From: Sasha Levin Date: Tue, 21 Oct 2025 14:54:21 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v6.6.114~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6aceec507fd0d3cefa7cac227eaf897edf09bf32;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-5.10/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..eb4e5c1a81 --- /dev/null +++ b/queue-5.10/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 83a37b6ed8e0c32e52c3e705dd2429de092e15be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 2ceb57d1d58ee..1332089683da0 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + */ +-- +2.51.0 + diff --git a/queue-5.10/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-5.10/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..952a3a8582 --- /dev/null +++ b/queue-5.10/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 436b9d153e985492393f671bd7a56cd4456fe692 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 8926011604e39..9cd6dac033630 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 19fed56b6ee3f..ebb8b3e5b9a88 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-5.10/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-5.10/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..2ab8d80f7f --- /dev/null +++ b/queue-5.10/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From 6cc4e0c4d5a7e9117ffd866624a4296ce20682f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 6619a71b57bbe..a6f481f1517dd 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1222,7 +1222,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-5.10/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-5.10/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..a0a4a193af --- /dev/null +++ b/queue-5.10/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From 18f5568c6791ed2d898673c2048b1b638b5fafb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 3673a9e7ba449..e2816c88cfe52 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -4982,8 +4982,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.10/fsdax-switch-dax_iomap_rw-to-use-iomap_iter.patch b/queue-5.10/fsdax-switch-dax_iomap_rw-to-use-iomap_iter.patch new file mode 100644 index 0000000000..77e205ad1f --- /dev/null +++ b/queue-5.10/fsdax-switch-dax_iomap_rw-to-use-iomap_iter.patch @@ -0,0 +1,128 @@ +From 7be45f02e72dfaac0bdc944bc7f82f7fdd63fb9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 18:33:13 -0700 +Subject: fsdax: switch dax_iomap_rw to use iomap_iter + +From: Christoph Hellwig + +[ Upstream commit ca289e0b95afa973d204c77a4ad5c37e06145fbf ] + +Switch the dax_iomap_rw implementation to use iomap_iter. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Stable-dep-of: 154d1e7ad9e5 ("dax: skip read lock assertion for read-only filesystems") +Signed-off-by: Sasha Levin +--- + fs/dax.c | 49 ++++++++++++++++++++++++------------------------- + 1 file changed, 24 insertions(+), 25 deletions(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 3e7e9a57fd28c..6619a71b57bbe 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1104,20 +1104,21 @@ s64 dax_iomap_zero(loff_t pos, u64 length, struct iomap *iomap) + return size; + } + +-static loff_t +-dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data, +- struct iomap *iomap, struct iomap *srcmap) ++static loff_t dax_iomap_iter(const struct iomap_iter *iomi, ++ struct iov_iter *iter) + { ++ const struct iomap *iomap = &iomi->iomap; ++ loff_t length = iomap_length(iomi); ++ loff_t pos = iomi->pos; + struct block_device *bdev = iomap->bdev; + struct dax_device *dax_dev = iomap->dax_dev; +- struct iov_iter *iter = data; + loff_t end = pos + length, done = 0; + ssize_t ret = 0; + size_t xfer; + int id; + + if (iov_iter_rw(iter) == READ) { +- end = min(end, i_size_read(inode)); ++ end = min(end, i_size_read(iomi->inode)); + if (pos >= end) + return 0; + +@@ -1134,7 +1135,7 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data, + * written by write(2) is visible in mmap. + */ + if (iomap->flags & IOMAP_F_NEW) { +- invalidate_inode_pages2_range(inode->i_mapping, ++ invalidate_inode_pages2_range(iomi->inode->i_mapping, + pos >> PAGE_SHIFT, + (end - 1) >> PAGE_SHIFT); + } +@@ -1210,31 +1211,29 @@ ssize_t + dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + const struct iomap_ops *ops) + { +- struct address_space *mapping = iocb->ki_filp->f_mapping; +- struct inode *inode = mapping->host; +- loff_t pos = iocb->ki_pos, ret = 0, done = 0; +- unsigned flags = 0; ++ struct iomap_iter iomi = { ++ .inode = iocb->ki_filp->f_mapping->host, ++ .pos = iocb->ki_pos, ++ .len = iov_iter_count(iter), ++ }; ++ loff_t done = 0; ++ int ret; + + if (iov_iter_rw(iter) == WRITE) { +- lockdep_assert_held_write(&inode->i_rwsem); +- flags |= IOMAP_WRITE; ++ lockdep_assert_held_write(&iomi.inode->i_rwsem); ++ iomi.flags |= IOMAP_WRITE; + } else { +- lockdep_assert_held(&inode->i_rwsem); ++ lockdep_assert_held(&iomi.inode->i_rwsem); + } + + if (iocb->ki_flags & IOCB_NOWAIT) +- flags |= IOMAP_NOWAIT; ++ iomi.flags |= IOMAP_NOWAIT; + +- while (iov_iter_count(iter)) { +- ret = iomap_apply(inode, pos, iov_iter_count(iter), flags, ops, +- iter, dax_iomap_actor); +- if (ret <= 0) +- break; +- pos += ret; +- done += ret; +- } ++ while ((ret = iomap_iter(&iomi, ops)) > 0) ++ iomi.processed = dax_iomap_iter(&iomi, iter); + +- iocb->ki_pos += done; ++ done = iomi.pos - iocb->ki_pos; ++ iocb->ki_pos = iomi.pos; + return done ? done : ret; + } + EXPORT_SYMBOL_GPL(dax_iomap_rw); +@@ -1308,7 +1307,7 @@ static vm_fault_t dax_iomap_pte_fault(struct vm_fault *vmf, pfn_t *pfnp, + } + + /* +- * Note that we don't bother to use iomap_apply here: DAX required ++ * Note that we don't bother to use iomap_iter here: DAX required + * the file system block size to be equal the page size, which means + * that we never have to deal with more than a single extent here. + */ +@@ -1562,7 +1561,7 @@ static vm_fault_t dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp, + } + + /* +- * Note that we don't use iomap_apply here. We aren't doing I/O, only ++ * Note that we don't use iomap_iter here. We aren't doing I/O, only + * setting up a mapping, so really we're using iomap_begin() as a way + * to look up our filesystem block. + */ +-- +2.51.0 + diff --git a/queue-5.10/iomap-add-the-new-iomap_iter-model.patch b/queue-5.10/iomap-add-the-new-iomap_iter-model.patch new file mode 100644 index 0000000000..186c675607 --- /dev/null +++ b/queue-5.10/iomap-add-the-new-iomap_iter-model.patch @@ -0,0 +1,255 @@ +From 2d65cad2e29b923a584bea19358fe98fdb123e18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 18:33:07 -0700 +Subject: iomap: add the new iomap_iter model + +From: Christoph Hellwig + +[ Upstream commit f4b896c213f0752adc828ddc11bd55419ffab248 ] + +The iomap_iter struct provides a convenient way to package up and +maintain all the arguments to the various mapping and operation +functions. It is operated on using the iomap_iter() function that +is called in loop until the whole range has been processed. Compared +to the existing iomap_apply() function this avoid an indirect call +for each iteration. + +For now iomap_iter() calls back into the existing ->iomap_begin and +->iomap_end methods, but in the future this could be further optimized +to avoid indirect calls entirely. + +Based on an earlier patch from Matthew Wilcox . + +Signed-off-by: Christoph Hellwig +[djwong: add to apply.c to preserve git history of iomap loop control] +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Stable-dep-of: 154d1e7ad9e5 ("dax: skip read lock assertion for read-only filesystems") +Signed-off-by: Sasha Levin +--- + fs/iomap/apply.c | 74 ++++++++++++++++++++++++++++++++++++++++++- + fs/iomap/trace.h | 37 +++++++++++++++++++++- + include/linux/iomap.h | 56 ++++++++++++++++++++++++++++++++ + 3 files changed, 165 insertions(+), 2 deletions(-) + +diff --git a/fs/iomap/apply.c b/fs/iomap/apply.c +index 26ab6563181fc..e82647aef7ead 100644 +--- a/fs/iomap/apply.c ++++ b/fs/iomap/apply.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + /* + * Copyright (C) 2010 Red Hat, Inc. +- * Copyright (c) 2016-2018 Christoph Hellwig. ++ * Copyright (c) 2016-2021 Christoph Hellwig. + */ + #include + #include +@@ -97,3 +97,75 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags, + + return written ? written : ret; + } ++ ++static inline int iomap_iter_advance(struct iomap_iter *iter) ++{ ++ /* handle the previous iteration (if any) */ ++ if (iter->iomap.length) { ++ if (iter->processed <= 0) ++ return iter->processed; ++ if (WARN_ON_ONCE(iter->processed > iomap_length(iter))) ++ return -EIO; ++ iter->pos += iter->processed; ++ iter->len -= iter->processed; ++ if (!iter->len) ++ return 0; ++ } ++ ++ /* clear the state for the next iteration */ ++ iter->processed = 0; ++ memset(&iter->iomap, 0, sizeof(iter->iomap)); ++ memset(&iter->srcmap, 0, sizeof(iter->srcmap)); ++ return 1; ++} ++ ++static inline void iomap_iter_done(struct iomap_iter *iter) ++{ ++ WARN_ON_ONCE(iter->iomap.offset > iter->pos); ++ WARN_ON_ONCE(iter->iomap.length == 0); ++ WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos); ++ ++ trace_iomap_iter_dstmap(iter->inode, &iter->iomap); ++ if (iter->srcmap.type != IOMAP_HOLE) ++ trace_iomap_iter_srcmap(iter->inode, &iter->srcmap); ++} ++ ++/** ++ * iomap_iter - iterate over a ranges in a file ++ * @iter: iteration structue ++ * @ops: iomap ops provided by the file system ++ * ++ * Iterate over filesystem-provided space mappings for the provided file range. ++ * ++ * This function handles cleanup of resources acquired for iteration when the ++ * filesystem indicates there are no more space mappings, which means that this ++ * function must be called in a loop that continues as long it returns a ++ * positive value. If 0 or a negative value is returned, the caller must not ++ * return to the loop body. Within a loop body, there are two ways to break out ++ * of the loop body: leave @iter.processed unchanged, or set it to a negative ++ * errno. ++ */ ++int iomap_iter(struct iomap_iter *iter, const struct iomap_ops *ops) ++{ ++ int ret; ++ ++ if (iter->iomap.length && ops->iomap_end) { ++ ret = ops->iomap_end(iter->inode, iter->pos, iomap_length(iter), ++ iter->processed > 0 ? iter->processed : 0, ++ iter->flags, &iter->iomap); ++ if (ret < 0 && !iter->processed) ++ return ret; ++ } ++ ++ trace_iomap_iter(iter, ops, _RET_IP_); ++ ret = iomap_iter_advance(iter); ++ if (ret <= 0) ++ return ret; ++ ++ ret = ops->iomap_begin(iter->inode, iter->pos, iter->len, iter->flags, ++ &iter->iomap, &iter->srcmap); ++ if (ret < 0) ++ return ret; ++ iomap_iter_done(iter); ++ return 1; ++} +diff --git a/fs/iomap/trace.h b/fs/iomap/trace.h +index fdc7ae388476f..52b850b4d3f44 100644 +--- a/fs/iomap/trace.h ++++ b/fs/iomap/trace.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* +- * Copyright (c) 2009-2019 Christoph Hellwig ++ * Copyright (c) 2009-2021 Christoph Hellwig + * + * NOTE: none of these tracepoints shall be consider a stable kernel ABI + * as they can change at any time. +@@ -140,6 +140,8 @@ DEFINE_EVENT(iomap_class, name, \ + TP_ARGS(inode, iomap)) + DEFINE_IOMAP_EVENT(iomap_apply_dstmap); + DEFINE_IOMAP_EVENT(iomap_apply_srcmap); ++DEFINE_IOMAP_EVENT(iomap_iter_dstmap); ++DEFINE_IOMAP_EVENT(iomap_iter_srcmap); + + TRACE_EVENT(iomap_apply, + TP_PROTO(struct inode *inode, loff_t pos, loff_t length, +@@ -179,6 +181,39 @@ TRACE_EVENT(iomap_apply, + __entry->actor) + ); + ++TRACE_EVENT(iomap_iter, ++ TP_PROTO(struct iomap_iter *iter, const void *ops, ++ unsigned long caller), ++ TP_ARGS(iter, ops, caller), ++ TP_STRUCT__entry( ++ __field(dev_t, dev) ++ __field(u64, ino) ++ __field(loff_t, pos) ++ __field(loff_t, length) ++ __field(unsigned int, flags) ++ __field(const void *, ops) ++ __field(unsigned long, caller) ++ ), ++ TP_fast_assign( ++ __entry->dev = iter->inode->i_sb->s_dev; ++ __entry->ino = iter->inode->i_ino; ++ __entry->pos = iter->pos; ++ __entry->length = iomap_length(iter); ++ __entry->flags = iter->flags; ++ __entry->ops = ops; ++ __entry->caller = caller; ++ ), ++ TP_printk("dev %d:%d ino 0x%llx pos %lld length %lld flags %s (0x%x) ops %ps caller %pS", ++ MAJOR(__entry->dev), MINOR(__entry->dev), ++ __entry->ino, ++ __entry->pos, ++ __entry->length, ++ __print_flags(__entry->flags, "|", IOMAP_FLAGS_STRINGS), ++ __entry->flags, ++ __entry->ops, ++ (void *)__entry->caller) ++); ++ + #endif /* _IOMAP_TRACE_H */ + + #undef TRACE_INCLUDE_PATH +diff --git a/include/linux/iomap.h b/include/linux/iomap.h +index 5bd3cac4df9cb..5100a139d2efd 100644 +--- a/include/linux/iomap.h ++++ b/include/linux/iomap.h +@@ -143,6 +143,62 @@ struct iomap_ops { + ssize_t written, unsigned flags, struct iomap *iomap); + }; + ++/** ++ * struct iomap_iter - Iterate through a range of a file ++ * @inode: Set at the start of the iteration and should not change. ++ * @pos: The current file position we are operating on. It is updated by ++ * calls to iomap_iter(). Treat as read-only in the body. ++ * @len: The remaining length of the file segment we're operating on. ++ * It is updated at the same time as @pos. ++ * @processed: The number of bytes processed by the body in the most recent ++ * iteration, or a negative errno. 0 causes the iteration to stop. ++ * @flags: Zero or more of the iomap_begin flags above. ++ * @iomap: Map describing the I/O iteration ++ * @srcmap: Source map for COW operations ++ */ ++struct iomap_iter { ++ struct inode *inode; ++ loff_t pos; ++ u64 len; ++ s64 processed; ++ unsigned flags; ++ struct iomap iomap; ++ struct iomap srcmap; ++}; ++ ++int iomap_iter(struct iomap_iter *iter, const struct iomap_ops *ops); ++ ++/** ++ * iomap_length - length of the current iomap iteration ++ * @iter: iteration structure ++ * ++ * Returns the length that the operation applies to for the current iteration. ++ */ ++static inline u64 iomap_length(const struct iomap_iter *iter) ++{ ++ u64 end = iter->iomap.offset + iter->iomap.length; ++ ++ if (iter->srcmap.type != IOMAP_HOLE) ++ end = min(end, iter->srcmap.offset + iter->srcmap.length); ++ return min(iter->len, end - iter->pos); ++} ++ ++/** ++ * iomap_iter_srcmap - return the source map for the current iomap iteration ++ * @i: iteration structure ++ * ++ * Write operations on file systems with reflink support might require a ++ * source and a destination map. This function retourns the source map ++ * for a given operation, which may or may no be identical to the destination ++ * map in &i->iomap. ++ */ ++static inline struct iomap *iomap_iter_srcmap(struct iomap_iter *i) ++{ ++ if (i->srcmap.type != IOMAP_HOLE) ++ return &i->srcmap; ++ return &i->iomap; ++} ++ + /* + * Main iomap iterator function. + */ +-- +2.51.0 + diff --git a/queue-5.10/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-5.10/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..ed457f625b --- /dev/null +++ b/queue-5.10/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From 85a247baa7f195d41a73d1caa772fc4b81de1662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 0af58c4dcebc1..dc85a742f97cb 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -499,25 +499,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-5.10/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-5.10/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..ad7ead19ed --- /dev/null +++ b/queue-5.10/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 3de502472eca80a1312c61fea90065e53440c926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index cedf72924f19e..d7a037d32bcc2 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -468,6 +468,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index cf9184928eded..6a85200002969 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -553,20 +553,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index bd27204725ed8..6efad8d6653b6 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1277,8 +1277,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-5.10/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch b/queue-5.10/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch new file mode 100644 index 0000000000..6ee0a9e8ca --- /dev/null +++ b/queue-5.10/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch @@ -0,0 +1,96 @@ +From 859bc9f1d5a1e73530dd3d809b1c04332779e156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:07:42 +0100 +Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address + +From: Oleksij Rempel + +[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ] + +Convert `lan78xx_init_mac_address` to return error codes and handle +failures in register read and write operations. Update `lan78xx_reset` +to check for errors during MAC address initialization and propagate them +appropriately. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 3e3c67dc6bf74..c3aa3f75ab914 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1710,13 +1710,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { + .get_regs = lan78xx_get_regs, + }; + +-static void lan78xx_init_mac_address(struct lan78xx_net *dev) ++static int lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; + u8 addr[6]; ++ int ret; ++ ++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ if (ret < 0) ++ return ret; + +- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ if (ret < 0) ++ return ret; + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1749,14 +1755,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ if (ret < 0) ++ return ret; + } + +- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ if (ret < 0) ++ return ret; + + eth_hw_addr_set(dev->net, addr); ++ ++ return 0; + } + + /* MDIO read and write wrappers for phylib */ +@@ -2655,7 +2673,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- lan78xx_init_mac_address(dev); ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; + + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); +-- +2.51.0 + diff --git a/queue-5.10/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-5.10/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..454f1d372f --- /dev/null +++ b/queue-5.10/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From a245640545a4024a765fc5c051adf50808bfd408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index c3aa3f75ab914..fd5fa64cbe932 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2673,10 +2673,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -2685,6 +2681,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-5.10/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch b/queue-5.10/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch new file mode 100644 index 0000000000..ccdfeee3b3 --- /dev/null +++ b/queue-5.10/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch @@ -0,0 +1,111 @@ +From dea6bc9f6687f6beebf6c4d849945094d2e572dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 14:32:24 -0700 +Subject: net: usb: use eth_hw_addr_set() instead of ether_addr_copy() + +From: Jakub Kicinski + +[ Upstream commit af804e6db9f60b923ff5149d9bf782e0baa82a2b ] + +Commit 406f42fa0d3c ("net-next: When a bond have a massive amount +of VLANs...") introduced a rbtree for faster Ethernet address look +up. To maintain netdev->dev_addr in this tree we need to make all +the writes to it got through appropriate helpers. + +Convert net/usb from ether_addr_copy() to eth_hw_addr_set(): + + @@ + expression dev, np; + @@ + - ether_addr_copy(dev->dev_addr, np) + + eth_hw_addr_set(dev, np) + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/aqc111.c | 2 +- + drivers/net/usb/lan78xx.c | 4 ++-- + drivers/net/usb/r8152.c | 2 +- + drivers/net/usb/rndis_host.c | 2 +- + drivers/net/usb/rtl8150.c | 2 +- + 5 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index 485959771431d..ab9431ea295ad 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -720,7 +720,7 @@ static int aqc111_bind(struct usbnet *dev, struct usb_interface *intf) + if (ret) + goto out; + +- ether_addr_copy(dev->net->dev_addr, dev->net->perm_addr); ++ eth_hw_addr_set(dev->net, dev->net->perm_addr); + + /* Set Rx urb size */ + dev->rx_urb_size = URB_SIZE; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index cabe6cdd6903a..3e3c67dc6bf74 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1756,7 +1756,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + lan78xx_write_reg(dev, MAF_LO(0), addr_lo); + lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); + +- ether_addr_copy(dev->net->dev_addr, addr); ++ eth_hw_addr_set(dev->net, addr); + } + + /* MDIO read and write wrappers for phylib */ +@@ -2331,7 +2331,7 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p) + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + +- ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(netdev, addr->sa_data); + + addr_lo = netdev->dev_addr[0] | + netdev->dev_addr[1] << 8 | +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 0d6f10c9bb139..57565fb2c0a11 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -1545,7 +1545,7 @@ static int set_ethernet_addr(struct r8152 *tp) + return ret; + + if (tp->version == RTL_VER_01) +- ether_addr_copy(dev->dev_addr, sa.sa_data); ++ eth_hw_addr_set(dev, sa.sa_data); + else + ret = rtl8152_set_mac_address(dev, &sa); + +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index 1ff723e15d523..a244796fcaa44 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -422,7 +422,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) + if (bp[0] & 0x02) + eth_hw_addr_random(net); + else +- ether_addr_copy(net->dev_addr, bp); ++ eth_hw_addr_set(net, bp); + + /* set a nonzero filter to enable data transfers */ + memset(u.set, 0, sizeof *u.set); +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index c0f5e8ab1e34e..84252487ae49a 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -270,7 +270,7 @@ static void set_ethernet_addr(rtl8150_t *dev) + ret = get_registers(dev, IDR, sizeof(node_id), node_id); + + if (!ret) { +- ether_addr_copy(dev->netdev->dev_addr, node_id); ++ eth_hw_addr_set(dev->netdev, node_id); + } else { + eth_hw_addr_random(dev->netdev); + netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", +-- +2.51.0 + diff --git a/queue-5.10/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-5.10/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..c82df18310 --- /dev/null +++ b/queue-5.10/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From 3f1369cf8e5e6847a6942dda8a54e639fc7bd840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index b60add52f4497..9fb8fdd5b2619 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4979,8 +4979,9 @@ static int __maybe_unused rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_net_resume(tp); +-- +2.51.0 + diff --git a/queue-5.10/sched-balancing-rename-newidle_balance-sched_balance.patch b/queue-5.10/sched-balancing-rename-newidle_balance-sched_balance.patch new file mode 100644 index 0000000000..e8e61f81f9 --- /dev/null +++ b/queue-5.10/sched-balancing-rename-newidle_balance-sched_balance.patch @@ -0,0 +1,95 @@ +From 9a3a348c34a6bf26323ac9b99a388c0fcf3ad8be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:18:16 +0100 +Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle() + +From: Ingo Molnar + +[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ] + +Standardize scheduler load-balancing function names on the +sched_balance_() prefix. + +Signed-off-by: Ingo Molnar +Reviewed-by: Shrikanth Hegde +Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 802c97a05f57e..952a3fd41a6fe 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3907,7 +3907,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); + + static inline unsigned long task_util(struct task_struct *p) + { +@@ -4234,7 +4234,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -7065,7 +7065,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + if (rq->nr_running) + return 1; + +- return newidle_balance(rq, rf) != 0; ++ return sched_balance_newidle(rq, rf) != 0; + } + #endif /* CONFIG_SMP */ + +@@ -7356,10 +7356,10 @@ done: __maybe_unused; + if (!rf) + return NULL; + +- new_tasks = newidle_balance(rq, rf); ++ new_tasks = sched_balance_newidle(rq, rf); + + /* +- * Because newidle_balance() releases (and re-acquires) rq->lock, it is ++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is + * possible for any higher priority task to appear. In that case we + * must re-start the pick_next_entity() loop. + */ +@@ -10090,7 +10090,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, + ld_moved = 0; + + /* +- * newidle_balance() disregards balance intervals, so we could ++ * sched_balance_newidle() disregards balance intervals, so we could + * repeatedly reach this code, which would lead to balance_interval + * skyrocketting in a short amount of time. Skip the balance_interval + * increase logic to avoid that. +@@ -10808,7 +10808,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * newidle_balance is called by schedule() if this_cpu is about to become ++ * sched_balance_newidle is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + * + * Returns: +@@ -10816,7 +10816,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + * 0 - failed, no new tasks + * > 0 - success, new (fair) tasks present + */ +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +-- +2.51.0 + diff --git a/queue-5.10/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-5.10/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..00e014b742 --- /dev/null +++ b/queue-5.10/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From 5cf3116d64fd425845cb4597993b5fd8a59e1556 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 952a3fd41a6fe..c11d59bea0ea8 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7353,21 +7353,21 @@ done: __maybe_unused; + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-5.10/sched-fair-trivial-correction-of-the-newidle_balance.patch b/queue-5.10/sched-fair-trivial-correction-of-the-newidle_balance.patch new file mode 100644 index 0000000000..0e911d96fa --- /dev/null +++ b/queue-5.10/sched-fair-trivial-correction-of-the-newidle_balance.patch @@ -0,0 +1,39 @@ +From c9d02a90727a10536bbe4be630ea0321784d62f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 11:06:41 +1300 +Subject: sched/fair: Trivial correction of the newidle_balance() comment + +From: Barry Song + +[ Upstream commit 5b78f2dc315354c05300795064f587366a02c6ff ] + +idle_balance() has been renamed to newidle_balance(). To differentiate +with nohz_idle_balance, it seems refining the comment will be helpful +for the readers of the code. + +Signed-off-by: Barry Song +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lkml.kernel.org/r/20201202220641.22752-1-song.bao.hua@hisilicon.com +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 9f8cb265589b3..802c97a05f57e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -10808,7 +10808,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * idle_balance is called by schedule() if this_cpu is about to become ++ * newidle_balance is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + * + * Returns: +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 252b0a5e95..90ac1a853c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -237,3 +237,22 @@ media-rc-directly-use-ida_free.patch media-lirc-fix-error-handling-in-lirc_register.patch xen-events-update-virq_to_irq-on-migration.patch hid-multitouch-fix-sticky-fingers.patch +iomap-add-the-new-iomap_iter-model.patch +fsdax-switch-dax_iomap_rw-to-use-iomap_iter.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +net-dlink-handle-dma_map_single-failure-properly.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-don-t-rely-on-tx_work-during-send.patch +net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch +net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +sched-fair-trivial-correction-of-the-newidle_balance.patch +sched-balancing-rename-newidle_balance-sched_balance.