || idx == entry) +- break; +- /* +- * If we hit a match, we need to try again with +- * a different ASID. +- */ +- asid++; +- } while (asid < asid_mask); +- +- if (idx >= 0 && idx != entry) +- panic("Unable to uniquify TLB entry %d", idx); +- +- write_c0_index(entry); ++ /* Prevent any large pages from overlapping regular ones. */ ++ write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK); + mtc0_tlbw_hazard(); + tlb_write_indexed(); +- entry++; ++ tlbw_use_hazard(); + } + ++ sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL); ++ ++ write_c0_pagemask(PM_DEFAULT_MASK); ++ write_c0_entrylo0(0); ++ write_c0_entrylo1(0); ++ ++ idx = 0; ++ ent = tlbsize; ++ for (i = start; i < tlbsize; i++) ++ while (1) { ++ unsigned long entryhi, vpn; ++ ++ entryhi = UNIQUE_ENTRYHI(ent); ++ vpn = entryhi & vpn_mask & PAGE_MASK; ++ ++ if (idx >= cnt || vpn < tlb_vpns[idx]) { ++ write_c0_entryhi(entryhi); ++ write_c0_index(i); ++ mtc0_tlbw_hazard(); ++ tlb_write_indexed(); ++ ent++; ++ break; ++ } else if (vpn == tlb_vpns[idx]) { ++ ent++; ++ } else { ++ idx++; ++ } ++ } ++ + tlbw_use_hazard(); + htw_start(); + flush_micro_tlb(); +@@ -602,6 +627,7 @@ static void r4k_tlb_configure(void) + + /* From this point on the ARC firmware is dead. */ + r4k_tlb_uniquify(); ++ local_flush_tlb_all(); + + /* Did I tell you that ARC SUCKS? */ + } diff --git a/queue-6.12/revert-drm-amd-display-move-setup_stream_attribute.patch b/queue-6.12/revert-drm-amd-display-move-setup_stream_attribute.patch new file mode 100644 index 0000000000..6028ee84ab --- /dev/null +++ b/queue-6.12/revert-drm-amd-display-move-setup_stream_attribute.patch @@ -0,0 +1,103 @@ +From 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 25 Nov 2025 09:08:45 -0500 +Subject: Revert "drm/amd/display: Move setup_stream_attribute" + +From: Alex Deucher + +commit 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d upstream. + +This reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414. + +This results in a blank screen on the HDMI port on some systems. +Revert for now so as not to regress 6.18, can be addressed +in 6.19 once the issue is root caused. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4652 +Cc: Sunpeng.Li@amd.com +Cc: ivan.lipski@amd.com +Signed-off-by: Alex Deucher +(cherry picked from commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 1 - + drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 2 -- + drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 -- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +++ + drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c | 7 ------- + 5 files changed, 3 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -670,7 +670,6 @@ void dce110_enable_stream(struct pipe_ct + uint32_t early_control = 0; + struct timing_generator *tg = pipe_ctx->stream_res.tg; + +- link_hwss->setup_stream_attribute(pipe_ctx); + link_hwss->setup_stream_encoder(pipe_ctx); + + dc->hwss.update_info_frame(pipe_ctx); +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +@@ -3017,8 +3017,6 @@ void dcn20_enable_stream(struct pipe_ctx + link_enc->transmitter - TRANSMITTER_UNIPHY_A); + } + +- link_hwss->setup_stream_attribute(pipe_ctx); +- + if (dc->res_pool->dccg->funcs->set_pixel_rate_div) + dc->res_pool->dccg->funcs->set_pixel_rate_div( + dc->res_pool->dccg, +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -1019,8 +1019,6 @@ void dcn401_enable_stream(struct pipe_ct + } + } + +- link_hwss->setup_stream_attribute(pipe_ctx); +- + if (dc->res_pool->dccg->funcs->set_pixel_rate_div) { + dc->res_pool->dccg->funcs->set_pixel_rate_div( + dc->res_pool->dccg, +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -2447,6 +2447,7 @@ void link_set_dpms_on( + struct link_encoder *link_enc; + enum otg_out_mux_dest otg_out_dest = OUT_MUX_DIO; + struct vpg *vpg = pipe_ctx->stream_res.stream_enc->vpg; ++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res); + bool apply_edp_fast_boot_optimization = + pipe_ctx->stream->apply_edp_fast_boot_optimization; + +@@ -2489,6 +2490,8 @@ void link_set_dpms_on( + pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, otg_out_dest); + } + ++ link_hwss->setup_stream_attribute(pipe_ctx); ++ + pipe_ctx->stream->apply_edp_fast_boot_optimization = false; + + // Enable VPG before building infoframe +--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c +@@ -44,11 +44,6 @@ static void virtual_stream_encoder_dvi_s + struct dc_crtc_timing *crtc_timing, + bool is_dual_link) {} + +-static void virtual_stream_encoder_lvds_set_stream_attribute( +- struct stream_encoder *enc, +- struct dc_crtc_timing *crtc_timing) +-{} +- + static void virtual_stream_encoder_set_throttled_vcp_size( + struct stream_encoder *enc, + struct fixed31_32 avg_time_slots_per_mtp) +@@ -120,8 +115,6 @@ static const struct stream_encoder_funcs + virtual_stream_encoder_hdmi_set_stream_attribute, + .dvi_set_stream_attribute = + virtual_stream_encoder_dvi_set_stream_attribute, +- .lvds_set_stream_attribute = +- virtual_stream_encoder_lvds_set_stream_attribute, + .set_throttled_vcp_size = + virtual_stream_encoder_set_throttled_vcp_size, + .update_hdmi_info_packets = diff --git a/queue-6.12/revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch b/queue-6.12/revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch new file mode 100644 index 0000000000..7911a7ec88 --- /dev/null +++ b/queue-6.12/revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch @@ -0,0 +1,68 @@ +From 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Tue, 