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch diff --git a/queue-5.10/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-5.10/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..ab9095596a --- /dev/null +++ b/queue-5.10/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From 236f18a004bc74d6f47b1f39fc302c8433437afa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 32e38ac5ee2bd..88e8d6543948e 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2177,7 +2177,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2239,9 +2240,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-5.10/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-5.10/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..694c697f88 --- /dev/null +++ b/queue-5.10/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From 7b8919e431e4e0b51ba44808b0300494ba78826f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index a7e8f13bb9761..e8be9e5a244fd 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5821,7 +5821,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5962,9 +5962,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-5.10/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-5.10/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..f44294dde7 --- /dev/null +++ b/queue-5.10/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From d8551f7d29121f523ff50008e8ace08bf70f540f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 63517995c692a..f22b32b4c8022 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -185,12 +185,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.10/tls-don-t-rely-on-tx_work-during-send.patch b/queue-5.10/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..fef2029da5 --- /dev/null +++ b/queue-5.10/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From ca24c97199be91c7ac3e21298e816239307f81b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index e519a0160668e..a300d1ac13a88 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1056,6 +1056,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1110,6 +1117,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-5.15/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-5.15/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..7ff0cbcb62 --- /dev/null +++ b/queue-5.15/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From acd43b177ba68246acd4abe0595d86ec21dc3bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 011d0f0c39415..dc70256ca2203 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. +-- +2.51.0 + diff --git a/queue-5.15/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch b/queue-5.15/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch new file mode 100644 index 0000000000..da786259c5 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch @@ -0,0 +1,50 @@ +From 5e7b3bed30a92c1aad262404558fd4deb17ca252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:16:45 +0800 +Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card + +From: Jiaming Zhang + +[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ] + +In try_to_register_card(), the return value of usb_ifnum_to_if() is +passed directly to usb_interface_claimed() without a NULL check, which +will lead to a NULL pointer dereference when creating an invalid +USB audio device. Fix this by adding a check to ensure the interface +pointer is valid before passing it to usb_interface_claimed(). + +Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") +Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ +Signed-off-by: Jiaming Zhang +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index bec6d41a143d2..33ffa62032ab9 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -753,10 +753,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) + */ + static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) + { ++ struct usb_interface *iface; ++ + if (check_delayed_register_option(chip) == ifnum || +- chip->last_iface == ifnum || +- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) ++ chip->last_iface == ifnum) ++ return snd_card_register(chip->card); ++ ++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); ++ if (iface && usb_interface_claimed(iface)) + return snd_card_register(chip->card); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-5.15/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..ca9e70bab7 --- /dev/null +++ b/queue-5.15/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 501dcb8b461da69bf3947970894971cbfc9bbe4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index af04c035633ff..32397517807b0 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 19fed56b6ee3f..ebb8b3e5b9a88 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-5.15/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch b/queue-5.15/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch new file mode 100644 index 0000000000..787dbd2cb8 --- /dev/null +++ b/queue-5.15/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch @@ -0,0 +1,46 @@ +From fa63c9f277a2d8a3878324f12251a1e862e014fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 17:46:32 +0200 +Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() + +From: Marc Kleine-Budde + +[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ] + +Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to +m_can_platform") moved the PM runtime enable from the m_can core +driver into the m_can_platform. + +That patch forgot to move the pm_runtime_disable() to +m_can_plat_remove(), so that unloading the m_can_platform driver +causes an "Unbalanced pm_runtime_enable!" error message. + +Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the +problem. + +Cc: Patrik Flykt +Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index de6d8e01bf2e8..71cf3662128a1 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -170,7 +170,7 @@ static int m_can_plat_remove(struct platform_device *pdev) + struct m_can_classdev *mcan_class = &priv->cdev; + + m_can_class_unregister(mcan_class); +- ++ pm_runtime_disable(mcan_class->dev); + m_can_class_free_dev(mcan_class->net); + + return 0; +-- +2.51.0 + diff --git a/queue-5.15/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-5.15/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..1f04e9aa12 --- /dev/null +++ b/queue-5.15/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From cb6ce603b3da5ee478fa2d01efff59f56a587ace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 4ab1c493c73f1..504114394995c 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1285,7 +1285,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-5.15/doc-fix-seg6_flowlabel-path.patch b/queue-5.15/doc-fix-seg6_flowlabel-path.patch new file mode 100644 index 0000000000..145f6f0632 --- /dev/null +++ b/queue-5.15/doc-fix-seg6_flowlabel-path.patch @@ -0,0 +1,38 @@ +From 2d163fa4a5775d988c09bf527fcb0ede3b73cdf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:18:59 +0200 +Subject: doc: fix seg6_flowlabel path + +From: Nicolas Dichtel + +[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ] + +This sysctl is not per interface; it's global per netns. + +Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") +Reported-by: Philippe Guibert +Signed-off-by: Nicolas Dichtel +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/seg6-sysctl.rst | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst +index 07c20e470bafe..1b6af4779be11 100644 +--- a/Documentation/networking/seg6-sysctl.rst ++++ b/Documentation/networking/seg6-sysctl.rst +@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER + + Default is 0. + ++/proc/sys/net/ipv6/seg6_* variables: ++==================================== ++ + seg6_flowlabel - INTEGER + Controls the behaviour of computing the flowlabel of outer + IPv6 header in case of SR T.encaps +-- +2.51.0 + diff --git a/queue-5.15/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-5.15/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..494445626d --- /dev/null +++ b/queue-5.15/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From 70dc121a31f6c3eb10f8a5e3da4b85560e7a6aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 2d1f37aefdbd1..e25032ad16be7 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5387,8 +5387,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-5.15/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..7f29275bf5 --- /dev/null +++ b/queue-5.15/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From c1655ba4bcba2c46812b2c3207ee5d40a3e8084d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index ca8bfd1b8278e..59db32dcf9f3d 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -499,25 +499,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-5.15/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-5.15/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..9a50ac362c --- /dev/null +++ b/queue-5.15/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 4a925ddf41d555884da98fafe9b61a6fe2d64eb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index d8b9942f1afd9..7ca06cf6e0f79 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -467,6 +467,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 9f9b7768cd192..7ddadf779004e 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -553,20 +553,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 5955fca601b3a..ccdea44438940 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1247,8 +1247,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-5.15/net-tls-wait-for-async-completion-on-last-message.patch b/queue-5.15/net-tls-wait-for-async-completion-on-last-message.patch new file mode 100644 index 0000000000..331164c0af --- /dev/null +++ b/queue-5.15/net-tls-wait-for-async-completion-on-last-message.patch @@ -0,0 +1,52 @@ +From ceb365e650c723362371b80af45df99511d32cf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2024 14:17:41 +0200 +Subject: net: tls: wait for async completion on last message + +From: Sascha Hauer + +[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ] + +When asynchronous encryption is used KTLS sends out the final data at +proto->close time. This becomes problematic when the task calling +close() receives a signal. In this case it can happen that +tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the +final data is not sent. + +The described situation happens when KTLS is used in conjunction with +io_uring, as io_uring uses task_work_add() to add work to the current +userspace task. A discussion of the problem along with a reproducer can +be found in [1] and [2] + +Fix this by waiting for the asynchronous encryption to be completed on +the final message. With this there is no data left to be sent at close +time. + +[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/ +[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/ + +Signed-off-by: Sascha Hauer +Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 6b0fd0e5fc880..d2cb19f5cb8bc 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1164,7 +1164,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + + if (!num_async) { + goto send_end; +- } else if (num_zc) { ++ } else if (num_zc || eor) { + int err; + + /* Wait for pending encryptions to get completed */ +-- +2.51.0 + diff --git a/queue-5.15/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch b/queue-5.15/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch new file mode 100644 index 0000000000..78bd504d48 --- /dev/null +++ b/queue-5.15/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch @@ -0,0 +1,96 @@ +From 2f451670de3bbcf2250c964d71af587f48bf7c27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:07:42 +0100 +Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address + +From: Oleksij Rempel + +[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ] + +Convert `lan78xx_init_mac_address` to return error codes and handle +failures in register read and write operations. Update `lan78xx_reset` +to check for errors during MAC address initialization and propagate them +appropriately. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 4be15489a2c2a..182a4dbd8cf26 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1773,13 +1773,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { + .get_regs = lan78xx_get_regs, + }; + +-static void lan78xx_init_mac_address(struct lan78xx_net *dev) ++static int lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; + u8 addr[6]; ++ int ret; ++ ++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ if (ret < 0) ++ return ret; + +- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ if (ret < 0) ++ return ret; + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1812,14 +1818,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ if (ret < 0) ++ return ret; + } + +- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ if (ret < 0) ++ return ret; + + eth_hw_addr_set(dev->net, addr); ++ ++ return 0; + } + + /* MDIO read and write wrappers for phylib */ +@@ -2718,7 +2736,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- lan78xx_init_mac_address(dev); ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; + + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); +-- +2.51.0 + diff --git a/queue-5.15/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-5.15/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..5755bdacf7 --- /dev/null +++ b/queue-5.15/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From 4fd25d722aef6ab7e8495114e9dfd5dd3b396ebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 182a4dbd8cf26..174d94bdaae64 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2736,10 +2736,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -2748,6 +2744,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-5.15/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch b/queue-5.15/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch new file mode 100644 index 0000000000..558cb08b8a --- /dev/null +++ b/queue-5.15/net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch @@ -0,0 +1,111 @@ +From 2abdcacb1d5f69988036f5ec4651f09a0353682f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 14:32:24 -0700 +Subject: net: usb: use eth_hw_addr_set() instead of ether_addr_copy() + +From: Jakub Kicinski + +[ Upstream commit af804e6db9f60b923ff5149d9bf782e0baa82a2b ] + +Commit 406f42fa0d3c ("net-next: When a bond have a massive amount +of VLANs...") introduced a rbtree for faster Ethernet address look +up. To maintain netdev->dev_addr in this tree we need to make all +the writes to it got through appropriate helpers. + +Convert net/usb from ether_addr_copy() to eth_hw_addr_set(): + + @@ + expression dev, np; + @@ + - ether_addr_copy(dev->dev_addr, np) + + eth_hw_addr_set(dev, np) + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/aqc111.c | 2 +- + drivers/net/usb/lan78xx.c | 4 ++-- + drivers/net/usb/r8152.c | 2 +- + drivers/net/usb/rndis_host.c | 2 +- + drivers/net/usb/rtl8150.c | 2 +- + 5 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index 6be07557bc63d..00aba7e1d0b95 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -720,7 +720,7 @@ static int aqc111_bind(struct usbnet *dev, struct usb_interface *intf) + if (ret) + goto out; + +- ether_addr_copy(dev->net->dev_addr, dev->net->perm_addr); ++ eth_hw_addr_set(dev->net, dev->net->perm_addr); + + /* Set Rx urb size */ + dev->rx_urb_size = URB_SIZE; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 2279a4b8cd4e3..4be15489a2c2a 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1819,7 +1819,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + lan78xx_write_reg(dev, MAF_LO(0), addr_lo); + lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); + +- ether_addr_copy(dev->net->dev_addr, addr); ++ eth_hw_addr_set(dev->net, addr); + } + + /* MDIO read and write wrappers for phylib */ +@@ -2394,7 +2394,7 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p) + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + +- ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(netdev, addr->sa_data); + + addr_lo = netdev->dev_addr[0] | + netdev->dev_addr[1] << 8 | +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1dfa0091fa307..1bd18a6292803 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -1724,7 +1724,7 @@ static int set_ethernet_addr(struct r8152 *tp, bool in_resume) + return ret; + + if (tp->version == RTL_VER_01) +- ether_addr_copy(dev->dev_addr, sa.sa_data); ++ eth_hw_addr_set(dev, sa.sa_data); + else + ret = __rtl8152_set_mac_address(dev, &sa, in_resume); + +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index e5f6614da5acc..f3e4a68b6c947 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -422,7 +422,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) + if (bp[0] & 0x02) + eth_hw_addr_random(net); + else +- ether_addr_copy(net->dev_addr, bp); ++ eth_hw_addr_set(net, bp); + + /* set a nonzero filter to enable data transfers */ + memset(u.set, 0, sizeof *u.set); +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index 324bec0c22fb4..57f1056a27b14 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -270,7 +270,7 @@ static void set_ethernet_addr(rtl8150_t *dev) + ret = get_registers(dev, IDR, sizeof(node_id), node_id); + + if (!ret) { +- ether_addr_copy(dev->netdev->dev_addr, node_id); ++ eth_hw_addr_set(dev->netdev, node_id); + } else { + eth_hw_addr_random(dev->netdev); + netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", +-- +2.51.0 + diff --git a/queue-5.15/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-5.15/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..90697d933c --- /dev/null +++ b/queue-5.15/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From fafb4f9c7a11e28dc00c7b91789588fd9f4bc476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 1ea30c9b8c07c..07dc9fdeea54c 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4962,8 +4962,9 @@ static int rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_runtime_resume(device); +-- +2.51.0 + diff --git a/queue-5.15/riscv-kprobes-fix-probe-address-validation.patch b/queue-5.15/riscv-kprobes-fix-probe-address-validation.patch new file mode 100644 index 0000000000..025046752e --- /dev/null +++ b/queue-5.15/riscv-kprobes-fix-probe-address-validation.patch @@ -0,0 +1,64 @@ +From 7bbc4c7faba8c72ead96d2989e37c2b185a39ed3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:25:13 +0200 +Subject: riscv: kprobes: Fix probe address validation + +From: Fabian Vogt + +[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ] + +When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", +arch_check_kprobe would start iterating all instructions starting from +_text until the probed address. Not only is this very inefficient, but +literal values in there (e.g. left by function patching) are +misinterpreted in a way that causes a desync. + +Fix this by doing it like x86: start the iteration at the closest +preceding symbol instead of the given starting point. + +Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") +Signed-off-by: Fabian Vogt +Signed-off-by: Marvin Friedrich +Acked-by: Guo Ren +Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index 7548b1d62509c..5251f18278017 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + +-static bool __kprobes arch_check_kprobe(struct kprobe *p) ++static bool __kprobes arch_check_kprobe(unsigned long addr) + { +- unsigned long tmp = (unsigned long)p->addr - p->offset; +- unsigned long addr = (unsigned long)p->addr; ++ unsigned long tmp, offset; ++ ++ /* start iterating at the closest preceding symbol */ ++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) ++ return false; ++ ++ tmp = addr - offset; + + while (tmp <= addr) { + if (tmp == addr) +@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if ((unsigned long)insn & 0x1) + return -EILSEQ; + +- if (!arch_check_kprobe(p)) ++ if (!arch_check_kprobe((unsigned long)p->addr)) + return -EILSEQ; + + /* copy instruction */ +-- +2.51.0 + diff --git a/queue-5.15/sched-balancing-rename-newidle_balance-sched_balance.patch b/queue-5.15/sched-balancing-rename-newidle_balance-sched_balance.patch new file mode 100644 index 0000000000..e98d9be15f --- /dev/null +++ b/queue-5.15/sched-balancing-rename-newidle_balance-sched_balance.patch @@ -0,0 +1,95 @@ +From 45bbebefd25b0d0c54116a565b2785b2d0d21633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:18:16 +0100 +Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle() + +From: Ingo Molnar + +[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ] + +Standardize scheduler load-balancing function names on the +sched_balance_() prefix. + +Signed-off-by: Ingo Molnar +Reviewed-by: Shrikanth Hegde +Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index ea707ee9ddac1..03b809308712e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3959,7 +3959,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); + + static inline unsigned long task_util(struct task_struct *p) + { +@@ -4291,7 +4291,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -7280,7 +7280,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + if (rq->nr_running) + return 1; + +- return newidle_balance(rq, rf) != 0; ++ return sched_balance_newidle(rq, rf) != 0; + } + #endif /* CONFIG_SMP */ + +@@ -7616,10 +7616,10 @@ done: __maybe_unused; + if (!rf) + return NULL; + +- new_tasks = newidle_balance(rq, rf); ++ new_tasks = sched_balance_newidle(rq, rf); + + /* +- * Because newidle_balance() releases (and re-acquires) rq->lock, it is ++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is + * possible for any higher priority task to appear. In that case we + * must re-start the pick_next_entity() loop. + */ +@@ -10427,7 +10427,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, + ld_moved = 0; + + /* +- * newidle_balance() disregards balance intervals, so we could ++ * sched_balance_newidle() disregards balance intervals, so we could + * repeatedly reach this code, which would lead to balance_interval + * skyrocketing in a short amount of time. Skip the balance_interval + * increase logic to avoid that. +@@ -11155,7 +11155,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * newidle_balance is called by schedule() if this_cpu is about to become ++ * sched_balance_newidle is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + * + * Returns: +@@ -11163,7 +11163,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + * 0 - failed, no new tasks + * > 0 - success, new (fair) tasks present + */ +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +-- +2.51.0 + diff --git a/queue-5.15/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-5.15/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..929f624173 --- /dev/null +++ b/queue-5.15/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From d17708aaf6d87d9e25338d1515dc0a36978e58f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 03b809308712e..87f32cf8aa029 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7613,21 +7613,21 @@ done: __maybe_unused; + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 13cbbbe33a..1b024cce17 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -13,3 +13,26 @@ drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch crypto-rockchip-fix-dma_unmap_sg-nents-value.patch cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch hid-multitouch-fix-sticky-fingers.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch +net-dlink-handle-dma_map_single-failure-properly.patch +doc-fix-seg6_flowlabel-path.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +splice-net-add-a-splice_eof-op-to-file-ops-and-socke.patch +net-tls-wait-for-async-completion-on-last-message.patch +tls-wait-for-async-encrypt-in-case-of-error-during-l.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-don-t-rely-on-tx_work-during-send.patch +net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch +net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +riscv-kprobes-fix-probe-address-validation.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +sched-balancing-rename-newidle_balance-sched_balance.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch +alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch diff --git a/queue-5.15/splice-net-add-a-splice_eof-op-to-file-ops-and-socke.patch b/queue-5.15/splice-net-add-a-splice_eof-op-to-file-ops-and-socke.patch new file mode 100644 index 0000000000..73717a5353 --- /dev/null +++ b/queue-5.15/splice-net-add-a-splice_eof-op-to-file-ops-and-socke.patch @@ -0,0 +1,212 @@ +From 80062a0bb92b49fa486a08b38a6b64359b4c4470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 19:19:10 +0100 +Subject: splice, net: Add a splice_eof op to file-ops and socket-ops + +From: David Howells + +[ Upstream commit 2bfc66850952b6921b2033b09729ec59eabbc81d ] + +Add an optional method, ->splice_eof(), to allow splice to indicate the +premature termination of a splice to struct file_operations and struct +proto_ops. + +This is called if sendfile() or splice() encounters all of the following +conditions inside splice_direct_to_actor(): + + (1) the user did not set SPLICE_F_MORE (splice only), and + + (2) an EOF condition occurred (->splice_read() returned 0), and + + (3) we haven't read enough to fulfill the request (ie. len > 0 still), and + + (4) we have already spliced at least one byte. + +A further patch will modify the behaviour of SPLICE_F_MORE to always be +passed to the actor if either the user set it or we haven't yet read +sufficient data to fulfill the request. + +Suggested-by: Linus Torvalds +Link: https://lore.kernel.org/r/CAHk-=wh=V579PDYvkpnTobCLGczbgxpMgGmmhqiTyE34Cpi5Gg@mail.gmail.com/ +Signed-off-by: David Howells +Reviewed-by: Jakub Kicinski +cc: Jens Axboe +cc: Christoph Hellwig +cc: Al Viro +cc: Matthew Wilcox +cc: Jan Kara +cc: Jeff Layton +cc: David Hildenbrand +cc: Christian Brauner +cc: Chuck Lever +cc: Boris Pismenny +cc: John Fastabend +cc: linux-mm@kvack.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg") +Signed-off-by: Sasha Levin +--- + fs/splice.c | 31 ++++++++++++++++++++++++++++++- + include/linux/fs.h | 1 + + include/linux/net.h | 1 + + include/linux/splice.h | 1 + + include/net/sock.h | 1 + + net/socket.c | 10 ++++++++++ + 6 files changed, 44 insertions(+), 1 deletion(-) + +diff --git a/fs/splice.c b/fs/splice.c +index 5dbce4dcc1a7d..e8591211044a3 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -767,6 +767,17 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, + return out->f_op->splice_write(pipe, out, ppos, len, flags); + } + ++/* ++ * Indicate to the caller that there was a premature EOF when reading from the ++ * source and the caller didn't indicate they would be sending more data after ++ * this. ++ */ ++static void do_splice_eof(struct splice_desc *sd) ++{ ++ if (sd->splice_eof) ++ sd->splice_eof(sd); ++} ++ + /* + * Attempt to initiate a splice from a file to a pipe. + */ +@@ -869,7 +880,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + + ret = do_splice_to(in, &pos, pipe, len, flags); + if (unlikely(ret <= 0)) +- goto out_release; ++ goto read_failure; + + read_len = ret; + sd->total_len = read_len; +@@ -909,6 +920,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + file_accessed(in); + return bytes; + ++read_failure: ++ /* ++ * If the user did *not* set SPLICE_F_MORE *and* we didn't hit that ++ * "use all of len" case that cleared SPLICE_F_MORE, *and* we did a ++ * "->splice_in()" that returned EOF (ie zero) *and* we have sent at ++ * least 1 byte *then* we will also do the ->splice_eof() call. ++ */ ++ if (ret == 0 && !more && len > 0 && bytes) ++ do_splice_eof(sd); + out_release: + /* + * If we did an incomplete transfer we must release +@@ -937,6 +957,14 @@ static int direct_splice_actor(struct pipe_inode_info *pipe, + sd->flags); + } + ++static void direct_file_splice_eof(struct splice_desc *sd) ++{ ++ struct file *file = sd->u.file; ++ ++ if (file->f_op->splice_eof) ++ file->f_op->splice_eof(file); ++} ++ + /** + * do_splice_direct - splices data directly between two files + * @in: file to splice from +@@ -962,6 +990,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out, + .flags = flags, + .pos = *ppos, + .u.file = out, ++ .splice_eof = direct_file_splice_eof, + .opos = opos, + }; + long ret; +diff --git a/include/linux/fs.h b/include/linux/fs.h +index a8d708fe08b30..72a956d243c2e 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2104,6 +2104,7 @@ struct file_operations { + int (*flock) (struct file *, int, struct file_lock *); + ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); + ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); ++ void (*splice_eof)(struct file *file); + int (*setlease)(struct file *, long, struct file_lock **, void **); + long (*fallocate)(struct file *file, int mode, loff_t offset, + loff_t len); +diff --git a/include/linux/net.h b/include/linux/net.h +index ba736b457a068..9054f17e4b631 100644 +--- a/include/linux/net.h ++++ b/include/linux/net.h +@@ -187,6 +187,7 @@ struct proto_ops { + int offset, size_t size, int flags); + ssize_t (*splice_read)(struct socket *sock, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, unsigned int flags); ++ void (*splice_eof)(struct socket *sock); + int (*set_peek_off)(struct sock *sk, int val); + int (*peek_len)(struct socket *sock); + +diff --git a/include/linux/splice.h b/include/linux/splice.h +index a55179fd60fc3..41a70687be853 100644 +--- a/include/linux/splice.h ++++ b/include/linux/splice.h +@@ -38,6 +38,7 @@ struct splice_desc { + struct file *file; /* file to read/write */ + void *data; /* cookie */ + } u; ++ void (*splice_eof)(struct splice_desc *sd); /* Unexpected EOF handler */ + loff_t pos; /* file position */ + loff_t *opos; /* sendfile: output position */ + size_t num_spliced; /* number of bytes already spliced */ +diff --git a/include/net/sock.h b/include/net/sock.h +index 3158cf0269ac9..b987074f80965 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1229,6 +1229,7 @@ struct proto { + int *addr_len); + int (*sendpage)(struct sock *sk, struct page *page, + int offset, size_t size, int flags); ++ void (*splice_eof)(struct socket *sock); + int (*bind)(struct sock *sk, + struct sockaddr *addr, int addr_len); + int (*bind_add)(struct sock *sk, +diff --git a/net/socket.c b/net/socket.c +index bb2a209e3e28d..1d71fa44ace45 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -129,6 +129,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page, + static ssize_t sock_splice_read(struct file *file, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); ++static void sock_splice_eof(struct file *file); + + #ifdef CONFIG_PROC_FS + static void sock_show_fdinfo(struct seq_file *m, struct file *f) +@@ -163,6 +164,7 @@ static const struct file_operations socket_file_ops = { + .sendpage = sock_sendpage, + .splice_write = generic_splice_sendpage, + .splice_read = sock_splice_read, ++ .splice_eof = sock_splice_eof, + .show_fdinfo = sock_show_fdinfo, + }; + +@@ -1037,6 +1039,14 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos, + return sock->ops->splice_read(sock, ppos, pipe, len, flags); + } + ++static void sock_splice_eof(struct file *file) ++{ ++ struct socket *sock = file->private_data; ++ ++ if (sock->ops->splice_eof) ++ sock->ops->splice_eof(sock); ++} ++ + static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) + { + struct file *file = iocb->ki_filp; +-- +2.51.0 + diff --git a/queue-5.15/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-5.15/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..a41f3fe7b8 --- /dev/null +++ b/queue-5.15/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From 47c3d1544d743b92df4bc43e115d10d4dce0471a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3a66d0c7d015c..dd63832c11fd7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2180,7 +2180,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2242,9 +2243,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-5.15/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-5.15/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..01061a6951 --- /dev/null +++ b/queue-5.15/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From ed541e8bb62c87f44200569f369a0c36d8613014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 7c51b9b593afc..bd3b56c7aab8d 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5815,7 +5815,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5956,9 +5956,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-5.15/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-5.15/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..7ba2aec20b --- /dev/null +++ b/queue-5.15/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From 0bfd361beff4011f26648b068e7e4791fd53c81e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index ba170f1f38a4c..0352771295914 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -185,12 +185,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.15/tls-don-t-rely-on-tx_work-during-send.patch b/queue-5.15/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..494617a121 --- /dev/null +++ b/queue-5.15/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From a1830ac59041bbbf5d7cf3459ea65a6e8047c9f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index e08edfc639fd5..110859f7e5e3e 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1089,6 +1089,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1143,6 +1150,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-5.15/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch b/queue-5.15/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch new file mode 100644 index 0000000000..94c7080018 --- /dev/null +++ b/queue-5.15/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch @@ -0,0 +1,67 @@ +From f9fd5adf6a854508bdeb988afd8fd4250db2390d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:57 +0200 +Subject: tls: wait for async encrypt in case of error during latter iterations + of sendmsg + +From: Sabrina Dubroca + +[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ] + +If we hit an error during the main loop of tls_sw_sendmsg_locked (eg +failed allocation), we jump to send_end and immediately +return. Previous iterations may have queued async encryption requests +that are still pending. We should wait for those before returning, as +we could otherwise be reading from memory that userspace believes +we're not using anymore, which would be a sort of use-after-free. + +This is similar to what tls_sw_recvmsg already does: failures during +the main loop jump to the "wait for async" code, not straight to the +unlock/return. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index d2cb19f5cb8bc..e08edfc639fd5 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1013,7 +1013,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + if (ret == -EINPROGRESS) + num_async++; + else if (ret != -EAGAIN) +- goto send_end; ++ goto end; + } + } + +@@ -1162,8 +1162,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto alloc_encrypted; + } + ++send_end: + if (!num_async) { +- goto send_end; ++ goto end; + } else if (num_zc || eor) { + int err; + +@@ -1181,7 +1182,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + tls_tx_records(sk, msg->msg_flags); + } + +-send_end: ++end: + ret = sk_stream_error(sk, msg->msg_flags, ret); + + release_sock(sk); +-- +2.51.0 + diff --git a/queue-5.4/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-5.4/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..a6356896e6 --- /dev/null +++ b/queue-5.4/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 6d3b6f0f07397c141274b4acbfd6310b9241dbe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index bbbca964b9b46..f1933f7b9f1bf 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + */ +-- +2.51.0 + diff --git a/queue-5.4/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-5.4/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..8d4f1d1332 --- /dev/null +++ b/queue-5.4/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 683112be2ab02171a3cbd6ca551bcf5cacc5a8fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index de10e7e3a68d0..1fa7eb75d1a39 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1247,7 +1247,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 3819b23c927d5..6dd95e7d81e41 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1637,6 +1637,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-5.4/net-dl2k-switch-from-pci_-to-dma_-api.patch b/queue-5.4/net-dl2k-switch-from-pci_-to-dma_-api.patch new file mode 100644 index 0000000000..7541e6bc78 --- /dev/null +++ b/queue-5.4/net-dl2k-switch-from-pci_-to-dma_-api.patch @@ -0,0 +1,319 @@ +From a578fd8dc79cdf79b79a31553163b1a1140cfd4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Sep 2020 08:14:17 +0200 +Subject: net: dl2k: switch from 'pci_' to 'dma_' API + +From: Christophe JAILLET + +[ Upstream commit b49db89e9697ddfa7fbe7387e176072ee2feb2db ] + +The wrappers in include/linux/pci-dma-compat.h should go away. + +The patch has been generated with the coccinelle script below and has been +hand modified to replace GFP_ with a correct flag. +It has been compile tested. + +When memory is allocated in 'rio_probe1()' GFP_KERNEL can be used because +it is a probe function and no lock is taken in the between. + +@@ +@@ +- PCI_DMA_BIDIRECTIONAL ++ DMA_BIDIRECTIONAL + +@@ +@@ +- PCI_DMA_TODEVICE ++ DMA_TO_DEVICE + +@@ +@@ +- PCI_DMA_FROMDEVICE ++ DMA_FROM_DEVICE + +@@ +@@ +- PCI_DMA_NONE ++ DMA_NONE + +@@ +expression e1, e2, e3; +@@ +- pci_alloc_consistent(e1, e2, e3) ++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_) + +@@ +expression e1, e2, e3; +@@ +- pci_zalloc_consistent(e1, e2, e3) ++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_free_consistent(e1, e2, e3, e4) ++ dma_free_coherent(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_map_single(e1, e2, e3, e4) ++ dma_map_single(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_single(e1, e2, e3, e4) ++ dma_unmap_single(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4, e5; +@@ +- pci_map_page(e1, e2, e3, e4, e5) ++ dma_map_page(&e1->dev, e2, e3, e4, e5) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_page(e1, e2, e3, e4) ++ dma_unmap_page(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_map_sg(e1, e2, e3, e4) ++ dma_map_sg(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_sg(e1, e2, e3, e4) ++ dma_unmap_sg(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_single_for_cpu(e1, e2, e3, e4) ++ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_single_for_device(e1, e2, e3, e4) ++ dma_sync_single_for_device(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) ++ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_sg_for_device(e1, e2, e3, e4) ++ dma_sync_sg_for_device(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2; +@@ +- pci_dma_mapping_error(e1, e2) ++ dma_mapping_error(&e1->dev, e2) + +@@ +expression e1, e2; +@@ +- pci_set_dma_mask(e1, e2) ++ dma_set_mask(&e1->dev, e2) + +@@ +expression e1, e2; +@@ +- pci_set_consistent_dma_mask(e1, e2) ++ dma_set_coherent_mask(&e1->dev, e2) + +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Stable-dep-of: 65946eac6d88 ("net: dlink: handle dma_map_single() failure properly") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 80 ++++++++++++++++--------------- + 1 file changed, 41 insertions(+), 39 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index b4a8d4f12087a..8597648156635 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -233,13 +233,15 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) + + pci_set_drvdata (pdev, dev); + +- ring_space = pci_alloc_consistent (pdev, TX_TOTAL_SIZE, &ring_dma); ++ ring_space = dma_alloc_coherent(&pdev->dev, TX_TOTAL_SIZE, &ring_dma, ++ GFP_KERNEL); + if (!ring_space) + goto err_out_iounmap; + np->tx_ring = ring_space; + np->tx_ring_dma = ring_dma; + +- ring_space = pci_alloc_consistent (pdev, RX_TOTAL_SIZE, &ring_dma); ++ ring_space = dma_alloc_coherent(&pdev->dev, RX_TOTAL_SIZE, &ring_dma, ++ GFP_KERNEL); + if (!ring_space) + goto err_out_unmap_tx; + np->rx_ring = ring_space; +@@ -290,9 +292,11 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) + return 0; + + err_out_unmap_rx: +- pci_free_consistent (pdev, RX_TOTAL_SIZE, np->rx_ring, np->rx_ring_dma); ++ dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring, ++ np->rx_ring_dma); + err_out_unmap_tx: +- pci_free_consistent (pdev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma); ++ dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring, ++ np->tx_ring_dma); + err_out_iounmap: + #ifdef MEM_MAPPING + pci_iounmap(pdev, np->ioaddr); +@@ -446,8 +450,9 @@ static void free_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + skb = np->rx_skbuff[i]; + if (skb) { +- pci_unmap_single(np->pdev, desc_to_dma(&np->rx_ring[i]), +- skb->len, PCI_DMA_FROMDEVICE); ++ dma_unmap_single(&np->pdev->dev, ++ desc_to_dma(&np->rx_ring[i]), ++ skb->len, DMA_FROM_DEVICE); + dev_kfree_skb(skb); + np->rx_skbuff[i] = NULL; + } +@@ -457,8 +462,9 @@ static void free_list(struct net_device *dev) + for (i = 0; i < TX_RING_SIZE; i++) { + skb = np->tx_skbuff[i]; + if (skb) { +- pci_unmap_single(np->pdev, desc_to_dma(&np->tx_ring[i]), +- skb->len, PCI_DMA_TODEVICE); ++ dma_unmap_single(&np->pdev->dev, ++ desc_to_dma(&np->tx_ring[i]), ++ skb->len, DMA_TO_DEVICE); + dev_kfree_skb(skb); + np->tx_skbuff[i] = NULL; + } +@@ -515,9 +521,8 @@ static int alloc_list(struct net_device *dev) + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ + np->rx_ring[i].fraginfo = +- cpu_to_le64(pci_map_single( +- np->pdev, skb->data, np->rx_buf_sz, +- PCI_DMA_FROMDEVICE)); ++ cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE)); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + +@@ -683,9 +688,8 @@ rio_timer (struct timer_list *t) + } + np->rx_skbuff[entry] = skb; + np->rx_ring[entry].fraginfo = +- cpu_to_le64 (pci_map_single +- (np->pdev, skb->data, np->rx_buf_sz, +- PCI_DMA_FROMDEVICE)); ++ cpu_to_le64 (dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE)); + } + np->rx_ring[entry].fraginfo |= + cpu_to_le64((u64)np->rx_buf_sz << 48); +@@ -739,9 +743,8 @@ start_xmit (struct sk_buff *skb, struct net_device *dev) + ((u64)np->vlan << 32) | + ((u64)skb->priority << 45); + } +- txdesc->fraginfo = cpu_to_le64 (pci_map_single (np->pdev, skb->data, +- skb->len, +- PCI_DMA_TODEVICE)); ++ txdesc->fraginfo = cpu_to_le64 (dma_map_single(&np->pdev->dev, skb->data, ++ skb->len, DMA_TO_DEVICE)); + txdesc->fraginfo |= cpu_to_le64((u64)skb->len << 48); + + /* DL2K bug: DMA fails to get next descriptor ptr in 10Mbps mode +@@ -838,9 +841,9 @@ rio_free_tx (struct net_device *dev, int irq) + if (!(np->tx_ring[entry].status & cpu_to_le64(TFDDone))) + break; + skb = np->tx_skbuff[entry]; +- pci_unmap_single (np->pdev, +- desc_to_dma(&np->tx_ring[entry]), +- skb->len, PCI_DMA_TODEVICE); ++ dma_unmap_single(&np->pdev->dev, ++ desc_to_dma(&np->tx_ring[entry]), skb->len, ++ DMA_TO_DEVICE); + if (irq) + dev_consume_skb_irq(skb); + else +@@ -965,25 +968,25 @@ receive_packet (struct net_device *dev) + + /* Small skbuffs for short packets */ + if (pkt_len > copy_thresh) { +- pci_unmap_single (np->pdev, +- desc_to_dma(desc), +- np->rx_buf_sz, +- PCI_DMA_FROMDEVICE); ++ dma_unmap_single(&np->pdev->dev, ++ desc_to_dma(desc), ++ np->rx_buf_sz, ++ DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; + } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { +- pci_dma_sync_single_for_cpu(np->pdev, +- desc_to_dma(desc), +- np->rx_buf_sz, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_cpu(&np->pdev->dev, ++ desc_to_dma(desc), ++ np->rx_buf_sz, ++ DMA_FROM_DEVICE); + skb_copy_to_linear_data (skb, + np->rx_skbuff[entry]->data, + pkt_len); + skb_put (skb, pkt_len); +- pci_dma_sync_single_for_device(np->pdev, +- desc_to_dma(desc), +- np->rx_buf_sz, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_device(&np->pdev->dev, ++ desc_to_dma(desc), ++ np->rx_buf_sz, ++ DMA_FROM_DEVICE); + } + skb->protocol = eth_type_trans (skb, dev); + #if 0 +@@ -1016,9 +1019,8 @@ receive_packet (struct net_device *dev) + } + np->rx_skbuff[entry] = skb; + np->rx_ring[entry].fraginfo = +- cpu_to_le64 (pci_map_single +- (np->pdev, skb->data, np->rx_buf_sz, +- PCI_DMA_FROMDEVICE)); ++ cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE)); + } + np->rx_ring[entry].fraginfo |= + cpu_to_le64((u64)np->rx_buf_sz << 48); +@@ -1818,10 +1820,10 @@ rio_remove1 (struct pci_dev *pdev) + struct netdev_private *np = netdev_priv(dev); + + unregister_netdev (dev); +- pci_free_consistent (pdev, RX_TOTAL_SIZE, np->rx_ring, +- np->rx_ring_dma); +- pci_free_consistent (pdev, TX_TOTAL_SIZE, np->tx_ring, +- np->tx_ring_dma); ++ dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring, ++ np->rx_ring_dma); ++ dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring, ++ np->tx_ring_dma); + #ifdef MEM_MAPPING + pci_iounmap(pdev, np->ioaddr); + #endif +-- +2.51.0 + diff --git a/queue-5.4/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-5.4/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..54514bf99b --- /dev/null +++ b/queue-5.4/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From 86ba146507dce0881956d560dc7119268663a30b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 8597648156635..855328ae6ea57 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -508,25 +508,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-5.4/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-5.4/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..72479f8541 --- /dev/null +++ b/queue-5.4/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 5978936965a6535b190469414bd61fd6702340f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 3a04e2ccfb393..d2945ec5aba21 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -454,6 +454,21 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb, + struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + gfp_t flags); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 906c37c7f80d5..38cace81bfa2d 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -560,20 +560,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 5319093d9aa62..c79e6c032b300 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1201,8 +1201,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-5.4/sched-balancing-rename-newidle_balance-sched_balance.patch b/queue-5.4/sched-balancing-rename-newidle_balance-sched_balance.patch new file mode 100644 index 0000000000..1869768e5d --- /dev/null +++ b/queue-5.4/sched-balancing-rename-newidle_balance-sched_balance.patch @@ -0,0 +1,90 @@ +From 6131381137925dc64542a5498bcf91ad51f9c73a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:18:16 +0100 +Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle() + +From: Ingo Molnar + +[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ] + +Standardize scheduler load-balancing function names on the +sched_balance_() prefix. + +Signed-off-by: Ingo Molnar +Reviewed-by: Shrikanth Hegde +Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 1d82b9cc9eb77..62c0348ef556a 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3690,7 +3690,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); + + static inline unsigned long task_util(struct task_struct *p) + { +@@ -3851,7 +3851,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -6690,7 +6690,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + if (rq->nr_running) + return 1; + +- return newidle_balance(rq, rf) != 0; ++ return sched_balance_newidle(rq, rf) != 0; + } + #endif /* CONFIG_SMP */ + +@@ -6981,10 +6981,10 @@ done: __maybe_unused; + if (!rf) + return NULL; + +- new_tasks = newidle_balance(rq, rf); ++ new_tasks = sched_balance_newidle(rq, rf); + + /* +- * Because newidle_balance() releases (and re-acquires) rq->lock, it is ++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is + * possible for any higher priority task to appear. In that case we + * must re-start the pick_next_entity() loop. + */ +@@ -9182,7 +9182,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, + ld_moved = 0; + + /* +- * newidle_balance() disregards balance intervals, so we could ++ * sched_balance_newidle() disregards balance intervals, so we could + * repeatedly reach this code, which would lead to balance_interval + * skyrocketting in a short amount of time. Skip the balance_interval + * increase logic to avoid that. +@@ -9897,10 +9897,10 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * newidle_balance is called by schedule() if this_cpu is about to become ++ * sched_balance_newidle is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + */ +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +-- +2.51.0 + diff --git a/queue-5.4/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-5.4/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..f51b9b400f --- /dev/null +++ b/queue-5.4/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From 05686279236c95809859e94d50c6216d5b1ea2f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 62c0348ef556a..5e8f2167d8caa 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6978,21 +6978,21 @@ done: __maybe_unused; + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-5.4/sched-fair-trivial-correction-of-the-newidle_balance.patch b/queue-5.4/sched-fair-trivial-correction-of-the-newidle_balance.patch new file mode 100644 index 0000000000..b719763a4a --- /dev/null +++ b/queue-5.4/sched-fair-trivial-correction-of-the-newidle_balance.patch @@ -0,0 +1,39 @@ +From bc8d436105b261ccccdce02ef038118ec93f96e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 11:06:41 +1300 +Subject: sched/fair: Trivial correction of the newidle_balance() comment + +From: Barry Song + +[ Upstream commit 5b78f2dc315354c05300795064f587366a02c6ff ] + +idle_balance() has been renamed to newidle_balance(). To differentiate +with nohz_idle_balance, it seems refining the comment will be helpful +for the readers of the code. + +Signed-off-by: Barry Song +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lkml.kernel.org/r/20201202220641.22752-1-song.bao.hua@hisilicon.com +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index db4a1da522e42..1d82b9cc9eb77 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9897,7 +9897,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * idle_balance is called by schedule() if this_cpu is about to become ++ * newidle_balance is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + */ + static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) +-- +2.51.0 + diff --git a/queue-5.4/sched-make-newidle_balance-static-again.patch b/queue-5.4/sched-make-newidle_balance-static-again.patch new file mode 100644 index 0000000000..6f5db21ed5 --- /dev/null +++ b/queue-5.4/sched-make-newidle_balance-static-again.patch @@ -0,0 +1,80 @@ +From 73bf5432d99188c1372124e9d5a413ff9e1c3a89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Apr 2020 18:50:34 +0800 +Subject: sched: Make newidle_balance() static again + +From: Chen Yu + +[ Upstream commit d91cecc156620ec75d94c55369509c807c3d07e6 ] + +After Commit 6e2df0581f56 ("sched: Fix pick_next_task() vs 'change' +pattern race"), there is no need to expose newidle_balance() as it +is only used within fair.c file. Change this function back to static again. + +No functional change. + +Reported-by: kbuild test robot +Suggested-by: Peter Zijlstra +Signed-off-by: Chen Yu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/83cd3030b031ca5d646cd5e225be10e7a0fdd8f5.1587464698.git.yu.c.chen@intel.com +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 6 ++++-- + kernel/sched/sched.h | 4 ---- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 2680216234ff2..db4a1da522e42 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3690,6 +3690,8 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + ++static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++ + static inline unsigned long task_util(struct task_struct *p) + { + return READ_ONCE(p->se.avg.util_avg); +@@ -3849,7 +3851,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int idle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -9898,7 +9900,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + * idle_balance is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + */ +-int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index b8a3db59e3267..46e6f4e905dd6 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1464,14 +1464,10 @@ static inline void unregister_sched_domain_sysctl(void) + } + #endif + +-extern int newidle_balance(struct rq *this_rq, struct rq_flags *rf); +- + #else + + static inline void sched_ttwu_pending(void) { } + +-static inline int newidle_balance(struct rq *this_rq, struct rq_flags *rf) { return 0; } +- + #endif /* CONFIG_SMP */ + + #include "stats.h" +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 23dcdd2455..9a6a9c5bf6 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -156,3 +156,16 @@ media-lirc-fix-error-handling-in-lirc_register.patch xen-events-update-virq_to_irq-on-migration.patch media-pci-ivtv-switch-from-pci_-to-dma_-api.patch media-pci-ivtv-add-missing-check-after-dma-map.patch +net-dl2k-switch-from-pci_-to-dma_-api.patch +net-dlink-handle-dma_map_single-failure-properly.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-don-t-rely-on-tx_work-during-send.patch +sched-make-newidle_balance-static-again.patch +sched-fair-trivial-correction-of-the-newidle_balance.patch +sched-balancing-rename-newidle_balance-sched_balance.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch diff --git a/queue-5.4/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-5.4/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..ae2acaa42c --- /dev/null +++ b/queue-5.4/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From 9a3a6801e4131fc47ce209324eb1880fb472149c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 4f203cbbc99b5..6492110e0c9b0 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1952,7 +1952,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2014,9 +2015,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-5.4/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-5.4/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..0f8a0159be --- /dev/null +++ b/queue-5.4/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From 7b3de864be175b878e68b2df69f347c55b500d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 55aa877713339..3ea966d85ea38 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5827,7 +5827,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5968,9 +5968,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-5.4/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-5.4/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..8b9de07a89 --- /dev/null +++ b/queue-5.4/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From c45bd0ef8c66572f26e24425dd637a75b2b5dcf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index cb51a2f46b11d..5bf809b090342 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -181,12 +181,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.4/tls-don-t-rely-on-tx_work-during-send.patch b/queue-5.4/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..21f0b59425 --- /dev/null +++ b/queue-5.4/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From 785b98b97f829018852014c5bf4148aa3ad1c8b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 8dabbbf521688..b175f0595a478 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1052,6 +1052,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1106,6 +1113,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-6.1/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-6.1/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..34e6c7758e --- /dev/null +++ b/queue-6.1/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 77db58bbcdb74f658acd1feeab42bd083064df9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 011d0f0c39415..dc70256ca2203 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch b/queue-6.1/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch new file mode 100644 index 0000000000..632ebc57b8 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch @@ -0,0 +1,50 @@ +From 698aaeddebf4d8c0edfe1e3dec7861877a7448af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:16:45 +0800 +Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card + +From: Jiaming Zhang + +[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ] + +In try_to_register_card(), the return value of usb_ifnum_to_if() is +passed directly to usb_interface_claimed() without a NULL check, which +will lead to a NULL pointer dereference when creating an invalid +USB audio device. Fix this by adding a check to ensure the interface +pointer is valid before passing it to usb_interface_claimed(). + +Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") +Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ +Signed-off-by: Jiaming Zhang +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 5f539a1baef3d..d7fe1c22a48bb 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -753,10 +753,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) + */ + static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) + { ++ struct usb_interface *iface; ++ + if (check_delayed_register_option(chip) == ifnum || +- chip->last_iface == ifnum || +- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) ++ chip->last_iface == ifnum) ++ return snd_card_register(chip->card); ++ ++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); ++ if (iface && usb_interface_claimed(iface)) + return snd_card_register(chip->card); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-6.1/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..a9d72c9e2b --- /dev/null +++ b/queue-6.1/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 3d0e4225030ab4e7d2d31bb89fc86cbc9f5cf970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 34d45cebefb5d..b4d57da71de2a 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 19fed56b6ee3f..ebb8b3e5b9a88 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-6.1/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch b/queue-6.1/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch new file mode 100644 index 0000000000..1308f97165 --- /dev/null +++ b/queue-6.1/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch @@ -0,0 +1,103 @@ +From 1f98e30c3f928712976653ddf235a051ffa5c266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:26 +0300 +Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit + +From: Cristian Ciocaltea + +[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ] + +Stress testing the audio jack hotplug handling on a few Steam Deck units +revealed that the debounce circuit is responsible for having a negative +impact on the detection reliability, e.g. in some cases the ejection +interrupt is not fired, while in other instances it goes into a kind of +invalid state and generates a flood of misleading interrupts. + +Add new entries to the DMI table introduced via commit 1bc40efdaf4a +("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") +and extend the quirk logic to allow bypassing the debounce circuit used +for jack detection on Valve Steam Deck LCD and OLED models. + +While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to +NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability +by differentiating from similarly named register bits. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 380ceac4d8700..66309eede0dbd 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -26,7 +26,8 @@ + #include + #include "nau8821.h" + +-#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1) + + static int nau8821_quirk; + static int quirk_override = -1; +@@ -1043,9 +1044,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2, + NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE); + +- /* Not bypass de-bounce circuit */ +- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, +- NAU8821_JACK_DET_DB_BYPASS, 0); ++ /* Do not bypass de-bounce circuit */ ++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)) ++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, ++ NAU8821_JACK_DET_DB_BYPASS, 0); + + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, + NAU8821_IRQ_EJECT_EN, 0); +@@ -1718,7 +1720,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), + DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), + }, +- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), ++ }, ++ { ++ /* Valve Steam Deck LCD */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), ++ }, ++ { ++ /* Valve Steam Deck OLED */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), + }, + {} + }; +@@ -1760,9 +1778,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821_check_quirks(); + +- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH) + nau8821->jkdet_polarity = 0; + ++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS) ++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n"); ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.51.0 + diff --git a/queue-6.1/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch b/queue-6.1/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch new file mode 100644 index 0000000000..d59514378d --- /dev/null +++ b/queue-6.1/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch @@ -0,0 +1,61 @@ +From 2d7c74bf70faf630ade03d9d3f53704b126e60b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:23 +0300 +Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection + +From: Cristian Ciocaltea + +[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ] + +The microphone detection work scheduled by a prior jack insertion +interrupt may still be in a pending state or under execution when a jack +ejection interrupt has been fired. + +This might lead to a racing condition or nau8821_jdet_work() completing +after nau8821_eject_jack(), which will override the currently +disconnected state of the jack and incorrectly report the headphone or +the headset as being connected. + +Cancel any pending jdet_work or wait for its execution to finish before +attempting to handle the ejection interrupt. + +Proceed similarly before launching the eject handler as a consequence of +detecting an invalid insert interrupt. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index efd92656a060d..ae2becb30beaa 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1063,6 +1063,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + + if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == + NAU8821_JACK_EJECT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); +@@ -1077,11 +1078,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + clear_irq = NAU8821_KEY_RELEASE_IRQ; + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_EN); + if (nau8821_is_jack_inserted(regmap)) { + /* detect microphone and jack type */ +- cancel_work_sync(&nau8821->jdet_work); + schedule_work(&nau8821->jdet_work); + /* Turn off insertion interruption at manual mode */ + regmap_update_bits(regmap, +-- +2.51.0 + diff --git a/queue-6.1/asoc-nau8821-generalize-helper-to-clear-irq-status.patch b/queue-6.1/asoc-nau8821-generalize-helper-to-clear-irq-status.patch new file mode 100644 index 0000000000..acf7af923f --- /dev/null +++ b/queue-6.1/asoc-nau8821-generalize-helper-to-clear-irq-status.patch @@ -0,0 +1,78 @@ +From ecd0cf3722278bb18a9f6b6b6356d4ad31f21540 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:24 +0300 +Subject: ASoC: nau8821: Generalize helper to clear IRQ status + +From: Cristian Ciocaltea + +[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ] + +Instead of adding yet another utility function for dealing with the +interrupt clearing register, generalize nau8821_int_status_clear_all() +by renaming it to nau8821_irq_status_clear(), whilst introducing a +second parameter to allow restricting the operation scope to a single +interrupt instead of the whole range of active IRQs. + +While at it, also fix a spelling typo in the comment block. + +Note this is mainly a prerequisite for subsequent patches aiming to +address some deficiencies in the implementation of the interrupt +handler. Thus the presence of the Fixes tag below is intentional, to +facilitate backporting. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index ae2becb30beaa..380ceac4d8700 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -902,12 +902,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap) + return active_high == is_high; + } + +-static void nau8821_int_status_clear_all(struct regmap *regmap) ++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq) + { +- int active_irq, clear_irq, i; ++ int clear_irq, i; + +- /* Reset the intrruption status from rightmost bit if the corres- +- * ponding irq event occurs. ++ if (active_irq) { ++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq); ++ return; ++ } ++ ++ /* Reset the interruption status from rightmost bit if the ++ * corresponding irq event occurs. + */ + regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq); + for (i = 0; i < NAU8821_REG_DATA_LEN; i++) { +@@ -934,7 +939,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + snd_soc_dapm_sync(dapm); + + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable the insertion interruption, disable the ejection inter- + * ruption, and then bypass de-bounce circuit. +@@ -1400,7 +1405,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821) + nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0); + if (nau8821->irq) { + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable both insertion and ejection interruptions, and then + * bypass de-bounce circuit. +-- +2.51.0 + diff --git a/queue-6.1/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch b/queue-6.1/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch new file mode 100644 index 0000000000..ee6837069c --- /dev/null +++ b/queue-6.1/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch @@ -0,0 +1,46 @@ +From a09b0c85e84722ad758221e2e82c32469ef25bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 17:46:32 +0200 +Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() + +From: Marc Kleine-Budde + +[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ] + +Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to +m_can_platform") moved the PM runtime enable from the m_can core +driver into the m_can_platform. + +That patch forgot to move the pm_runtime_disable() to +m_can_plat_remove(), so that unloading the m_can_platform driver +causes an "Unbalanced pm_runtime_enable!" error message. + +Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the +problem. + +Cc: Patrik Flykt +Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index de6d8e01bf2e8..71cf3662128a1 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -170,7 +170,7 @@ static int m_can_plat_remove(struct platform_device *pdev) + struct m_can_classdev *mcan_class = &priv->cdev; + + m_can_class_unregister(mcan_class); +- ++ pm_runtime_disable(mcan_class->dev); + m_can_class_free_dev(mcan_class->net); + + return 0; +-- +2.51.0 + diff --git a/queue-6.1/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-6.1/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..481f19722d --- /dev/null +++ b/queue-6.1/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From 14977b7f6bc47a0f7f758a093215e8c5d5ba05de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index ca7138bb1d545..2ebe70de35ec3 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1524,7 +1524,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-6.1/doc-fix-seg6_flowlabel-path.patch b/queue-6.1/doc-fix-seg6_flowlabel-path.patch new file mode 100644 index 0000000000..1d8de909de --- /dev/null +++ b/queue-6.1/doc-fix-seg6_flowlabel-path.patch @@ -0,0 +1,38 @@ +From 5e67e1e90da09dd475fe9d3fce721ebee60695fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:18:59 +0200 +Subject: doc: fix seg6_flowlabel path + +From: Nicolas Dichtel + +[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ] + +This sysctl is not per interface; it's global per netns. + +Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") +Reported-by: Philippe Guibert +Signed-off-by: Nicolas Dichtel +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/seg6-sysctl.rst | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst +index 07c20e470bafe..1b6af4779be11 100644 +--- a/Documentation/networking/seg6-sysctl.rst ++++ b/Documentation/networking/seg6-sysctl.rst +@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER + + Default is 0. + ++/proc/sys/net/ipv6/seg6_* variables: ++==================================== ++ + seg6_flowlabel - INTEGER + Controls the behaviour of computing the flowlabel of outer + IPv6 header in case of SR T.encaps +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-6.1/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..fc81faf26c --- /dev/null +++ b/queue-6.1/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From 52ec1c286319f128cae86dfe0e2c3be904e898a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 530888c475be1..d13ab986a5c20 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5435,8 +5435,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + thermal_data->sw_ctf_threshold = thermal_data->max; + +-- +2.51.0 + diff --git a/queue-6.1/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch b/queue-6.1/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch new file mode 100644 index 0000000000..258e5f0546 --- /dev/null +++ b/queue-6.1/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch @@ -0,0 +1,45 @@ +From 44bc00f52af697966af1089e82802ef3dc7ea999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 12:59:53 +0200 +Subject: drm/bridge: lt9211: Drop check for last nibble of version register + +From: Marek Vasut + +[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ] + +There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . +The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the +driver checks for right now. Since there is a possibility there will be +yet another revision of the LT9211 in the future, drop the last version +nibble check to allow all future revisions of the chip to work with this +driver. + +This fix makes LT9211 rev. U5 work with this driver. + +Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c +index 933ca028d612d..fd581160d95e9 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9211.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c +@@ -121,8 +121,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) + } + + /* Test for known Chip ID. */ +- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE || +- chipid[2] != REG_CHIPID2_VALUE) { ++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) { + dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n", + chipid[0], chipid[1], chipid[2]); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/drm-rockchip-vop2-use-correct-destination-rectangle-.patch b/queue-6.1/drm-rockchip-vop2-use-correct-destination-rectangle-.patch new file mode 100644 index 0000000000..798002b96e --- /dev/null +++ b/queue-6.1/drm-rockchip-vop2-use-correct-destination-rectangle-.patch @@ -0,0 +1,40 @@ +From 74004f901624725e4ae4770e653c9224cc13d3e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 07:20:01 -0700 +Subject: drm/rockchip: vop2: use correct destination rectangle height check + +From: Alok Tiwari + +[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ] + +The vop2_plane_atomic_check() function incorrectly checks +drm_rect_width(dest) twice instead of verifying both width and height. +Fix the second condition to use drm_rect_height(dest) so that invalid +destination rectangles with height < 4 are correctly rejected. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Alok Tiwari +Reviewed-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 6efa0a51b7d65..e14557d80efc2 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -983,7 +983,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane, + return format; + + if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 || +- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) { ++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) { + drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n", + drm_rect_width(src) >> 16, drm_rect_height(src) >> 16, + drm_rect_width(dest), drm_rect_height(dest)); +-- +2.51.0 + diff --git a/queue-6.1/hid-hid-input-only-ignore-0-battery-events-for-digit.patch b/queue-6.1/hid-hid-input-only-ignore-0-battery-events-for-digit.patch new file mode 100644 index 0000000000..95cade0034 --- /dev/null +++ b/queue-6.1/hid-hid-input-only-ignore-0-battery-events-for-digit.patch @@ -0,0 +1,53 @@ +From a432faadb2024fcc8bc6c3385c424d63eec6dbea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 21:28:44 -0700 +Subject: HID: hid-input: only ignore 0 battery events for digitizers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ] + +Commit 581c4484769e ("HID: input: map digitizer battery usage") added +handling of battery events for digitizers (typically for batteries +presented in stylii). Digitizers typically report correct battery levels +only when stylus is actively touching the surface, and in other cases +they may report battery level of 0. To avoid confusing consumers of the +battery information the code was added to filer out reports with 0 +battery levels. + +However there exist other kinds of devices that may legitimately report +0 battery levels. Fix this by filtering out 0-level reports only for +digitizer usages, and continue reporting them for other kinds of devices +(Smart Batteries, etc). + +Reported-by: 卢国宏 +Fixes: 581c4484769e ("HID: input: map digitizer battery usage") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index cd9d031858438..59ec205421753 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -636,7 +636,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, + return; + } + +- if (value == 0 || value < dev->battery_min || value > dev->battery_max) ++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0) ++ return; ++ ++ if (value < dev->battery_min || value > dev->battery_max) + return; + + capacity = hidinput_scale_battery_capacity(dev, value); +-- +2.51.0 + diff --git a/queue-6.1/hid-multitouch-fix-name-of-stylus-input-devices.patch b/queue-6.1/hid-multitouch-fix-name-of-stylus-input-devices.patch new file mode 100644 index 0000000000..40d20f175e --- /dev/null +++ b/queue-6.1/hid-multitouch-fix-name-of-stylus-input-devices.patch @@ -0,0 +1,51 @@ +From 2693262b8543acdb947e2bb2778f6ff190655518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 09:40:33 -0300 +Subject: HID: multitouch: fix name of Stylus input devices + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ] + +HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by +commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). +However, on multitouch devices, these suffixes may be overridden. Before +that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after +that, multitouch would override them to have an "UNKNOWN" suffix. Just add +HID_DG_PEN to the list of non-overriden suffixes in multitouch. + +Before this fix: + +[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 +ELAN9008:00 04F3:2E14 UNKNOWN + +After this fix: + +[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 + +ELAN9008:00 04F3:2E14 Stylus + +Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Mika Westerberg +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6f1e54ee8f05d..b9e67b408a4b9 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1658,6 +1658,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + case HID_CP_CONSUMER_CONTROL: + case HID_GD_WIRELESS_RADIO_CTLS: + case HID_GD_SYSTEM_MULTIAXIS: ++ case HID_DG_PEN: + /* already handled by hid core */ + break; + case HID_DG_TOUCHSCREEN: +-- +2.51.0 + diff --git a/queue-6.1/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-6.1/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..4fe2483e91 --- /dev/null +++ b/queue-6.1/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From ed7c95bae9968c25b0b548d42c6ef8e690b7ac45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index bf58181589bf2..2221d5b7eeba9 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-6.1/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-6.1/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..74652651ed --- /dev/null +++ b/queue-6.1/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 82ef0e5fb71487d4db1b6ac6c4f5b5a01bab1d61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 84751313b8265..e93db837412b2 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -481,6 +481,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 90e55b9979e69..dcf9e9c52a22a 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 2a470c0c38aef..dfca22c6d345d 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1256,8 +1256,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-6.1/net-tls-wait-for-async-completion-on-last-message.patch b/queue-6.1/net-tls-wait-for-async-completion-on-last-message.patch new file mode 100644 index 0000000000..b4bf26c8e3 --- /dev/null +++ b/queue-6.1/net-tls-wait-for-async-completion-on-last-message.patch @@ -0,0 +1,52 @@ +From 468d2a40d2b1bbc2e3f2685c6eddd7029eff77e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2024 14:17:41 +0200 +Subject: net: tls: wait for async completion on last message + +From: Sascha Hauer + +[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ] + +When asynchronous encryption is used KTLS sends out the final data at +proto->close time. This becomes problematic when the task calling +close() receives a signal. In this case it can happen that +tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the +final data is not sent. + +The described situation happens when KTLS is used in conjunction with +io_uring, as io_uring uses task_work_add() to add work to the current +userspace task. A discussion of the problem along with a reproducer can +be found in [1] and [2] + +Fix this by waiting for the asynchronous encryption to be completed on +the final message. With this there is no data left to be sent at close +time. + +[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/ +[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/ + +Signed-off-by: Sascha Hauer +Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index fe6514e964ba3..c67cf1a06c0e5 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1184,7 +1184,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + + if (!num_async) { + goto send_end; +- } else if (num_zc) { ++ } else if (num_zc || eor) { + int err; + + /* Wait for pending encryptions to get completed */ +-- +2.51.0 + diff --git a/queue-6.1/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch b/queue-6.1/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch new file mode 100644 index 0000000000..121f329c19 --- /dev/null +++ b/queue-6.1/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch @@ -0,0 +1,96 @@ +From 4455b83d4da76c5ee11480c1d6a296623b9218d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:07:42 +0100 +Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address + +From: Oleksij Rempel + +[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ] + +Convert `lan78xx_init_mac_address` to return error codes and handle +failures in register read and write operations. Update `lan78xx_reset` +to check for errors during MAC address initialization and propagate them +appropriately. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 0f1c9009d793e..08fb03bcf4952 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1940,13 +1940,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { + .get_regs = lan78xx_get_regs, + }; + +-static void lan78xx_init_mac_address(struct lan78xx_net *dev) ++static int lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; + u8 addr[6]; ++ int ret; ++ ++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ if (ret < 0) ++ return ret; + +- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ if (ret < 0) ++ return ret; + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1979,14 +1985,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ if (ret < 0) ++ return ret; + } + +- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ if (ret < 0) ++ return ret; + + eth_hw_addr_set(dev->net, addr); ++ ++ return 0; + } + + /* MDIO read and write wrappers for phylib */ +@@ -2910,7 +2928,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- lan78xx_init_mac_address(dev); ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; + + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); +-- +2.51.0 + diff --git a/queue-6.1/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-6.1/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..d285c844b9 --- /dev/null +++ b/queue-6.1/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From 463e3b2e3a49838d558a2cff4f4430a9e40c7a6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 08fb03bcf4952..42f8fc71baee8 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2928,10 +2928,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -2940,6 +2936,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.1/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-6.1/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..d64bb312fe --- /dev/null +++ b/queue-6.1/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From 8e3ca393a9ce1c8944ccbb1a4f0b9ca6c272cafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 6346821d480bd..6879660e44fad 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4950,8 +4950,9 @@ static int rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_runtime_resume(device); +-- +2.51.0 + diff --git a/queue-6.1/riscv-kprobes-fix-probe-address-validation.patch b/queue-6.1/riscv-kprobes-fix-probe-address-validation.patch new file mode 100644 index 0000000000..ccdb1341ab --- /dev/null +++ b/queue-6.1/riscv-kprobes-fix-probe-address-validation.patch @@ -0,0 +1,64 @@ +From c323fc140bf9f7beca1081da382bd2246e4e260c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:25:13 +0200 +Subject: riscv: kprobes: Fix probe address validation + +From: Fabian Vogt + +[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ] + +When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", +arch_check_kprobe would start iterating all instructions starting from +_text until the probed address. Not only is this very inefficient, but +literal values in there (e.g. left by function patching) are +misinterpreted in a way that causes a desync. + +Fix this by doing it like x86: start the iteration at the closest +preceding symbol instead of the given starting point. + +Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") +Signed-off-by: Fabian Vogt +Signed-off-by: Marvin Friedrich +Acked-by: Guo Ren +Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index cca2b3a2135ad..f4836ef13e9bb 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + +-static bool __kprobes arch_check_kprobe(struct kprobe *p) ++static bool __kprobes arch_check_kprobe(unsigned long addr) + { +- unsigned long tmp = (unsigned long)p->addr - p->offset; +- unsigned long addr = (unsigned long)p->addr; ++ unsigned long tmp, offset; ++ ++ /* start iterating at the closest preceding symbol */ ++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) ++ return false; ++ ++ tmp = addr - offset; + + while (tmp <= addr) { + if (tmp == addr) +@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if ((unsigned long)insn & 0x1) + return -EILSEQ; + +- if (!arch_check_kprobe(p)) ++ if (!arch_check_kprobe((unsigned long)p->addr)) + return -EILSEQ; + + /* copy instruction */ +-- +2.51.0 + diff --git a/queue-6.1/sched-balancing-rename-newidle_balance-sched_balance.patch b/queue-6.1/sched-balancing-rename-newidle_balance-sched_balance.patch new file mode 100644 index 0000000000..56dd4b98f2 --- /dev/null +++ b/queue-6.1/sched-balancing-rename-newidle_balance-sched_balance.patch @@ -0,0 +1,95 @@ +From d6cce78b8fbe121245522c3191737620975a6df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:18:16 +0100 +Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle() + +From: Ingo Molnar + +[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ] + +Standardize scheduler load-balancing function names on the +sched_balance_() prefix. + +Signed-off-by: Ingo Molnar +Reviewed-by: Shrikanth Hegde +Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 2deb896883d38..cf889d1ed13d1 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4261,7 +4261,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); + + static inline unsigned long task_util(struct task_struct *p) + { +@@ -4590,7 +4590,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -7575,7 +7575,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + if (rq->nr_running) + return 1; + +- return newidle_balance(rq, rf) != 0; ++ return sched_balance_newidle(rq, rf) != 0; + } + #endif /* CONFIG_SMP */ + +@@ -7911,10 +7911,10 @@ done: __maybe_unused; + if (!rf) + return NULL; + +- new_tasks = newidle_balance(rq, rf); ++ new_tasks = sched_balance_newidle(rq, rf); + + /* +- * Because newidle_balance() releases (and re-acquires) rq->lock, it is ++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is + * possible for any higher priority task to appear. In that case we + * must re-start the pick_next_entity() loop. + */ +@@ -10786,7 +10786,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, + ld_moved = 0; + + /* +- * newidle_balance() disregards balance intervals, so we could ++ * sched_balance_newidle() disregards balance intervals, so we could + * repeatedly reach this code, which would lead to balance_interval + * skyrocketing in a short amount of time. Skip the balance_interval + * increase logic to avoid that. +@@ -11548,7 +11548,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * newidle_balance is called by schedule() if this_cpu is about to become ++ * sched_balance_newidle is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + * + * Returns: +@@ -11556,7 +11556,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + * 0 - failed, no new tasks + * > 0 - success, new (fair) tasks present + */ +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +-- +2.51.0 + diff --git a/queue-6.1/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-6.1/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..7805daa820 --- /dev/null +++ b/queue-6.1/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From bae53a41cc6f5826e5e02def17bd57336ee1c5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index cf889d1ed13d1..b6795bf15211c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7908,21 +7908,21 @@ done: __maybe_unused; + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 4b7cdcbdd2..d192c96692 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -34,3 +34,32 @@ timers-provide-timer_shutdown.patch timers-update-the-documentation-to-reflect-on-the-new-timer_shutdown-api.patch bluetooth-hci_qca-fix-the-teardown-problem-for-real.patch hid-multitouch-fix-sticky-fingers.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch +net-dlink-handle-dma_map_single-failure-properly.patch +doc-fix-seg6_flowlabel-path.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +net-tls-wait-for-async-completion-on-last-message.patch +tls-wait-for-async-encrypt-in-case-of-error-during-l.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch +tls-don-t-rely-on-tx_work-during-send.patch +net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +riscv-kprobes-fix-probe-address-validation.patch +drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch +asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch +asoc-nau8821-generalize-helper-to-clear-irq-status.patch +asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +drm-rockchip-vop2-use-correct-destination-rectangle-.patch +sched-balancing-rename-newidle_balance-sched_balance.