4 Nov 2025 22:54:02 +0100 +Subject: Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" + +From: Jiri Olsa + +commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream. + +This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3. + +Currently we store initial stacktrace entry twice for non-HW ot_regs, which +means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel. + +It's easy to reproduce this bpftrace: + + # bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }' + Attaching 1 probe... + + bprm_execve+1767 + bprm_execve+1767 + do_execveat_common.isra.0+425 + __x64_sys_execve+56 + do_syscall_64+133 + entry_SYSCALL_64_after_hwframe+118 + +When perf_callchain_kernel calls unwind_start with first_frame, AFAICS +we do not skip regs->ip, but it's added as part of the unwind process. +Hence reverting the extra perf_callchain_store for non-hw regs leg. + +I was not able to bisect this, so I'm not really sure why this was needed +in v5.2 and why it's not working anymore, but I could see double entries +as far as v5.10. + +I did the test for both ORC and framepointer unwind with and without the +this fix and except for the initial entry the stacktraces are the same. + +Acked-by: Song Liu +Signed-off-by: Jiri Olsa +Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org +Signed-off-by: Alexei Starovoitov +Acked-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2769,13 +2769,13 @@ perf_callchain_kernel(struct perf_callch + return; + } + +- if (perf_callchain_store(entry, regs->ip)) +- return; +- +- if (perf_hw_regs(regs)) ++ if (perf_hw_regs(regs)) { ++ if (perf_callchain_store(entry, regs->ip)) ++ return; + unwind_start(&state, current, regs, NULL); +- else ++ } else { + unwind_start(&state, current, NULL, (void *)regs->sp); ++ } + + for (; !unwind_done(&state); unwind_next_frame(&state)) { + addr = unwind_get_return_address(&state); diff --git a/queue-6.12/series b/queue-6.12/series index d7c4f1f006..91034adc79 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -46,3 +46,20 @@ spi-spi-nxp-fspi-remove-the-goto-in-probe.patch spi-spi-nxp-fspi-add-oct-dtr-mode-support.patch spi-nxp-fspi-propagate-fwnode-in-acpi-case-as-well.patch spi-bcm63xx-fix-premature-cs-deassertion-on-rx-only-.patch +revert-drm-amd-display-move-setup_stream_attribute.patch +revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch +iio-buffer-dma-support-getting-the-dma-channel.patch +iio-buffer-dmaengine-enable-.get_dma_dev.patch +iio-buffer-support-getting-dma-channel-from-the-buffer.patch +iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch +iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch +iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch +iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch +iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch +iio-accel-bmc150-fix-irq-assumption-regression.patch +iio-accel-fix-adxl355-startup-race-condition.patch +iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch +iio-adc-rtq6056-correct-the-sign-bit-index.patch +mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch +mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch +tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch diff --git a/queue-6.12/tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch b/queue-6.12/tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch new file mode 100644 index 0000000000..ae31909fbd --- /dev/null +++ b/queue-6.12/tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch @@ -0,0 +1,57 @@ +From b042fdf18e89a347177a49e795d8e5184778b5b6 Mon Sep 17 00:00:00 2001 +From: Deepanshu Kartikey +Date: Wed, 19 Nov 2025 12:10:19 +0530 +Subject: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs + +From: Deepanshu Kartikey + +commit b042fdf18e89a347177a49e795d8e5184778b5b6 upstream. + +When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel +calls vm_ops->close on each portion. For trace buffer mappings, this +results in ring_buffer_unmap() being called multiple times while +ring_buffer_map() was only called once. + +This causes ring_buffer_unmap() to return -ENODEV on subsequent calls +because user_mapped is already 0, triggering a WARN_ON. + +Trace buffer mappings cannot support partial mappings because the ring +buffer structure requires the complete buffer including the meta page. + +Fix this by adding a may_split callback that returns -EINVAL to prevent +VMA splits entirely. + +Cc: stable@vger.kernel.org +Fixes: cf9f0f7c4c5bb ("tracing: Allow user-space mapping of the ring-buffer") +Link: https://patch.msgid.link/20251119064019.25904-1-kartikey406@gmail.com +Closes: https://syzkaller.appspot.com/bug?extid=a72c325b042aae6403c7 +Tested-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com +Reported-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com +Signed-off-by: Deepanshu Kartikey +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -8283,8 +8283,18 @@ static void tracing_buffers_mmap_close(s + put_snapshot_map(iter->tr); + } + ++static int tracing_buffers_may_split(struct vm_area_struct *vma, unsigned long addr) ++{ ++ /* ++ * Trace buffer mappings require the complete buffer including ++ * the meta page. Partial mappings are not supported. ++ */ ++ return -EINVAL; ++} ++ + static const struct vm_operations_struct tracing_buffers_vmops = { + .close = tracing_buffers_mmap_close, ++ .may_split = tracing_buffers_may_split, + }; + + static int tracing_buffers_mmap(struct file *filp, struct vm_area_struct *vma)