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch +alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch +hid-hid-input-only-ignore-0-battery-events-for-digit.patch +hid-multitouch-fix-name-of-stylus-input-devices.patch diff --git a/queue-6.1/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-6.1/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..782995a9ad --- /dev/null +++ b/queue-6.1/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From c3817280e590183746596f2ae2ed82467831371b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 40568365cdb3b..a8d8e2f294ff2 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2184,7 +2184,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2246,9 +2247,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-6.1/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-6.1/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..371de6e298 --- /dev/null +++ b/queue-6.1/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From 01906c0ad76f445d30ffbba472ecb8da3bfc9806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 95d460237835d..8e5236142aaca 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5814,7 +5814,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5955,9 +5955,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-6.1/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-6.1/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..c311af5090 --- /dev/null +++ b/queue-6.1/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From aec93aa5f3960e0f55aa7b9b53fbc787055eea5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 14d01558311d2..4797f68b9ec80 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -208,12 +208,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/tls-don-t-rely-on-tx_work-during-send.patch b/queue-6.1/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..5d03bdf48c --- /dev/null +++ b/queue-6.1/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From bf4305c45eae555faa247a384035578fb7ef92ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index baed07edc6395..e7f151c98eb93 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1109,6 +1109,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + } else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1163,6 +1170,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-6.1/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch b/queue-6.1/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch new file mode 100644 index 0000000000..d8ef3584e3 --- /dev/null +++ b/queue-6.1/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch @@ -0,0 +1,67 @@ +From b0c45ed11b2ad2fdc839e419891e61956f5c5189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:57 +0200 +Subject: tls: wait for async encrypt in case of error during latter iterations + of sendmsg + +From: Sabrina Dubroca + +[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ] + +If we hit an error during the main loop of tls_sw_sendmsg_locked (eg +failed allocation), we jump to send_end and immediately +return. Previous iterations may have queued async encryption requests +that are still pending. We should wait for those before returning, as +we could otherwise be reading from memory that userspace believes +we're not using anymore, which would be a sort of use-after-free. + +This is similar to what tls_sw_recvmsg already does: failures during +the main loop jump to the "wait for async" code, not straight to the +unlock/return. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index c67cf1a06c0e5..0e378d7cb6903 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1029,7 +1029,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + if (ret == -EINPROGRESS) + num_async++; + else if (ret != -EAGAIN) +- goto send_end; ++ goto end; + } + } + +@@ -1182,8 +1182,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + goto alloc_encrypted; + } + ++send_end: + if (!num_async) { +- goto send_end; ++ goto end; + } else if (num_zc || eor) { + int err; + +@@ -1201,7 +1202,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + tls_tx_records(sk, msg->msg_flags); + } + +-send_end: ++end: + ret = sk_stream_error(sk, msg->msg_flags, ret); + + release_sock(sk); +-- +2.51.0 + diff --git a/queue-6.1/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch b/queue-6.1/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch new file mode 100644 index 0000000000..5055ff2d5c --- /dev/null +++ b/queue-6.1/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch @@ -0,0 +1,47 @@ +From a1451677313f6b2de04041181757fe04b8b1fbc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:59 +0200 +Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails + +From: Sabrina Dubroca + +[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ] + +Async decryption calls tls_strp_msg_hold to create a clone of the +input skb to hold references to the memory it uses. If we fail to +allocate that clone, proceeding with async decryption can lead to +various issues (UAF on the skb, writing into userspace memory after +the recv() call has returned). + +In this case, wait for all pending decryption requests. + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 0e378d7cb6903..baed07edc6395 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1724,8 +1724,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov, + + if (unlikely(darg->async)) { + err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold); +- if (err) +- __skb_queue_tail(&ctx->async_hold, darg->skb); ++ if (err) { ++ err = tls_decrypt_async_wait(ctx); ++ darg->async = false; ++ } + return err; + } + +-- +2.51.0 + diff --git a/queue-6.12/accel-qaic-fix-bootlog-initialization-ordering.patch b/queue-6.12/accel-qaic-fix-bootlog-initialization-ordering.patch new file mode 100644 index 0000000000..0a2d265d4d --- /dev/null +++ b/queue-6.12/accel-qaic-fix-bootlog-initialization-ordering.patch @@ -0,0 +1,58 @@ +From 12e65321ee51d001dfcb6f262c1aafb53eeb7767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 13:57:50 +0200 +Subject: accel/qaic: Fix bootlog initialization ordering + +From: Jeffrey Hugo + +[ Upstream commit fd6e385528d8f85993b7bfc6430576136bb14c65 ] + +As soon as we queue MHI buffers to receive the bootlog from the device, +we could be receiving data. Therefore all the resources needed to +process that data need to be setup prior to queuing the buffers. + +We currently initialize some of the resources after queuing the buffers +which creates a race between the probe() and any data that comes back +from the device. If the uninitialized resources are accessed, we could +see page faults. + +Fix the init ordering to close the race. + +Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs") +Signed-off-by: Jeffrey Hugo +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_debugfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/accel/qaic/qaic_debugfs.c b/drivers/accel/qaic/qaic_debugfs.c +index 20b653d99e524..5ed49daaf541f 100644 +--- a/drivers/accel/qaic/qaic_debugfs.c ++++ b/drivers/accel/qaic/qaic_debugfs.c +@@ -251,6 +251,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d + if (ret) + goto destroy_workqueue; + ++ dev_set_drvdata(&mhi_dev->dev, qdev); ++ qdev->bootlog_ch = mhi_dev; ++ + for (i = 0; i < BOOTLOG_POOL_SIZE; i++) { + msg = devm_kzalloc(&qdev->pdev->dev, sizeof(*msg), GFP_KERNEL); + if (!msg) { +@@ -266,8 +269,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d + goto mhi_unprepare; + } + +- dev_set_drvdata(&mhi_dev->dev, qdev); +- qdev->bootlog_ch = mhi_dev; + return 0; + + mhi_unprepare: +-- +2.51.0 + diff --git a/queue-6.12/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch b/queue-6.12/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch new file mode 100644 index 0000000000..3da3c0f1da --- /dev/null +++ b/queue-6.12/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch @@ -0,0 +1,106 @@ +From 63cf520c34eef35c0e548c9c06c8d507be0468f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 08:18:37 +0200 +Subject: accel/qaic: Synchronize access to DBC request queue head & tail + pointer + +From: Pranjal Ramajor Asha Kanojiya + +[ Upstream commit 52e59f7740ba23bbb664914967df9a00208ca10c ] + +Two threads of the same process can potential read and write parallelly to +head and tail pointers of the same DBC request queue. This could lead to a +race condition and corrupt the DBC request queue. + +Fixes: ff13be830333 ("accel/qaic: Add datapath") +Signed-off-by: Pranjal Ramajor Asha Kanojiya +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +[jhugo: Add fixes tag] +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic.h | 2 ++ + drivers/accel/qaic/qaic_data.c | 12 ++++++++++-- + drivers/accel/qaic/qaic_drv.c | 3 +++ + 3 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/accel/qaic/qaic.h b/drivers/accel/qaic/qaic.h +index 02561b6cecc64..2d7b3af09e284 100644 +--- a/drivers/accel/qaic/qaic.h ++++ b/drivers/accel/qaic/qaic.h +@@ -91,6 +91,8 @@ struct dma_bridge_chan { + * response queue's head and tail pointer of this DBC. + */ + void __iomem *dbc_base; ++ /* Synchronizes access to Request queue's head and tail pointer */ ++ struct mutex req_lock; + /* Head of list where each node is a memory handle queued in request queue */ + struct list_head xfer_list; + /* Synchronizes DBC readers during cleanup */ +diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c +index 43aba57b48f05..265eeb4e156fc 100644 +--- a/drivers/accel/qaic/qaic_data.c ++++ b/drivers/accel/qaic/qaic_data.c +@@ -1357,13 +1357,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + goto release_ch_rcu; + } + ++ ret = mutex_lock_interruptible(&dbc->req_lock); ++ if (ret) ++ goto release_ch_rcu; ++ + head = readl(dbc->dbc_base + REQHP_OFF); + tail = readl(dbc->dbc_base + REQTP_OFF); + + if (head == U32_MAX || tail == U32_MAX) { + /* PCI link error */ + ret = -ENODEV; +- goto release_ch_rcu; ++ goto unlock_req_lock; + } + + queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail); +@@ -1371,11 +1375,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + ret = send_bo_list_to_device(qdev, file_priv, exec, args->hdr.count, is_partial, dbc, + head, &tail); + if (ret) +- goto release_ch_rcu; ++ goto unlock_req_lock; + + /* Finalize commit to hardware */ + submit_ts = ktime_get_ns(); + writel(tail, dbc->dbc_base + REQTP_OFF); ++ mutex_unlock(&dbc->req_lock); + + update_profiling_data(file_priv, exec, args->hdr.count, is_partial, received_ts, + submit_ts, queue_level); +@@ -1383,6 +1388,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + if (datapath_polling) + schedule_work(&dbc->poll_work); + ++unlock_req_lock: ++ if (ret) ++ mutex_unlock(&dbc->req_lock); + release_ch_rcu: + srcu_read_unlock(&dbc->ch_lock, rcu_id); + unlock_dev_srcu: +diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c +index 10e711c96a670..cb606c4bb8511 100644 +--- a/drivers/accel/qaic/qaic_drv.c ++++ b/drivers/accel/qaic/qaic_drv.c +@@ -422,6 +422,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, const struct pci_de + return NULL; + init_waitqueue_head(&qdev->dbc[i].dbc_release); + INIT_LIST_HEAD(&qdev->dbc[i].bo_lists); ++ ret = drmm_mutex_init(drm, &qdev->dbc[i].req_lock); ++ if (ret) ++ return NULL; + } + + return qdev; +-- +2.51.0 + diff --git a/queue-6.12/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch b/queue-6.12/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch new file mode 100644 index 0000000000..0f2c7c16ec --- /dev/null +++ b/queue-6.12/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch @@ -0,0 +1,49 @@ +From bc158f68bd3c060de4fae1d3c6bdf829c33a4d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 14:23:20 +0200 +Subject: accel/qaic: Treat remaining == 0 as error in + find_and_map_user_pages() + +From: Youssef Samir + +[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ] + +Currently, if find_and_map_user_pages() takes a DMA xfer request from the +user with a length field set to 0, or in a rare case, the host receives +QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size +is equal to the requested transaction size, the function will return 0 +before allocating an sgt or setting the fields of the dma_xfer struct. +In that case, encode_addr_size_pairs() will try to access the sgt which +will lead to a general protection fault. + +Return an EINVAL in case the user provides a zero-sized ALP, or the device +requests continuation after all of the bytes have been transferred. + +Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") +Signed-off-by: Youssef Samir +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_control.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c +index d8bdab69f8009..b86a8e48e731b 100644 +--- a/drivers/accel/qaic/qaic_control.c ++++ b/drivers/accel/qaic/qaic_control.c +@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, + return -EINVAL; + remaining = in_trans->size - resources->xferred_dma_size; + if (remaining == 0) +- return 0; ++ return -EINVAL; + + if (check_add_overflow(xfer_start_addr, remaining, &end)) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-6.12/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..75527796e6 --- /dev/null +++ b/queue-6.12/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 8ad8f18b198206038866fae11cdd048b293aa3c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 775db3fc4959f..ec10270c2cce3 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch b/queue-6.12/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch new file mode 100644 index 0000000000..bb8b938aa6 --- /dev/null +++ b/queue-6.12/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch @@ -0,0 +1,50 @@ +From f1f157481ff8e799e9ff614eac6e77d946c4943c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:16:45 +0800 +Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card + +From: Jiaming Zhang + +[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ] + +In try_to_register_card(), the return value of usb_ifnum_to_if() is +passed directly to usb_interface_claimed() without a NULL check, which +will lead to a NULL pointer dereference when creating an invalid +USB audio device. Fix this by adding a check to ensure the interface +pointer is valid before passing it to usb_interface_claimed(). + +Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") +Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ +Signed-off-by: Jiaming Zhang +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 9c411b82a218d..d0a42859208aa 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -760,10 +760,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) + */ + static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) + { ++ struct usb_interface *iface; ++ + if (check_delayed_register_option(chip) == ifnum || +- chip->last_iface == ifnum || +- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) ++ chip->last_iface == ifnum) ++ return snd_card_register(chip->card); ++ ++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); ++ if (iface && usb_interface_claimed(iface)) + return snd_card_register(chip->card); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-6.12/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..45c23178c4 --- /dev/null +++ b/queue-6.12/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 05cdd6fa3d0c9bc6a2f83f284c726926115f720c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 8bc49259d71af..32a6d52614242 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index ed76a8df6ec6e..75e9cb3fc7aa6 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1664,6 +1664,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-6.12/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch b/queue-6.12/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch new file mode 100644 index 0000000000..b989190b8a --- /dev/null +++ b/queue-6.12/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch @@ -0,0 +1,41 @@ +From fd8bbcea9fd68ec535e5244922e21228364cdfba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:55:30 +0800 +Subject: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails + +From: Li Qiang + +[ Upstream commit 5726b68473f7153a7f6294185e5998b7e2a230a2 ] + +devm_kasprintf() may return NULL on memory allocation failure, +but the debug message prints cpus->dai_name before checking it. +Move the dev_dbg() call after the NULL check to prevent potential +NULL pointer dereference. + +Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver") +Signed-off-by: Li Qiang +Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c +index 99a244f495bd3..876f0b7fcd3de 100644 +--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c ++++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c +@@ -216,9 +216,9 @@ static int create_sdw_dailink(struct snd_soc_card *card, + cpus->dai_name = devm_kasprintf(dev, GFP_KERNEL, + "SDW%d Pin%d", + link_num, cpu_pin_id); +- dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name); + if (!cpus->dai_name) + return -ENOMEM; ++ dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name); + + codec_maps[j].cpu = 0; + codec_maps[j].codec = j; +-- +2.51.0 + diff --git a/queue-6.12/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch b/queue-6.12/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch new file mode 100644 index 0000000000..da16dbd903 --- /dev/null +++ b/queue-6.12/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch @@ -0,0 +1,54 @@ +From 959f68a8985dd614219ca04a18e15730c5855f09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 19:03:13 +0200 +Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec + +From: Christophe Leroy + +[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ] + +The gain ranges specified in Renesas IDT821034 codec documentation +are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the +receive path (DAC). Allthough the registers allow programming values +outside those ranges, the signal S/N and distorsion are only +guaranteed in the specified ranges. + +Set ranges to the specified ones. + +Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec") +Signed-off-by: Christophe Leroy +Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/idt821034.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c +index cb7a68c799f8f..401d0897b8ab4 100644 +--- a/sound/soc/codecs/idt821034.c ++++ b/sound/soc/codecs/idt821034.c +@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol, + return ret; + } + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306); +-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */ +-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300); ++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */ ++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */ + #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */ + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029); +-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/ +-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300); ++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */ ++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */ + #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */ + + static const struct snd_kcontrol_new idt821034_controls[] = { +-- +2.51.0 + diff --git a/queue-6.12/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch b/queue-6.12/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch new file mode 100644 index 0000000000..60b6afc6c4 --- /dev/null +++ b/queue-6.12/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch @@ -0,0 +1,103 @@ +From aaf4e9f1fe0bd3c0bd68bcd5b5f1cdd9f12bb392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:26 +0300 +Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit + +From: Cristian Ciocaltea + +[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ] + +Stress testing the audio jack hotplug handling on a few Steam Deck units +revealed that the debounce circuit is responsible for having a negative +impact on the detection reliability, e.g. in some cases the ejection +interrupt is not fired, while in other instances it goes into a kind of +invalid state and generates a flood of misleading interrupts. + +Add new entries to the DMI table introduced via commit 1bc40efdaf4a +("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") +and extend the quirk logic to allow bypassing the debounce circuit used +for jack detection on Valve Steam Deck LCD and OLED models. + +While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to +NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability +by differentiating from similarly named register bits. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 56e769446eb30..bfb719ca4c2cf 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -26,7 +26,8 @@ + #include + #include "nau8821.h" + +-#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1) + + static int nau8821_quirk; + static int quirk_override = -1; +@@ -1166,9 +1167,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2, + NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE); + +- /* Not bypass de-bounce circuit */ +- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, +- NAU8821_JACK_DET_DB_BYPASS, 0); ++ /* Do not bypass de-bounce circuit */ ++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)) ++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, ++ NAU8821_JACK_DET_DB_BYPASS, 0); + + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, + NAU8821_IRQ_EJECT_EN, 0); +@@ -1863,7 +1865,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), + DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), + }, +- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), ++ }, ++ { ++ /* Valve Steam Deck LCD */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), ++ }, ++ { ++ /* Valve Steam Deck OLED */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), + }, + {} + }; +@@ -1905,9 +1923,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821_check_quirks(); + +- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH) + nau8821->jkdet_polarity = 0; + ++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS) ++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n"); ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.51.0 + diff --git a/queue-6.12/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch b/queue-6.12/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch new file mode 100644 index 0000000000..db4dffd206 --- /dev/null +++ b/queue-6.12/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch @@ -0,0 +1,61 @@ +From 0f4b37925e53d1221c29a2a834cefb85ce4a92f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:23 +0300 +Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection + +From: Cristian Ciocaltea + +[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ] + +The microphone detection work scheduled by a prior jack insertion +interrupt may still be in a pending state or under execution when a jack +ejection interrupt has been fired. + +This might lead to a racing condition or nau8821_jdet_work() completing +after nau8821_eject_jack(), which will override the currently +disconnected state of the jack and incorrectly report the headphone or +the headset as being connected. + +Cancel any pending jdet_work or wait for its execution to finish before +attempting to handle the ejection interrupt. + +Proceed similarly before launching the eject handler as a consequence of +detecting an invalid insert interrupt. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index de5c4db05c8f8..23ee515db9bdd 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1186,6 +1186,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + + if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == + NAU8821_JACK_EJECT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); +@@ -1200,11 +1201,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + clear_irq = NAU8821_KEY_RELEASE_IRQ; + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_EN); + if (nau8821_is_jack_inserted(regmap)) { + /* detect microphone and jack type */ +- cancel_work_sync(&nau8821->jdet_work); + schedule_work(&nau8821->jdet_work); + /* Turn off insertion interruption at manual mode */ + regmap_update_bits(regmap, +-- +2.51.0 + diff --git a/queue-6.12/asoc-nau8821-generalize-helper-to-clear-irq-status.patch b/queue-6.12/asoc-nau8821-generalize-helper-to-clear-irq-status.patch new file mode 100644 index 0000000000..5e643d0058 --- /dev/null +++ b/queue-6.12/asoc-nau8821-generalize-helper-to-clear-irq-status.patch @@ -0,0 +1,78 @@ +From 495e6e7210eee1423f563110da1f680b1e4a63c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:24 +0300 +Subject: ASoC: nau8821: Generalize helper to clear IRQ status + +From: Cristian Ciocaltea + +[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ] + +Instead of adding yet another utility function for dealing with the +interrupt clearing register, generalize nau8821_int_status_clear_all() +by renaming it to nau8821_irq_status_clear(), whilst introducing a +second parameter to allow restricting the operation scope to a single +interrupt instead of the whole range of active IRQs. + +While at it, also fix a spelling typo in the comment block. + +Note this is mainly a prerequisite for subsequent patches aiming to +address some deficiencies in the implementation of the interrupt +handler. Thus the presence of the Fixes tag below is intentional, to +facilitate backporting. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 23ee515db9bdd..56e769446eb30 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1022,12 +1022,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap) + return active_high == is_high; + } + +-static void nau8821_int_status_clear_all(struct regmap *regmap) ++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq) + { +- int active_irq, clear_irq, i; ++ int clear_irq, i; + +- /* Reset the intrruption status from rightmost bit if the corres- +- * ponding irq event occurs. ++ if (active_irq) { ++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq); ++ return; ++ } ++ ++ /* Reset the interruption status from rightmost bit if the ++ * corresponding irq event occurs. + */ + regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq); + for (i = 0; i < NAU8821_REG_DATA_LEN; i++) { +@@ -1054,7 +1059,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + snd_soc_dapm_sync(dapm); + + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable the insertion interruption, disable the ejection inter- + * ruption, and then bypass de-bounce circuit. +@@ -1523,7 +1528,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821) + nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0); + if (nau8821->irq) { + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable both insertion and ejection interruptions, and then + * bypass de-bounce circuit. +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-add-deinit-callback.patch b/queue-6.12/can-m_can-add-deinit-callback.patch new file mode 100644 index 0000000000..cf629ef5c9 --- /dev/null +++ b/queue-6.12/can-m_can-add-deinit-callback.patch @@ -0,0 +1,57 @@ +From 46d2e00e5f448bed2ac8275af969262b7200fcba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 15:52:22 +0100 +Subject: can: m_can: add deinit callback + +From: Sean Nyekjaer + +[ Upstream commit baa8aaf79768b72eb7a181c476ca0291613f59e6 ] + +This is added in preparation for calling standby mode in the tcan4x5x +driver or other users of m_can. +For the tcan4x5x; If Vsup 12V, standby mode will save 7-8mA, when the +interface is down. + +Signed-off-by: Sean Nyekjaer +Link: https://patch.msgid.link/20241122-tcan-standby-v3-1-90bafaf5eccd@geanix.com +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: a9e30a22d6f2 ("can: m_can: fix CAN state in system PM") +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 7 +++++++ + drivers/net/can/m_can/m_can.h | 1 + + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index a7e326faca8ca..249263fca748d 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1796,6 +1796,13 @@ static void m_can_stop(struct net_device *dev) + + /* set the state as STOPPED */ + cdev->can.state = CAN_STATE_STOPPED; ++ ++ if (cdev->ops->deinit) { ++ ret = cdev->ops->deinit(cdev); ++ if (ret) ++ netdev_err(dev, "failed to deinitialize: %pe\n", ++ ERR_PTR(ret)); ++ } + } + + static int m_can_close(struct net_device *dev) +diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h +index ef39e8e527ab6..bd4746c63af3f 100644 +--- a/drivers/net/can/m_can/m_can.h ++++ b/drivers/net/can/m_can/m_can.h +@@ -68,6 +68,7 @@ struct m_can_ops { + int (*write_fifo)(struct m_can_classdev *cdev, int addr_offset, + const void *val, size_t val_count); + int (*init)(struct m_can_classdev *cdev); ++ int (*deinit)(struct m_can_classdev *cdev); + }; + + struct m_can_tx_op { +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-call-deinit-init-callback-when-going-into-.patch b/queue-6.12/can-m_can-call-deinit-init-callback-when-going-into-.patch new file mode 100644 index 0000000000..4894273a5f --- /dev/null +++ b/queue-6.12/can-m_can-call-deinit-init-callback-when-going-into-.patch @@ -0,0 +1,91 @@ +From 1b50e99838906460c6ad4077528a90dc88e0c7f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 15:52:24 +0100 +Subject: can: m_can: call deinit/init callback when going into suspend/resume + +From: Sean Nyekjaer + +[ Upstream commit ad1ddb3bfb0c9193eb19d4788192904350c7e51a ] + +m_can user like the tcan4x5x device, can go into standby mode. +Low power RX mode is enabled to allow wake on can. + +Signed-off-by: Sean Nyekjaer +Link: https://patch.msgid.link/20241122-tcan-standby-v3-3-90bafaf5eccd@geanix.com +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: a9e30a22d6f2 ("can: m_can: fix CAN state in system PM") +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 249263fca748d..bf7996c302426 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -2485,6 +2485,7 @@ int m_can_class_suspend(struct device *dev) + { + struct m_can_classdev *cdev = dev_get_drvdata(dev); + struct net_device *ndev = cdev->net; ++ int ret = 0; + + if (netif_running(ndev)) { + netif_stop_queue(ndev); +@@ -2497,6 +2498,9 @@ int m_can_class_suspend(struct device *dev) + if (cdev->pm_wake_source) { + hrtimer_cancel(&cdev->hrtimer); + m_can_write(cdev, M_CAN_IE, IR_RF0N); ++ ++ if (cdev->ops->deinit) ++ ret = cdev->ops->deinit(cdev); + } else { + m_can_stop(ndev); + } +@@ -2508,7 +2512,7 @@ int m_can_class_suspend(struct device *dev) + + cdev->can.state = CAN_STATE_SLEEPING; + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(m_can_class_suspend); + +@@ -2516,14 +2520,13 @@ int m_can_class_resume(struct device *dev) + { + struct m_can_classdev *cdev = dev_get_drvdata(dev); + struct net_device *ndev = cdev->net; ++ int ret = 0; + + pinctrl_pm_select_default_state(dev); + + cdev->can.state = CAN_STATE_ERROR_ACTIVE; + + if (netif_running(ndev)) { +- int ret; +- + ret = m_can_clk_start(cdev); + if (ret) + return ret; +@@ -2536,6 +2539,10 @@ int m_can_class_resume(struct device *dev) + * again. + */ + cdev->active_interrupts |= IR_RF0N | IR_TEFN; ++ ++ if (cdev->ops->init) ++ ret = cdev->ops->init(cdev); ++ + m_can_write(cdev, M_CAN_IE, cdev->active_interrupts); + } else { + ret = m_can_start(ndev); +@@ -2549,7 +2556,7 @@ int m_can_class_resume(struct device *dev) + netif_start_queue(ndev); + } + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(m_can_class_resume); + +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-fix-can-state-in-system-pm.patch b/queue-6.12/can-m_can-fix-can-state-in-system-pm.patch new file mode 100644 index 0000000000..dac219757f --- /dev/null +++ b/queue-6.12/can-m_can-fix-can-state-in-system-pm.patch @@ -0,0 +1,68 @@ +From 0f730d87a32f6a48b8f2659491fb1800e2df0768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 16:58:31 +0200 +Subject: can: m_can: fix CAN state in system PM + +From: Marc Kleine-Budde + +[ Upstream commit a9e30a22d6f23a2684c248871cad4c3061181639 ] + +A suspend/resume cycle on a down interface results in the interface +coming up in Error Active state. A suspend/resume cycle on an Up +interface will always result in Error Active state, regardless of the +actual CAN state. + +During suspend, only set running interfaces to CAN_STATE_SLEEPING. +During resume only touch the CAN state of running interfaces. For +wakeup sources, set the CAN state depending on the Protocol Status +Regitser (PSR), for non wakeup source interfaces m_can_start() will do +the same. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index bf7996c302426..f31a91ec7a6d0 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -2506,12 +2506,11 @@ int m_can_class_suspend(struct device *dev) + } + + m_can_clk_stop(cdev); ++ cdev->can.state = CAN_STATE_SLEEPING; + } + + pinctrl_pm_select_sleep_state(dev); + +- cdev->can.state = CAN_STATE_SLEEPING; +- + return ret; + } + EXPORT_SYMBOL_GPL(m_can_class_suspend); +@@ -2524,8 +2523,6 @@ int m_can_class_resume(struct device *dev) + + pinctrl_pm_select_default_state(dev); + +- cdev->can.state = CAN_STATE_ERROR_ACTIVE; +- + if (netif_running(ndev)) { + ret = m_can_clk_start(cdev); + if (ret) +@@ -2543,6 +2540,8 @@ int m_can_class_resume(struct device *dev) + if (cdev->ops->init) + ret = cdev->ops->init(cdev); + ++ cdev->can.state = m_can_state_get_by_psr(cdev); ++ + m_can_write(cdev, M_CAN_IE, cdev->active_interrupts); + } else { + ret = m_can_start(ndev); +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch b/queue-6.12/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch new file mode 100644 index 0000000000..993c928689 --- /dev/null +++ b/queue-6.12/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch @@ -0,0 +1,44 @@ +From 50b2322a89d7c27e525c2e33c7ed755848debf92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 18:24:12 +0200 +Subject: can: m_can: m_can_chip_config(): bring up interface in correct state + +From: Marc Kleine-Budde + +[ Upstream commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 ] + +In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the +CAN state and CAN error counters over an internal reset cycle. An +external reset is not always possible, due to the shared reset with +the other CAN core. This caused the core not always be in Error Active +state when bringing up the controller. + +Instead of always setting the CAN state to Error Active in +m_can_chip_config(), fix this by reading and decoding the Protocol +Status Regitser (PSR) and set the CAN state accordingly. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 8f663db386948..a7e326faca8ca 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1617,7 +1617,7 @@ static int m_can_start(struct net_device *dev) + netdev_queue_set_dql_min_limit(netdev_get_tx_queue(cdev->net, 0), + cdev->tx_max_coalesced_frames); + +- cdev->can.state = CAN_STATE_ERROR_ACTIVE; ++ cdev->can.state = m_can_state_get_by_psr(cdev); + + m_can_enable_all_interrupts(cdev); + +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch b/queue-6.12/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch new file mode 100644 index 0000000000..afd5225388 --- /dev/null +++ b/queue-6.12/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch @@ -0,0 +1,124 @@ +From add77cc37b26cc74d6448cb2671a17d9e1127156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 16:56:15 +0200 +Subject: can: m_can: m_can_handle_state_errors(): fix CAN state transition to + Error Active + +From: Marc Kleine-Budde + +[ Upstream commit 3d9db29b45f970d81acf61cf91a65442efbeb997 ] + +The CAN Error State is determined by the receive and transmit error +counters. The CAN error counters decrease when reception/transmission +is successful, so that a status transition back to the Error Active +status is possible. This transition is not handled by +m_can_handle_state_errors(). + +Add the missing detection of the Error Active state to +m_can_handle_state_errors() and extend the handling of this state in +m_can_handle_state_change(). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: 4942c42fe184 ("can: m_can: m_can_chip_config(): bring up interface in correct state") +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 53 +++++++++++++++++++++-------------- + 1 file changed, 32 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index dbcf17fb3ef25..8f663db386948 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -812,6 +812,9 @@ static int m_can_handle_state_change(struct net_device *dev, + u32 timestamp = 0; + + switch (new_state) { ++ case CAN_STATE_ERROR_ACTIVE: ++ cdev->can.state = CAN_STATE_ERROR_ACTIVE; ++ break; + case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cdev->can.can_stats.error_warning++; +@@ -841,6 +844,12 @@ static int m_can_handle_state_change(struct net_device *dev, + __m_can_get_berr_counter(dev, &bec); + + switch (new_state) { ++ case CAN_STATE_ERROR_ACTIVE: ++ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT; ++ cf->data[1] = CAN_ERR_CRTL_ACTIVE; ++ cf->data[6] = bec.txerr; ++ cf->data[7] = bec.rxerr; ++ break; + case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT; +@@ -877,30 +886,33 @@ static int m_can_handle_state_change(struct net_device *dev, + return 1; + } + +-static int m_can_handle_state_errors(struct net_device *dev, u32 psr) ++static enum can_state ++m_can_state_get_by_psr(struct m_can_classdev *cdev) + { +- struct m_can_classdev *cdev = netdev_priv(dev); +- int work_done = 0; ++ u32 reg_psr; + +- if (psr & PSR_EW && cdev->can.state != CAN_STATE_ERROR_WARNING) { +- netdev_dbg(dev, "entered error warning state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_ERROR_WARNING); +- } ++ reg_psr = m_can_read(cdev, M_CAN_PSR); + +- if (psr & PSR_EP && cdev->can.state != CAN_STATE_ERROR_PASSIVE) { +- netdev_dbg(dev, "entered error passive state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_ERROR_PASSIVE); +- } ++ if (reg_psr & PSR_BO) ++ return CAN_STATE_BUS_OFF; ++ if (reg_psr & PSR_EP) ++ return CAN_STATE_ERROR_PASSIVE; ++ if (reg_psr & PSR_EW) ++ return CAN_STATE_ERROR_WARNING; + +- if (psr & PSR_BO && cdev->can.state != CAN_STATE_BUS_OFF) { +- netdev_dbg(dev, "entered error bus off state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_BUS_OFF); +- } ++ return CAN_STATE_ERROR_ACTIVE; ++} + +- return work_done; ++static int m_can_handle_state_errors(struct net_device *dev) ++{ ++ struct m_can_classdev *cdev = netdev_priv(dev); ++ enum can_state new_state; ++ ++ new_state = m_can_state_get_by_psr(cdev); ++ if (new_state == cdev->can.state) ++ return 0; ++ ++ return m_can_handle_state_change(dev, new_state); + } + + static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus) +@@ -1031,8 +1043,7 @@ static int m_can_rx_handler(struct net_device *dev, int quota, u32 irqstatus) + } + + if (irqstatus & IR_ERR_STATE) +- work_done += m_can_handle_state_errors(dev, +- m_can_read(cdev, M_CAN_PSR)); ++ work_done += m_can_handle_state_errors(dev); + + if (irqstatus & IR_ERR_BUS_30X) + work_done += m_can_handle_bus_errors(dev, irqstatus, +-- +2.51.0 + diff --git a/queue-6.12/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch b/queue-6.12/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch new file mode 100644 index 0000000000..11a970d9bf --- /dev/null +++ b/queue-6.12/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch @@ -0,0 +1,46 @@ +From 006893a7f0b275255c34e9d80701f24236c7133b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 17:46:32 +0200 +Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() + +From: Marc Kleine-Budde + +[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ] + +Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to +m_can_platform") moved the PM runtime enable from the m_can core +driver into the m_can_platform. + +That patch forgot to move the pm_runtime_disable() to +m_can_plat_remove(), so that unloading the m_can_platform driver +causes an "Unbalanced pm_runtime_enable!" error message. + +Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the +problem. + +Cc: Patrik Flykt +Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index b832566efda04..057eaa7b8b4b2 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -180,7 +180,7 @@ static void m_can_plat_remove(struct platform_device *pdev) + struct m_can_classdev *mcan_class = &priv->cdev; + + m_can_class_unregister(mcan_class); +- ++ pm_runtime_disable(mcan_class->dev); + m_can_class_free_dev(mcan_class->net); + } + +-- +2.51.0 + diff --git a/queue-6.12/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-6.12/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..4633b3d23c --- /dev/null +++ b/queue-6.12/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From f2ba0f3ed98b42484ee9b5360ebc297eded6f398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 21b47402b3dca..756400f2a6257 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1578,7 +1578,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-6.12/doc-fix-seg6_flowlabel-path.patch b/queue-6.12/doc-fix-seg6_flowlabel-path.patch new file mode 100644 index 0000000000..bf58f97158 --- /dev/null +++ b/queue-6.12/doc-fix-seg6_flowlabel-path.patch @@ -0,0 +1,38 @@ +From 8d29f50816956b539bb63f8c9f2b2aa0359ce5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:18:59 +0200 +Subject: doc: fix seg6_flowlabel path + +From: Nicolas Dichtel + +[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ] + +This sysctl is not per interface; it's global per netns. + +Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") +Reported-by: Philippe Guibert +Signed-off-by: Nicolas Dichtel +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/seg6-sysctl.rst | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst +index 07c20e470bafe..1b6af4779be11 100644 +--- a/Documentation/networking/seg6-sysctl.rst ++++ b/Documentation/networking/seg6-sysctl.rst +@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER + + Default is 0. + ++/proc/sys/net/ipv6/seg6_* variables: ++==================================== ++ + seg6_flowlabel - INTEGER + Controls the behaviour of computing the flowlabel of outer + IPv6 header in case of SR T.encaps +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-6.12/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..52bfd597c0 --- /dev/null +++ b/queue-6.12/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From c4cf6e0286a2a6019b488ae844cb5bba8719eec5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 632a25957477e..3018e294673a5 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5444,8 +5444,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + thermal_data->sw_ctf_threshold = thermal_data->max; + +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch b/queue-6.12/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch new file mode 100644 index 0000000000..8234de3f8e --- /dev/null +++ b/queue-6.12/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch @@ -0,0 +1,111 @@ +From 1d76411a7a97265ebe1355f084eac969fbb0061c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 10:12:36 -0400 +Subject: drm/amdgpu: add ip offset support for cyan skillfish + +From: Alex Deucher + +[ Upstream commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c ] + +For chips that don't have IP discovery tables. + +Signed-off-by: Alex Deucher +Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/Makefile | 3 +- + .../drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/nv.h | 1 + + 3 files changed, 59 insertions(+), 1 deletion(-) + create mode 100644 drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c + +diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile b/drivers/gpu/drm/amd/amdgpu/Makefile +index c7b18c52825d6..784651269ec55 100644 +--- a/drivers/gpu/drm/amd/amdgpu/Makefile ++++ b/drivers/gpu/drm/amd/amdgpu/Makefile +@@ -83,7 +83,8 @@ amdgpu-y += \ + vega20_reg_init.o nbio_v7_4.o nbio_v2_3.o nv.o arct_reg_init.o mxgpu_nv.o \ + nbio_v7_2.o hdp_v4_0.o hdp_v5_0.o aldebaran_reg_init.o aldebaran.o soc21.o soc24.o \ + sienna_cichlid.o smu_v13_0_10.o nbio_v4_3.o hdp_v6_0.o nbio_v7_7.o hdp_v5_2.o lsdma_v6_0.o \ +- nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o ++ nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o \ ++ cyan_skillfish_reg_init.o + + # add DF block + amdgpu-y += \ +diff --git a/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c +new file mode 100644 +index 0000000000000..96616a865aac7 +--- /dev/null ++++ b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c +@@ -0,0 +1,56 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright 2018 Advanced Micro Devices, Inc. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR ++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ * ++ */ ++#include "amdgpu.h" ++#include "nv.h" ++ ++#include "soc15_common.h" ++#include "soc15_hw_ip.h" ++#include "cyan_skillfish_ip_offset.h" ++ ++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev) ++{ ++ /* HW has more IP blocks, only initialized the blocke needed by driver */ ++ uint32_t i; ++ ++ adev->gfx.xcc_mask = 1; ++ for (i = 0 ; i < MAX_INSTANCE ; ++i) { ++ adev->reg_offset[GC_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[HDP_HWIP][i] = (uint32_t *)(&(HDP_BASE.instance[i])); ++ adev->reg_offset[MMHUB_HWIP][i] = (uint32_t *)(&(MMHUB_BASE.instance[i])); ++ adev->reg_offset[ATHUB_HWIP][i] = (uint32_t *)(&(ATHUB_BASE.instance[i])); ++ adev->reg_offset[NBIO_HWIP][i] = (uint32_t *)(&(NBIO_BASE.instance[i])); ++ adev->reg_offset[MP0_HWIP][i] = (uint32_t *)(&(MP0_BASE.instance[i])); ++ adev->reg_offset[MP1_HWIP][i] = (uint32_t *)(&(MP1_BASE.instance[i])); ++ adev->reg_offset[VCN_HWIP][i] = (uint32_t *)(&(UVD0_BASE.instance[i])); ++ adev->reg_offset[DF_HWIP][i] = (uint32_t *)(&(DF_BASE.instance[i])); ++ adev->reg_offset[DCE_HWIP][i] = (uint32_t *)(&(DMU_BASE.instance[i])); ++ adev->reg_offset[OSSSYS_HWIP][i] = (uint32_t *)(&(OSSSYS_BASE.instance[i])); ++ adev->reg_offset[SDMA0_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[SDMA1_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[SMUIO_HWIP][i] = (uint32_t *)(&(SMUIO_BASE.instance[i])); ++ adev->reg_offset[THM_HWIP][i] = (uint32_t *)(&(THM_BASE.instance[i])); ++ adev->reg_offset[CLK_HWIP][i] = (uint32_t *)(&(CLK_BASE.instance[i])); ++ } ++ return 0; ++} +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.h b/drivers/gpu/drm/amd/amdgpu/nv.h +index 83e9782aef39d..8f4817404f10d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.h ++++ b/drivers/gpu/drm/amd/amdgpu/nv.h +@@ -31,5 +31,6 @@ extern const struct amdgpu_ip_block_version nv_common_ip_block; + void nv_grbm_select(struct amdgpu_device *adev, + u32 me, u32 pipe, u32 queue, u32 vmid); + void nv_set_virt_ops(struct amdgpu_device *adev); ++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev); + + #endif +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch b/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch new file mode 100644 index 0000000000..cf65633fa8 --- /dev/null +++ b/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch @@ -0,0 +1,62 @@ +From 8452b48bd71ff21eb676636673a453af721b0bbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 10:18:46 -0400 +Subject: drm/amdgpu: add support for cyan skillfish without IP discovery + +From: Alex Deucher + +[ Upstream commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 ] + +For platforms without an IP discovery table. + +Signed-off-by: Alex Deucher +Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 30 +++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index 6042956cd5c3c..0f427314b2b48 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2644,6 +2644,36 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 6, 0); + adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0); + break; ++ case CHIP_CYAN_SKILLFISH: ++ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2) { ++ r = amdgpu_discovery_reg_base_init(adev); ++ if (r) ++ return -EINVAL; ++ ++ amdgpu_discovery_harvest_ip(adev); ++ amdgpu_discovery_get_gfx_info(adev); ++ amdgpu_discovery_get_mall_info(adev); ++ amdgpu_discovery_get_vcn_info(adev); ++ } else { ++ cyan_skillfish_reg_base_init(adev); ++ adev->sdma.num_instances = 2; ++ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3); ++ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3); ++ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[HDP_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[SDMA0_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[SDMA1_HWIP][1] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[DF_HWIP][0] = IP_VERSION(3, 5, 0); ++ adev->ip_versions[NBIO_HWIP][0] = IP_VERSION(2, 1, 1); ++ adev->ip_versions[UMC_HWIP][0] = IP_VERSION(8, 1, 1); ++ adev->ip_versions[MP0_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[MP1_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[THM_HWIP][0] = IP_VERSION(11, 0, 1); ++ adev->ip_versions[SMUIO_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[GC_HWIP][0] = IP_VERSION(10, 1, 3); ++ adev->ip_versions[UVD_HWIP][0] = IP_VERSION(2, 0, 3); ++ } ++ break; + default: + r = amdgpu_discovery_reg_base_init(adev); + if (r) { +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch b/queue-6.12/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch new file mode 100644 index 0000000000..d575f1559f --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch @@ -0,0 +1,116 @@ +From a584fbb11c965a65863fb4d5dfded8ddf70af03a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 17:31:32 -0400 +Subject: drm/amdgpu: fix handling of harvesting for ip_discovery firmware + +From: Alex Deucher + +[ Upstream commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 ] + +Chips which use the IP discovery firmware loaded by the driver +reported incorrect harvesting information in the ip discovery +table in sysfs because the driver only uses the ip discovery +firmware for populating sysfs and not for direct parsing for the +driver itself as such, the fields that are used to print the +harvesting info in sysfs report incorrect data for some IPs. Populate +the relevant fields for this case as well. + +Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery") +Acked-by: Tom St Denis +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index 0f427314b2b48..e00b5e4542347 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -1016,7 +1016,9 @@ static uint8_t amdgpu_discovery_get_harvest_info(struct amdgpu_device *adev, + /* Until a uniform way is figured, get mask based on hwid */ + switch (hw_id) { + case VCN_HWID: +- harvest = ((1 << inst) & adev->vcn.inst_mask) == 0; ++ /* VCN vs UVD+VCE */ ++ if (!amdgpu_ip_version(adev, VCE_HWIP, 0)) ++ harvest = ((1 << inst) & adev->vcn.inst_mask) == 0; + break; + case DMU_HWID: + if (adev->harvest_ip_mask & AMD_HARVEST_IP_DMU_MASK) +@@ -2462,7 +2464,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 0, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 0, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 0); +@@ -2489,7 +2493,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 3, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 3, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 1); +@@ -2516,8 +2522,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 1; ++ adev->sdma.sdma_mask = 1; + adev->vcn.num_vcn_inst = 1; + adev->gmc.num_umc = 2; ++ adev->gfx.xcc_mask = 1; + if (adev->apu_flags & AMD_APU_IS_RAVEN2) { + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 2, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 2, 0); +@@ -2560,7 +2568,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega20_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 8; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 0); +@@ -2588,8 +2598,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + arct_reg_base_init(adev); + adev->sdma.num_instances = 8; ++ adev->sdma.sdma_mask = 0xff; + adev->vcn.num_vcn_inst = 2; + adev->gmc.num_umc = 8; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 1); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 1); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 1); +@@ -2621,8 +2633,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + aldebaran_reg_base_init(adev); + adev->sdma.num_instances = 5; ++ adev->sdma.sdma_mask = 0x1f; + adev->vcn.num_vcn_inst = 2; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 2); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 2); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 4, 0); +@@ -2657,6 +2671,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + } else { + cyan_skillfish_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1); +-- +2.51.0 + diff --git a/queue-6.12/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch b/queue-6.12/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch new file mode 100644 index 0000000000..28e3b9caed --- /dev/null +++ b/queue-6.12/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch @@ -0,0 +1,45 @@ +From 9c4c8117d903410d6a7d97d4c55802dda65e8988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 12:59:53 +0200 +Subject: drm/bridge: lt9211: Drop check for last nibble of version register + +From: Marek Vasut + +[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ] + +There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . +The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the +driver checks for right now. Since there is a possibility there will be +yet another revision of the LT9211 in the future, drop the last version +nibble check to allow all future revisions of the chip to work with this +driver. + +This fix makes LT9211 rev. U5 work with this driver. + +Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c +index c8881796fba4c..4014375f06ea1 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9211.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c +@@ -120,8 +120,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) + } + + /* Test for known Chip ID. */ +- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE || +- chipid[2] != REG_CHIPID2_VALUE) { ++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) { + dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n", + chipid[0], chipid[1], chipid[2]); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch b/queue-6.12/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch new file mode 100644 index 0000000000..dcf00565f4 --- /dev/null +++ b/queue-6.12/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch @@ -0,0 +1,54 @@ +From 56a46444629be7e09a8bc284891e330811008dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 12:33:03 +0200 +Subject: drm/draw: fix color truncation in drm_draw_fill24 + +From: Francesco Valla + +[ Upstream commit 095232711f23179053ca26bcf046ca121a91a465 ] + +The color parameter passed to drm_draw_fill24() was truncated to 16 +bits, leading to an incorrect color drawn to the target iosys_map. +Fix this behavior, widening the parameter to 32 bits. + +Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw") + +Signed-off-by: Francesco Valla +Reviewed-by: Jocelyn Falempe +Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it +Signed-off-by: Jocelyn Falempe +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_draw.c | 2 +- + drivers/gpu/drm/drm_draw_internal.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_draw.c b/drivers/gpu/drm/drm_draw.c +index d41f8ae1c1483..b61ebc5bdd5ce 100644 +--- a/drivers/gpu/drm/drm_draw.c ++++ b/drivers/gpu/drm/drm_draw.c +@@ -125,7 +125,7 @@ EXPORT_SYMBOL(drm_draw_fill16); + + void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +- u16 color) ++ u32 color) + { + unsigned int y, x; + +diff --git a/drivers/gpu/drm/drm_draw_internal.h b/drivers/gpu/drm/drm_draw_internal.h +index f121ee7339dc1..20cb404e23ea6 100644 +--- a/drivers/gpu/drm/drm_draw_internal.h ++++ b/drivers/gpu/drm/drm_draw_internal.h +@@ -47,7 +47,7 @@ void drm_draw_fill16(struct iosys_map *dmap, unsigned int dpitch, + + void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +- u16 color); ++ u32 color); + + void drm_draw_fill32(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +-- +2.51.0 + diff --git a/queue-6.12/drm-i915-guc-skip-communication-warning-on-reset-in-.patch b/queue-6.12/drm-i915-guc-skip-communication-warning-on-reset-in-.patch new file mode 100644 index 0000000000..325e93a6e9 --- /dev/null +++ b/queue-6.12/drm-i915-guc-skip-communication-warning-on-reset-in-.patch @@ -0,0 +1,52 @@ +From 37664506784e92921a6a6034555015fb7437e158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:29:04 -0400 +Subject: drm/i915/guc: Skip communication warning on reset in progress + +From: Zhanjun Dong + +[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ] + +GuC IRQ and tasklet handler receive just single G2H message, and let other +messages to be received from next tasklet. During this chained tasklet +process, if reset process started, communication will be disabled. +Skip warning for this condition. + +Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018 +Signed-off-by: Zhanjun Dong +Reviewed-by: Vinay Belgaumkar +Signed-off-by: Daniele Ceraolo Spurio +Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com +(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +index 0d5197c0824a9..5cf3a516ccfb3 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +@@ -1324,9 +1324,16 @@ static int ct_receive(struct intel_guc_ct *ct) + + static void ct_try_receive_message(struct intel_guc_ct *ct) + { ++ struct intel_guc *guc = ct_to_guc(ct); + int ret; + +- if (GEM_WARN_ON(!ct->enabled)) ++ if (!ct->enabled) { ++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress); ++ return; ++ } ++ ++ /* When interrupt disabled, message handling is not expected */ ++ if (!guc->interrupts.enabled) + return; + + ret = ct_receive(ct); +-- +2.51.0 + diff --git a/queue-6.12/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch b/queue-6.12/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch new file mode 100644 index 0000000000..5fa0358d9d --- /dev/null +++ b/queue-6.12/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch @@ -0,0 +1,49 @@ +From 10ae5615b0e01eb8e075f38c841d77f38a1d861e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 12:51:11 +0200 +Subject: drm/panthor: Ensure MCU is disabled on suspend + +From: Ketil Johnsen + +[ Upstream commit e07e10ae83bdf429f59c8c149173a8c4f29c481e ] + +Currently the Panthor driver needs the GPU to be powered down +between suspend and resume. If this is not done, then the +MCU_CONTROL register will be preserved as AUTO, which again will +cause a premature FW boot on resume. The FW will go directly into +fatal state in this case. + +This case needs to be handled as there is no guarantee that the +GPU will be powered down after the suspend callback on all platforms. + +The fix is to call panthor_fw_stop() in "pre-reset" path to ensure +the MCU_CONTROL register is cleared (set DISABLE). This matches +well with the already existing call to panthor_fw_start() from the +"post-reset" path. + +Signed-off-by: Ketil Johnsen +Acked-by: Boris Brezillon +Reviewed-by: Steven Price +Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") +Signed-off-by: Steven Price +Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_fw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c +index 4e2d3a02ea068..cdd6e1c08cebd 100644 +--- a/drivers/gpu/drm/panthor/panthor_fw.c ++++ b/drivers/gpu/drm/panthor/panthor_fw.c +@@ -1057,6 +1057,7 @@ void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang) + } + + panthor_job_irq_suspend(&ptdev->fw->irq); ++ panthor_fw_stop(ptdev); + } + + /** +-- +2.51.0 + diff --git a/queue-6.12/drm-rockchip-vop2-use-correct-destination-rectangle-.patch b/queue-6.12/drm-rockchip-vop2-use-correct-destination-rectangle-.patch new file mode 100644 index 0000000000..c801e18d08 --- /dev/null +++ b/queue-6.12/drm-rockchip-vop2-use-correct-destination-rectangle-.patch @@ -0,0 +1,40 @@ +From ed3563cdb0eebd62d5236ffc1e676b9e5c7ca3e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 07:20:01 -0700 +Subject: drm/rockchip: vop2: use correct destination rectangle height check + +From: Alok Tiwari + +[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ] + +The vop2_plane_atomic_check() function incorrectly checks +drm_rect_width(dest) twice instead of verifying both width and height. +Fix the second condition to use drm_rect_height(dest) so that invalid +destination rectangles with height < 4 are correctly rejected. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Alok Tiwari +Reviewed-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 5d7df4c3b08c4..a551458ad4340 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -1118,7 +1118,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane, + return format; + + if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 || +- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) { ++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) { + drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n", + drm_rect_width(src) >> 16, drm_rect_height(src) >> 16, + drm_rect_width(dest), drm_rect_height(dest)); +-- +2.51.0 + diff --git a/queue-6.12/hid-hid-input-only-ignore-0-battery-events-for-digit.patch b/queue-6.12/hid-hid-input-only-ignore-0-battery-events-for-digit.patch new file mode 100644 index 0000000000..1953e150bf --- /dev/null +++ b/queue-6.12/hid-hid-input-only-ignore-0-battery-events-for-digit.patch @@ -0,0 +1,53 @@ +From 20dd4eb3dbfa72a76ff11ab0c6c832b1e200ccc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 21:28:44 -0700 +Subject: HID: hid-input: only ignore 0 battery events for digitizers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ] + +Commit 581c4484769e ("HID: input: map digitizer battery usage") added +handling of battery events for digitizers (typically for batteries +presented in stylii). Digitizers typically report correct battery levels +only when stylus is actively touching the surface, and in other cases +they may report battery level of 0. To avoid confusing consumers of the +battery information the code was added to filer out reports with 0 +battery levels. + +However there exist other kinds of devices that may legitimately report +0 battery levels. Fix this by filtering out 0-level reports only for +digitizer usages, and continue reporting them for other kinds of devices +(Smart Batteries, etc). + +Reported-by: 卢国宏 +Fixes: 581c4484769e ("HID: input: map digitizer battery usage") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f5c217ac4bfaa..f073d5621050a 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, + return; + } + +- if (value == 0 || value < dev->battery_min || value > dev->battery_max) ++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0) ++ return; ++ ++ if (value < dev->battery_min || value > dev->battery_max) + return; + + capacity = hidinput_scale_battery_capacity(dev, value); +-- +2.51.0 + diff --git a/queue-6.12/hid-multitouch-fix-name-of-stylus-input-devices.patch b/queue-6.12/hid-multitouch-fix-name-of-stylus-input-devices.patch new file mode 100644 index 0000000000..498c6a39a8 --- /dev/null +++ b/queue-6.12/hid-multitouch-fix-name-of-stylus-input-devices.patch @@ -0,0 +1,51 @@ +From eec78243e3fbbb1c67bf7b54c667d662e8049091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 09:40:33 -0300 +Subject: HID: multitouch: fix name of Stylus input devices + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ] + +HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by +commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). +However, on multitouch devices, these suffixes may be overridden. Before +that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after +that, multitouch would override them to have an "UNKNOWN" suffix. Just add +HID_DG_PEN to the list of non-overriden suffixes in multitouch. + +Before this fix: + +[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 +ELAN9008:00 04F3:2E14 UNKNOWN + +After this fix: + +[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 + +ELAN9008:00 04F3:2E14 Stylus + +Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Mika Westerberg +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 0667a24576fc4..0e4cb0e668eb5 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1663,6 +1663,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + case HID_CP_CONSUMER_CONTROL: + case HID_GD_WIRELESS_RADIO_CTLS: + case HID_GD_SYSTEM_MULTIAXIS: ++ case HID_DG_PEN: + /* already handled by hid core */ + break; + case HID_DG_TOUCHSCREEN: +-- +2.51.0 + diff --git a/queue-6.12/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch b/queue-6.12/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch new file mode 100644 index 0000000000..fc0fbb9959 --- /dev/null +++ b/queue-6.12/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch @@ -0,0 +1,163 @@ +From 8020bdb6b1da711ffb970d89123500d7f66d6672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 09:25:46 +0200 +Subject: ksmbd: fix recursive locking in RPC handle list access + +From: Marios Makassikis + +[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ] + +Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list +access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. + +This causes hung connections / tasks when a client attempts to open +a named pipe. Using Samba's rpcclient tool: + + $ rpcclient //192.168.1.254 -U user%password + $ rpcclient $> srvinfo + + +Kernel side: + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 + Workqueue: ksmbd-io handle_ksmbd_work + Call trace: + __schedule from schedule+0x3c/0x58 + schedule from schedule_preempt_disabled+0xc/0x10 + schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 + rwsem_down_read_slowpath from down_read+0x28/0x30 + down_read from ksmbd_session_rpc_method+0x18/0x3c + ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 + ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 + ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 + create_smb2_pipe from smb2_open+0x10c/0x27ac + smb2_open from handle_ksmbd_work+0x238/0x3dc + handle_ksmbd_work from process_scheduled_works+0x160/0x25c + process_scheduled_works from worker_thread+0x16c/0x1e8 + worker_thread from kthread+0xa8/0xb8 + kthread from ret_from_fork+0x14/0x38 + Exception stack(0x8529ffb0 to 0x8529fff8) + +The task deadlocks because the lock is already held: + ksmbd_session_rpc_open + down_write(&sess->rpc_lock) + ksmbd_rpc_open + ksmbd_session_rpc_method + down_read(&sess->rpc_lock) <-- deadlock + +Adjust ksmbd_session_rpc_method() callers to take the lock when necessary. + +Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access") +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/mgmt/user_session.c | 7 ++----- + fs/smb/server/smb2pdu.c | 9 ++++++++- + fs/smb/server/transport_ipc.c | 12 ++++++++++++ + 3 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c +index b36d0676dbe58..00805aed0b07d 100644 +--- a/fs/smb/server/mgmt/user_session.c ++++ b/fs/smb/server/mgmt/user_session.c +@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id) + int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id) + { + struct ksmbd_session_rpc *entry; +- int method; + +- down_read(&sess->rpc_lock); ++ lockdep_assert_held(&sess->rpc_lock); + entry = xa_load(&sess->rpc_handle_list, id); +- method = entry ? entry->method : 0; +- up_read(&sess->rpc_lock); + +- return method; ++ return entry ? entry->method : 0; + } + + void ksmbd_session_destroy(struct ksmbd_session *sess) +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index d2182477566a6..796235cb95677 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -4623,8 +4623,15 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess, + * pipe without opening it, checking error condition here + */ + id = req->VolatileFileId; +- if (!ksmbd_session_rpc_method(sess, id)) ++ ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); ++ if (!ksmbd_session_rpc_method(sess, id)) { ++ up_read(&sess->rpc_lock); + return -ENOENT; ++ } ++ up_read(&sess->rpc_lock); + + ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n", + req->FileInfoClass, req->VolatileFileId); +diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c +index 4454bbe3c7107..816f136ce5c4e 100644 +--- a/fs/smb/server/transport_ipc.c ++++ b/fs/smb/server/transport_ipc.c +@@ -825,6 +825,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -833,6 +836,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle + req->flags |= KSMBD_RPC_WRITE_METHOD; + req->payload_sz = payload_sz; + memcpy(req->payload, payload, payload_sz); ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +@@ -849,6 +853,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle) + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -856,6 +863,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle) + req->flags |= rpc_context_flags(sess); + req->flags |= KSMBD_RPC_READ_METHOD; + req->payload_sz = 0; ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +@@ -876,6 +884,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -884,6 +895,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle + req->flags |= KSMBD_RPC_IOCTL_METHOD; + req->payload_sz = payload_sz; + memcpy(req->payload, payload, payload_sz); ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +-- +2.51.0 + diff --git a/queue-6.12/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-6.12/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..7be70a6fdc --- /dev/null +++ b/queue-6.12/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From dd2ecdf112a2c340754c6e56843acfa737daae46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 92856cf387c76..7c9658a4ec4b5 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-6.12/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-6.12/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..dce3d2d4ac --- /dev/null +++ b/queue-6.12/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 07869f710a3550eec323b04d7aeebfc6e23112ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index ae83a969ae64b..01fcf952b05de 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -605,6 +605,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 09b73acf037ae..7c77d06372d19 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 5350c9bb2319b..b72ca10349068 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1257,8 +1257,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-6.12/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch b/queue-6.12/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch new file mode 100644 index 0000000000..8fdee570a3 --- /dev/null +++ b/queue-6.12/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch @@ -0,0 +1,96 @@ +From 3cf994139ffdf6df0877147f542d05d2b6791e47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:07:42 +0100 +Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address + +From: Oleksij Rempel + +[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ] + +Convert `lan78xx_init_mac_address` to return error codes and handle +failures in register read and write operations. Update `lan78xx_reset` +to check for errors during MAC address initialization and propagate them +appropriately. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 2f8637224b69e..6babe909036cf 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1920,13 +1920,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { + .get_regs = lan78xx_get_regs, + }; + +-static void lan78xx_init_mac_address(struct lan78xx_net *dev) ++static int lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; + u8 addr[6]; ++ int ret; ++ ++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ if (ret < 0) ++ return ret; + +- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ if (ret < 0) ++ return ret; + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1959,14 +1965,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ if (ret < 0) ++ return ret; + } + +- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ if (ret < 0) ++ return ret; + + eth_hw_addr_set(dev->net, addr); ++ ++ return 0; + } + + /* MDIO read and write wrappers for phylib */ +@@ -2905,7 +2923,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- lan78xx_init_mac_address(dev); ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; + + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); +-- +2.51.0 + diff --git a/queue-6.12/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-6.12/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..9fa4513459 --- /dev/null +++ b/queue-6.12/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From 322d1a879b1ed5bcb5df97ded52906fd8eb7fd7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 6babe909036cf..2da67814556f9 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2923,10 +2923,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -2935,6 +2931,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.12/netdevsim-set-the-carrier-when-the-device-goes-up.patch b/queue-6.12/netdevsim-set-the-carrier-when-the-device-goes-up.patch new file mode 100644 index 0000000000..9f1a639c6a --- /dev/null +++ b/queue-6.12/netdevsim-set-the-carrier-when-the-device-goes-up.patch @@ -0,0 +1,56 @@ +From 32779bc11f31137d25c87a0de961c6a73a7b69ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 02:17:25 -0700 +Subject: netdevsim: set the carrier when the device goes up + +From: Breno Leitao + +[ Upstream commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 ] + +Bringing a linked netdevsim device down and then up causes communication +failure because both interfaces lack carrier. Basically a ifdown/ifup on +the interface make the link broken. + +Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported +for NAPI, calling netif_carrier_off() in nsim_stop(). This patch +re-enables the carrier symmetrically on nsim_open(), in case the device +is linked and the peer is up. + +Signed-off-by: Breno Leitao +Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support") +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdev.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c +index ee2a7b2f6268d..e2d92295ad33b 100644 +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -433,6 +433,7 @@ static void nsim_enable_napi(struct netdevsim *ns) + static int nsim_open(struct net_device *dev) + { + struct netdevsim *ns = netdev_priv(dev); ++ struct netdevsim *peer; + int err; + + err = nsim_init_napi(ns); +@@ -441,6 +442,12 @@ static int nsim_open(struct net_device *dev) + + nsim_enable_napi(ns); + ++ peer = rtnl_dereference(ns->peer); ++ if (peer && netif_running(peer->netdev)) { ++ netif_carrier_on(dev); ++ netif_carrier_on(peer->netdev); ++ } ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/nvme-multipath-skip-nr_active-increments-in-retry-di.patch b/queue-6.12/nvme-multipath-skip-nr_active-increments-in-retry-di.patch new file mode 100644 index 0000000000..069578c250 --- /dev/null +++ b/queue-6.12/nvme-multipath-skip-nr_active-increments-in-retry-di.patch @@ -0,0 +1,60 @@ +From e34627c43800a48ca53f986bfaafe68ae90f349e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 12:08:22 -0700 +Subject: nvme-multipath: Skip nr_active increments in RETRY disposition + +From: Amit Chaudhary + +[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ] + +For queue-depth I/O policy, this patch fixes unbalanced I/Os across +nvme multipaths. + +Issue Description: + +The RETRY disposition incorrectly increments ns->ctrl->nr_active +counter and reinitializes iostat start-time. In such cases nr_active +counter never goes back to zero until that path disconnects and +reconnects. + +Such a path is not chosen for new I/Os if multiple RETRY cases on a given +a path cause its queue-depth counter to be artificially higher compared +to other paths. This leads to unbalanced I/Os across paths. + +The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already +set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set. + +base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a +Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device") +Signed-off-by: Amit Chaudhary +Reviewed-by: Randy Jennings +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 561dd08022c06..24cff8b044923 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -131,12 +131,14 @@ void nvme_mpath_start_request(struct request *rq) + struct nvme_ns *ns = rq->q->queuedata; + struct gendisk *disk = ns->head->disk; + +- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) { ++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) && ++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) { + atomic_inc(&ns->ctrl->nr_active); + nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE; + } + +- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq)) ++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) || ++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS)) + return; + + nvme_req(rq)->flags |= NVME_MPATH_IO_STATS; +-- +2.51.0 + diff --git a/queue-6.12/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch b/queue-6.12/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch new file mode 100644 index 0000000000..03c817dd18 --- /dev/null +++ b/queue-6.12/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch @@ -0,0 +1,48 @@ +From ca6e4d6da5510218e9de9b200dfe977eeb1804d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 17:19:42 +1000 +Subject: nvme/tcp: handle tls partially sent records in write_space() + +From: Wilfred Mallawa + +[ Upstream commit 5a869d017793399fd1d2609ff27e900534173eb3 ] + +With TLS enabled, records that are encrypted and appended to TLS TX +list can fail to see a retry if the underlying TCP socket is busy, for +example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known +to the NVMe TCP driver, as the TLS layer successfully generated a record. + +Typically, the TLS write_space() callback would ensure such records are +retried, but in the NVMe TCP Host driver, write_space() invokes +nvme_tcp_write_space(). This causes a partially sent record in the TLS TX +list to timeout after not being retried. + +This patch fixes the above by calling queue->write_space(), which calls +into the TLS layer to retry any pending records. + +Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") +Signed-off-by: Wilfred Mallawa +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 83a6b18b01ada..77df3432dfb78 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1075,6 +1075,9 @@ static void nvme_tcp_write_space(struct sock *sk) + queue = sk->sk_user_data; + if (likely(queue && sk_stream_is_writeable(sk))) { + clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); ++ /* Ensure pending TLS partial records are retried */ ++ if (nvme_tcp_queue_tls(queue)) ++ queue->write_space(sk); + queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work); + } + read_unlock_bh(&sk->sk_callback_lock); +-- +2.51.0 + diff --git a/queue-6.12/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-6.12/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..dfa60fc64a --- /dev/null +++ b/queue-6.12/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From cec5dfdbc8bec669d1ea0a64795bffe77b81a770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 7b82779e4cd5d..80b5262d0d572 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -5060,8 +5060,9 @@ static int rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_runtime_resume(device); +-- +2.51.0 + diff --git a/queue-6.12/riscv-kprobes-fix-probe-address-validation.patch b/queue-6.12/riscv-kprobes-fix-probe-address-validation.patch new file mode 100644 index 0000000000..09f2b65619 --- /dev/null +++ b/queue-6.12/riscv-kprobes-fix-probe-address-validation.patch @@ -0,0 +1,64 @@ +From 0e15f27e79d41d84bbfbb24c6ec6c3df4d6fa7a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:25:13 +0200 +Subject: riscv: kprobes: Fix probe address validation + +From: Fabian Vogt + +[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ] + +When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", +arch_check_kprobe would start iterating all instructions starting from +_text until the probed address. Not only is this very inefficient, but +literal values in there (e.g. left by function patching) are +misinterpreted in a way that causes a desync. + +Fix this by doing it like x86: start the iteration at the closest +preceding symbol instead of the given starting point. + +Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") +Signed-off-by: Fabian Vogt +Signed-off-by: Marvin Friedrich +Acked-by: Guo Ren +Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index d2dacea1aedd9..0daba93c1a81e 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + +-static bool __kprobes arch_check_kprobe(struct kprobe *p) ++static bool __kprobes arch_check_kprobe(unsigned long addr) + { +- unsigned long tmp = (unsigned long)p->addr - p->offset; +- unsigned long addr = (unsigned long)p->addr; ++ unsigned long tmp, offset; ++ ++ /* start iterating at the closest preceding symbol */ ++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) ++ return false; ++ ++ tmp = addr - offset; + + while (tmp <= addr) { + if (tmp == addr) +@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if ((unsigned long)insn & 0x1) + return -EILSEQ; + +- if (!arch_check_kprobe(p)) ++ if (!arch_check_kprobe((unsigned long)p->addr)) + return -EILSEQ; + + /* copy instruction */ +-- +2.51.0 + diff --git a/queue-6.12/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-6.12/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..6dcea5cc30 --- /dev/null +++ b/queue-6.12/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From 432a19c4e757b6b8428f76f32ea04da42ea8e4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index b3d9826e25b03..8bdcb5df0d461 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9059,21 +9059,21 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-6.12/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch b/queue-6.12/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch new file mode 100644 index 0000000000..634e8f8369 --- /dev/null +++ b/queue-6.12/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch @@ -0,0 +1,42 @@ +From 1f71000255b310347817a9861fa098151ea6617e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Oct 2025 11:53:30 +0800 +Subject: selftests: arg_parsing: Ensure data is flushed to disk before + reading. + +From: Xing Guo + +[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ] + +test_parse_test_list_file writes some data to +/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read +the data back. However, after writing data to that file, we forget to +call fsync() and it's causing testing failure in my laptop. This patch +helps fix it by adding the missing fsync() call. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Xing Guo +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index fbf0d9c2f58b3..e27d66b75fb1f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void) + if (!ASSERT_OK(ferror(fp), "prepare tmp")) + goto out_fclose; + ++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp")) ++ goto out_fclose; ++ + init_test_filter_set(&set); + + if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) +-- +2.51.0 + diff --git a/queue-6.12/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch b/queue-6.12/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch new file mode 100644 index 0000000000..820aa17557 --- /dev/null +++ b/queue-6.12/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch @@ -0,0 +1,63 @@ +From 451dc090085d7198ca013ed78d9391fd41024bb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 13:20:37 -0700 +Subject: selftests/bpf: make arg_parsing.c more robust to crashes + +From: Andrii Nakryiko + +[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ] + +We started getting a crash in BPF CI, which seems to originate from +test_parse_test_list_file() test and is happening at this line: + + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + +One way we can crash there is if set.cnt zero, which is checked for with +ASSERT_EQ() above, but we proceed after this regardless of the outcome. +Instead of crashing, we should bail out with test failure early. + +Similarly, if parse_test_list_file() fails, we shouldn't be even looking +at set, so bail even earlier if ASSERT_OK() fails. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Andrii Nakryiko +Tested-by: Ihor Solodrai +Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index bb143de68875c..fbf0d9c2f58b3 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void) + + init_test_filter_set(&set); + +- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"); ++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) ++ goto out_fclose; ++ ++ if (!ASSERT_EQ(set.cnt, 4, "test count")) ++ goto out_free_set; + +- ASSERT_EQ(set.cnt, 4, "test count"); + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count"); + ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name"); +@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void) + ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name"); + ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name"); + ++out_free_set: + free_test_filter_set(&set); +- + out_fclose: + fclose(fp); + out_remove: +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 475942286f..925cdd006b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -41,3 +41,53 @@ usb-gadget-f_rndis-refactor-bind-path-to-use-__free.patch cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch revert-io_uring-rw-drop-eopnotsupp-check-in-__io_complete_rw_common.patch hid-multitouch-fix-sticky-fingers.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch +can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch +can-m_can-m_can_chip_config-bring-up-interface-in-co.patch +can-m_can-add-deinit-callback.patch +can-m_can-call-deinit-init-callback-when-going-into-.patch +can-m_can-fix-can-state-in-system-pm.patch +net-dlink-handle-dma_map_single-failure-properly.patch +doc-fix-seg6_flowlabel-path.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +tls-trim-encrypted-message-to-match-the-plaintext-on.patch +tls-wait-for-async-encrypt-in-case-of-error-during-l.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch +tls-don-t-rely-on-tx_work-during-send.patch +netdevsim-set-the-carrier-when-the-device-goes-up.patch +net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +drm-panthor-ensure-mcu-is-disabled-on-suspend.patch +nvme-multipath-skip-nr_active-increments-in-retry-di.patch +riscv-kprobes-fix-probe-address-validation.patch +drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch +asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch +asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch +asoc-nau8821-generalize-helper-to-clear-irq-status.patch +asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch +drm-i915-guc-skip-communication-warning-on-reset-in-.patch +drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch +drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch +drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +drm-draw-fix-color-truncation-in-drm_draw_fill24.patch +drm-rockchip-vop2-use-correct-destination-rectangle-.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch +accel-qaic-fix-bootlog-initialization-ordering.patch +accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch +accel-qaic-synchronize-access-to-dbc-request-queue-h.patch +selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch +alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch +hid-hid-input-only-ignore-0-battery-events-for-digit.patch +hid-multitouch-fix-name-of-stylus-input-devices.patch +asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch +selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch +nvme-tcp-handle-tls-partially-sent-records-in-write_.patch diff --git a/queue-6.12/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-6.12/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..d94a0b750f --- /dev/null +++ b/queue-6.12/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From a8615a02b55567cf1db5835cba66835215e19773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 6d5387811c32a..5e37dc45639db 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2217,7 +2217,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2279,9 +2280,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-6.12/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-6.12/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..74b5acef2d --- /dev/null +++ b/queue-6.12/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From 16da245e4d8918e661d627b4846ff9ae37472e3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 717e110d23c91..dc170feee8ad7 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5803,7 +5803,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5944,9 +5944,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-6.12/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-6.12/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..e1cd3788b9 --- /dev/null +++ b/queue-6.12/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From 3218034da74ceb86716c4b13b33de6f88b14cd00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 0acf313deb01f..e52e4c91c9091 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -255,12 +255,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/tls-don-t-rely-on-tx_work-during-send.patch b/queue-6.12/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..0a0d1b6863 --- /dev/null +++ b/queue-6.12/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From f7168d5e8f8d22ce1660d38b007015200aba2ba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index bebf0dd3b95fa..1ff0d01bdadf0 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + } else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-6.12/tls-trim-encrypted-message-to-match-the-plaintext-on.patch b/queue-6.12/tls-trim-encrypted-message-to-match-the-plaintext-on.patch new file mode 100644 index 0000000000..75a748d0e6 --- /dev/null +++ b/queue-6.12/tls-trim-encrypted-message-to-match-the-plaintext-on.patch @@ -0,0 +1,49 @@ +From 3fe70866e40d6169c0f4278f872d4b2305b056f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:56 +0200 +Subject: tls: trim encrypted message to match the plaintext on short splice + +From: Sabrina Dubroca + +[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ] + +During tls_sw_sendmsg_locked, we pre-allocate the encrypted message +for the size we're expecting to send during the current iteration, but +we may end up sending less, for example when splicing: if we're +getting the data from small fragments of memory, we may fill up all +the slots in the skmsg with less data than expected. + +In this case, we need to trim the encrypted message to only the length +we actually need, to avoid pushing uninitialized bytes down the +underlying TCP socket. + +Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index f46550b96061e..aac685daf66c4 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + tls_ctx->pending_open_record_frags = true; + +- if (sk_msg_full(msg_pl)) ++ if (sk_msg_full(msg_pl)) { + full_record = true; ++ sk_msg_trim(sk, msg_en, ++ msg_pl->sg.size + prot->overhead_size); ++ } + + if (full_record || eor) + goto copied; +-- +2.51.0 + diff --git a/queue-6.12/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch b/queue-6.12/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch new file mode 100644 index 0000000000..438566c433 --- /dev/null +++ b/queue-6.12/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch @@ -0,0 +1,67 @@ +From db0f8a603774c0eccd3aca9c46913099b35d602f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:57 +0200 +Subject: tls: wait for async encrypt in case of error during latter iterations + of sendmsg + +From: Sabrina Dubroca + +[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ] + +If we hit an error during the main loop of tls_sw_sendmsg_locked (eg +failed allocation), we jump to send_end and immediately +return. Previous iterations may have queued async encryption requests +that are still pending. We should wait for those before returning, as +we could otherwise be reading from memory that userspace believes +we're not using anymore, which would be a sort of use-after-free. + +This is similar to what tls_sw_recvmsg already does: failures during +the main loop jump to the "wait for async" code, not straight to the +unlock/return. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index aac685daf66c4..dc5a7e24d7b77 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + if (ret == -EINPROGRESS) + num_async++; + else if (ret != -EAGAIN) +- goto send_end; ++ goto end; + } + } + +@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto alloc_encrypted; + } + ++send_end: + if (!num_async) { +- goto send_end; ++ goto end; + } else if (num_zc || eor) { + int err; + +@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + tls_tx_records(sk, msg->msg_flags); + } + +-send_end: ++end: + ret = sk_stream_error(sk, msg->msg_flags, ret); + return copied > 0 ? copied : ret; + } +-- +2.51.0 + diff --git a/queue-6.12/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch b/queue-6.12/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch new file mode 100644 index 0000000000..e55d7e5c9e --- /dev/null +++ b/queue-6.12/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch @@ -0,0 +1,47 @@ +From 13cb8203b3290fc84074f251f8b8c5bb14c6bccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:59 +0200 +Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails + +From: Sabrina Dubroca + +[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ] + +Async decryption calls tls_strp_msg_hold to create a clone of the +input skb to hold references to the memory it uses. If we fail to +allocate that clone, proceeding with async decryption can lead to +various issues (UAF on the skb, writing into userspace memory after +the recv() call has returned). + +In this case, wait for all pending decryption requests. + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index dc5a7e24d7b77..bebf0dd3b95fa 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1637,8 +1637,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov, + + if (unlikely(darg->async)) { + err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold); +- if (err) +- __skb_queue_tail(&ctx->async_hold, darg->skb); ++ if (err) { ++ err = tls_decrypt_async_wait(ctx); ++ darg->async = false; ++ } + return err; + } + +-- +2.51.0 + diff --git a/queue-6.17/accel-qaic-fix-bootlog-initialization-ordering.patch b/queue-6.17/accel-qaic-fix-bootlog-initialization-ordering.patch new file mode 100644 index 0000000000..3797f677de --- /dev/null +++ b/queue-6.17/accel-qaic-fix-bootlog-initialization-ordering.patch @@ -0,0 +1,58 @@ +From 84ae5da84ae8bac647092dc7f5b84374032ad9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 13:57:50 +0200 +Subject: accel/qaic: Fix bootlog initialization ordering + +From: Jeffrey Hugo + +[ Upstream commit fd6e385528d8f85993b7bfc6430576136bb14c65 ] + +As soon as we queue MHI buffers to receive the bootlog from the device, +we could be receiving data. Therefore all the resources needed to +process that data need to be setup prior to queuing the buffers. + +We currently initialize some of the resources after queuing the buffers +which creates a race between the probe() and any data that comes back +from the device. If the uninitialized resources are accessed, we could +see page faults. + +Fix the init ordering to close the race. + +Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs") +Signed-off-by: Jeffrey Hugo +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_debugfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/accel/qaic/qaic_debugfs.c b/drivers/accel/qaic/qaic_debugfs.c +index a991b8198dc40..8dc4fe5bb560e 100644 +--- a/drivers/accel/qaic/qaic_debugfs.c ++++ b/drivers/accel/qaic/qaic_debugfs.c +@@ -218,6 +218,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d + if (ret) + goto destroy_workqueue; + ++ dev_set_drvdata(&mhi_dev->dev, qdev); ++ qdev->bootlog_ch = mhi_dev; ++ + for (i = 0; i < BOOTLOG_POOL_SIZE; i++) { + msg = devm_kzalloc(&qdev->pdev->dev, sizeof(*msg), GFP_KERNEL); + if (!msg) { +@@ -233,8 +236,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d + goto mhi_unprepare; + } + +- dev_set_drvdata(&mhi_dev->dev, qdev); +- qdev->bootlog_ch = mhi_dev; + return 0; + + mhi_unprepare: +-- +2.51.0 + diff --git a/queue-6.17/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch b/queue-6.17/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch new file mode 100644 index 0000000000..03518ae5ec --- /dev/null +++ b/queue-6.17/accel-qaic-synchronize-access-to-dbc-request-queue-h.patch @@ -0,0 +1,106 @@ +From f6b621feb11a95f4f0e8ba9659f4b0459767cb21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 08:18:37 +0200 +Subject: accel/qaic: Synchronize access to DBC request queue head & tail + pointer + +From: Pranjal Ramajor Asha Kanojiya + +[ Upstream commit 52e59f7740ba23bbb664914967df9a00208ca10c ] + +Two threads of the same process can potential read and write parallelly to +head and tail pointers of the same DBC request queue. This could lead to a +race condition and corrupt the DBC request queue. + +Fixes: ff13be830333 ("accel/qaic: Add datapath") +Signed-off-by: Pranjal Ramajor Asha Kanojiya +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +[jhugo: Add fixes tag] +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic.h | 2 ++ + drivers/accel/qaic/qaic_data.c | 12 ++++++++++-- + drivers/accel/qaic/qaic_drv.c | 3 +++ + 3 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/accel/qaic/qaic.h b/drivers/accel/qaic/qaic.h +index c31081e42cee0..820d133236dd1 100644 +--- a/drivers/accel/qaic/qaic.h ++++ b/drivers/accel/qaic/qaic.h +@@ -97,6 +97,8 @@ struct dma_bridge_chan { + * response queue's head and tail pointer of this DBC. + */ + void __iomem *dbc_base; ++ /* Synchronizes access to Request queue's head and tail pointer */ ++ struct mutex req_lock; + /* Head of list where each node is a memory handle queued in request queue */ + struct list_head xfer_list; + /* Synchronizes DBC readers during cleanup */ +diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c +index 797289e9d7806..c4f117edb266e 100644 +--- a/drivers/accel/qaic/qaic_data.c ++++ b/drivers/accel/qaic/qaic_data.c +@@ -1356,13 +1356,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + goto release_ch_rcu; + } + ++ ret = mutex_lock_interruptible(&dbc->req_lock); ++ if (ret) ++ goto release_ch_rcu; ++ + head = readl(dbc->dbc_base + REQHP_OFF); + tail = readl(dbc->dbc_base + REQTP_OFF); + + if (head == U32_MAX || tail == U32_MAX) { + /* PCI link error */ + ret = -ENODEV; +- goto release_ch_rcu; ++ goto unlock_req_lock; + } + + queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail); +@@ -1370,11 +1374,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + ret = send_bo_list_to_device(qdev, file_priv, exec, args->hdr.count, is_partial, dbc, + head, &tail); + if (ret) +- goto release_ch_rcu; ++ goto unlock_req_lock; + + /* Finalize commit to hardware */ + submit_ts = ktime_get_ns(); + writel(tail, dbc->dbc_base + REQTP_OFF); ++ mutex_unlock(&dbc->req_lock); + + update_profiling_data(file_priv, exec, args->hdr.count, is_partial, received_ts, + submit_ts, queue_level); +@@ -1382,6 +1387,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr + if (datapath_polling) + schedule_work(&dbc->poll_work); + ++unlock_req_lock: ++ if (ret) ++ mutex_unlock(&dbc->req_lock); + release_ch_rcu: + srcu_read_unlock(&dbc->ch_lock, rcu_id); + unlock_dev_srcu: +diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c +index e31bcb0ecfc94..e162f4b8a262a 100644 +--- a/drivers/accel/qaic/qaic_drv.c ++++ b/drivers/accel/qaic/qaic_drv.c +@@ -454,6 +454,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, + return NULL; + init_waitqueue_head(&qdev->dbc[i].dbc_release); + INIT_LIST_HEAD(&qdev->dbc[i].bo_lists); ++ ret = drmm_mutex_init(drm, &qdev->dbc[i].req_lock); ++ if (ret) ++ return NULL; + } + + return qdev; +-- +2.51.0 + diff --git a/queue-6.17/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch b/queue-6.17/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch new file mode 100644 index 0000000000..be3a0e664c --- /dev/null +++ b/queue-6.17/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch @@ -0,0 +1,49 @@ +From cf44a5e1749552dc47d100d4caa74a773b83215b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 14:23:20 +0200 +Subject: accel/qaic: Treat remaining == 0 as error in + find_and_map_user_pages() + +From: Youssef Samir + +[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ] + +Currently, if find_and_map_user_pages() takes a DMA xfer request from the +user with a length field set to 0, or in a rare case, the host receives +QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size +is equal to the requested transaction size, the function will return 0 +before allocating an sgt or setting the fields of the dma_xfer struct. +In that case, encode_addr_size_pairs() will try to access the sgt which +will lead to a general protection fault. + +Return an EINVAL in case the user provides a zero-sized ALP, or the device +requests continuation after all of the bytes have been transferred. + +Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") +Signed-off-by: Youssef Samir +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_control.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c +index d8bdab69f8009..b86a8e48e731b 100644 +--- a/drivers/accel/qaic/qaic_control.c ++++ b/drivers/accel/qaic/qaic_control.c +@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, + return -EINVAL; + remaining = in_trans->size - resources->xferred_dma_size; + if (remaining == 0) +- return 0; ++ return -EINVAL; + + if (check_add_overflow(xfer_start_addr, remaining, &end)) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-6.17/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..fb64409e9e --- /dev/null +++ b/queue-6.17/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 5b7075c724d3bf0b41aeaa8402e9594a7a1bd1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 775db3fc4959f..ec10270c2cce3 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. +-- +2.51.0 + diff --git a/queue-6.17/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch b/queue-6.17/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch new file mode 100644 index 0000000000..fa41a58255 --- /dev/null +++ b/queue-6.17/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch @@ -0,0 +1,50 @@ +From 33be0aa225e94ee72cf2dd80bef871d7c8ae0424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:16:45 +0800 +Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card + +From: Jiaming Zhang + +[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ] + +In try_to_register_card(), the return value of usb_ifnum_to_if() is +passed directly to usb_interface_claimed() without a NULL check, which +will lead to a NULL pointer dereference when creating an invalid +USB audio device. Fix this by adding a check to ensure the interface +pointer is valid before passing it to usb_interface_claimed(). + +Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") +Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ +Signed-off-by: Jiaming Zhang +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 10d9b72855970..557f53d10ecfb 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -850,10 +850,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) + */ + static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) + { ++ struct usb_interface *iface; ++ + if (check_delayed_register_option(chip) == ifnum || +- chip->last_iface == ifnum || +- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) ++ chip->last_iface == ifnum) ++ return snd_card_register(chip->card); ++ ++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); ++ if (iface && usb_interface_claimed(iface)) + return snd_card_register(chip->card); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-6.17/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..87dcd9d689 --- /dev/null +++ b/queue-6.17/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From f54dfeae6e4b0f19c65313398416cc3dc1440c7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 2e9b95a94f89f..2ad672c17eec6 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1065,7 +1065,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 1a37ec45e6502..7675bb98f0295 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1555,6 +1555,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-6.17/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch b/queue-6.17/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch new file mode 100644 index 0000000000..6ec5c433f9 --- /dev/null +++ b/queue-6.17/asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch @@ -0,0 +1,41 @@ +From 055feb87ff350335bdd2b2b73fd7ede02c372010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 15:55:30 +0800 +Subject: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails + +From: Li Qiang + +[ Upstream commit 5726b68473f7153a7f6294185e5998b7e2a230a2 ] + +devm_kasprintf() may return NULL on memory allocation failure, +but the debug message prints cpus->dai_name before checking it. +Move the dev_dbg() call after the NULL check to prevent potential +NULL pointer dereference. + +Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver") +Signed-off-by: Li Qiang +Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c +index 91d72d4bb9a26..d055582a3bf1a 100644 +--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c ++++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c +@@ -176,9 +176,9 @@ static int create_sdw_dailink(struct snd_soc_card *card, + cpus->dai_name = devm_kasprintf(dev, GFP_KERNEL, + "SDW%d Pin%d", + link_num, cpu_pin_id); +- dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name); + if (!cpus->dai_name) + return -ENOMEM; ++ dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name); + + codec_maps[j].cpu = 0; + codec_maps[j].codec = j; +-- +2.51.0 + diff --git a/queue-6.17/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch b/queue-6.17/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch new file mode 100644 index 0000000000..ddcc76c224 --- /dev/null +++ b/queue-6.17/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch @@ -0,0 +1,54 @@ +From fcd4fa721f2cc00993dd4d1a48c5f8e3bd5ef449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 19:03:13 +0200 +Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec + +From: Christophe Leroy + +[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ] + +The gain ranges specified in Renesas IDT821034 codec documentation +are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the +receive path (DAC). Allthough the registers allow programming values +outside those ranges, the signal S/N and distorsion are only +guaranteed in the specified ranges. + +Set ranges to the specified ones. + +Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec") +Signed-off-by: Christophe Leroy +Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/idt821034.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c +index a03d4e5e7d144..cab2f2eecdfba 100644 +--- a/sound/soc/codecs/idt821034.c ++++ b/sound/soc/codecs/idt821034.c +@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol, + return ret; + } + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306); +-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */ +-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300); ++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */ ++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */ + #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */ + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029); +-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/ +-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300); ++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */ ++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */ + #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */ + + static const struct snd_kcontrol_new idt821034_controls[] = { +-- +2.51.0 + diff --git a/queue-6.17/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch b/queue-6.17/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch new file mode 100644 index 0000000000..7d38daa274 --- /dev/null +++ b/queue-6.17/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch @@ -0,0 +1,103 @@ +From ad1b4d0a957556a3a99984f75e495b0937064623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:26 +0300 +Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit + +From: Cristian Ciocaltea + +[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ] + +Stress testing the audio jack hotplug handling on a few Steam Deck units +revealed that the debounce circuit is responsible for having a negative +impact on the detection reliability, e.g. in some cases the ejection +interrupt is not fired, while in other instances it goes into a kind of +invalid state and generates a flood of misleading interrupts. + +Add new entries to the DMI table introduced via commit 1bc40efdaf4a +("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") +and extend the quirk logic to allow bypassing the debounce circuit used +for jack detection on Valve Steam Deck LCD and OLED models. + +While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to +NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability +by differentiating from similarly named register bits. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 56e5a0d80782b..a8ff2ce70be9a 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -26,7 +26,8 @@ + #include + #include "nau8821.h" + +-#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1) + + static int nau8821_quirk; + static int quirk_override = -1; +@@ -1177,9 +1178,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2, + NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE); + +- /* Not bypass de-bounce circuit */ +- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, +- NAU8821_JACK_DET_DB_BYPASS, 0); ++ /* Do not bypass de-bounce circuit */ ++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)) ++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, ++ NAU8821_JACK_DET_DB_BYPASS, 0); + + /* Unmask & enable the ejection IRQs */ + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, +@@ -1864,7 +1866,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), + DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), + }, +- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), ++ }, ++ { ++ /* Valve Steam Deck LCD */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), ++ }, ++ { ++ /* Valve Steam Deck OLED */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), + }, + {} + }; +@@ -1906,9 +1924,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821_check_quirks(); + +- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH) + nau8821->jkdet_polarity = 0; + ++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS) ++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n"); ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.51.0 + diff --git a/queue-6.17/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch b/queue-6.17/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch new file mode 100644 index 0000000000..a4c82bb887 --- /dev/null +++ b/queue-6.17/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch @@ -0,0 +1,61 @@ +From b043bc6cf8e21630bf5ed0753135422842aca81f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:23 +0300 +Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection + +From: Cristian Ciocaltea + +[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ] + +The microphone detection work scheduled by a prior jack insertion +interrupt may still be in a pending state or under execution when a jack +ejection interrupt has been fired. + +This might lead to a racing condition or nau8821_jdet_work() completing +after nau8821_eject_jack(), which will override the currently +disconnected state of the jack and incorrectly report the headphone or +the headset as being connected. + +Cancel any pending jdet_work or wait for its execution to finish before +attempting to handle the ejection interrupt. + +Proceed similarly before launching the eject handler as a consequence of +detecting an invalid insert interrupt. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index edb95f869a4a6..fed5d51fa5c3b 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1185,6 +1185,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + + if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == + NAU8821_JACK_EJECT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); +@@ -1199,11 +1200,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + clear_irq = NAU8821_KEY_RELEASE_IRQ; + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_EN); + if (nau8821_is_jack_inserted(regmap)) { + /* detect microphone and jack type */ +- cancel_work_sync(&nau8821->jdet_work); + schedule_work(&nau8821->jdet_work); + /* Turn off insertion interruption at manual mode */ + regmap_update_bits(regmap, +-- +2.51.0 + diff --git a/queue-6.17/asoc-nau8821-consistently-clear-interrupts-before-un.patch b/queue-6.17/asoc-nau8821-consistently-clear-interrupts-before-un.patch new file mode 100644 index 0000000000..4eb88d3857 --- /dev/null +++ b/queue-6.17/asoc-nau8821-consistently-clear-interrupts-before-un.patch @@ -0,0 +1,168 @@ +From b5a00ad10fd5ea3ce0db07cb5ceee7e934cdceef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:25 +0300 +Subject: ASoC: nau8821: Consistently clear interrupts before unmasking + +From: Cristian Ciocaltea + +[ Upstream commit a698679fe8b0fec41d1fb9547a53127a85c1be92 ] + +The interrupt handler attempts to perform some IRQ status clear +operations *after* rather than *before* unmasking and enabling +interrupts. This is a rather fragile approach since it may generally +lead to missing IRQ requests or causing spurious interrupts. + +Make use of the nau8821_irq_status_clear() helper instead of +manipulating the related register directly and ensure any interrupt +clearing is performed *after* the target interrupts are disabled/masked +and *before* proceeding with additional interrupt unmasking/enablement +operations. + +This also implicitly drops the redundant clear operation of the ejection +IRQ in the interrupt handler, since nau8821_eject_jack() has been +already responsible for clearing all active interrupts. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Fixes: 2551b6e89936 ("ASoC: nau8821: Add headset button detection") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-3-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 58 ++++++++++++++++++++------------------ + 1 file changed, 30 insertions(+), 28 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index cefce97893123..56e5a0d80782b 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1057,20 +1057,24 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + snd_soc_component_disable_pin(component, "MICBIAS"); + snd_soc_dapm_sync(dapm); + ++ /* Disable & mask both insertion & ejection IRQs */ ++ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL, ++ NAU8821_IRQ_INSERT_DIS | NAU8821_IRQ_EJECT_DIS, ++ NAU8821_IRQ_INSERT_DIS | NAU8821_IRQ_EJECT_DIS); ++ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, ++ NAU8821_IRQ_INSERT_EN | NAU8821_IRQ_EJECT_EN, ++ NAU8821_IRQ_INSERT_EN | NAU8821_IRQ_EJECT_EN); ++ + /* Clear all interruption status */ + nau8821_irq_status_clear(regmap, 0); + +- /* Enable the insertion interruption, disable the ejection inter- +- * ruption, and then bypass de-bounce circuit. +- */ ++ /* Enable & unmask the insertion IRQ */ + regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL, +- NAU8821_IRQ_EJECT_DIS | NAU8821_IRQ_INSERT_DIS, +- NAU8821_IRQ_EJECT_DIS); +- /* Mask unneeded IRQs: 1 - disable, 0 - enable */ ++ NAU8821_IRQ_INSERT_DIS, 0); + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, +- NAU8821_IRQ_EJECT_EN | NAU8821_IRQ_INSERT_EN, +- NAU8821_IRQ_EJECT_EN); ++ NAU8821_IRQ_INSERT_EN, 0); + ++ /* Bypass de-bounce circuit */ + regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, + NAU8821_JACK_DET_DB_BYPASS, NAU8821_JACK_DET_DB_BYPASS); + +@@ -1094,7 +1098,6 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + NAU8821_IRQ_KEY_RELEASE_DIS | + NAU8821_IRQ_KEY_PRESS_DIS); + } +- + } + + static void nau8821_jdet_work(struct work_struct *work) +@@ -1151,6 +1154,15 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + { + struct regmap *regmap = nau8821->regmap; + ++ /* Disable & mask insertion IRQ */ ++ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL, ++ NAU8821_IRQ_INSERT_DIS, NAU8821_IRQ_INSERT_DIS); ++ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, ++ NAU8821_IRQ_INSERT_EN, NAU8821_IRQ_INSERT_EN); ++ ++ /* Clear insert IRQ status */ ++ nau8821_irq_status_clear(regmap, NAU8821_JACK_INSERT_DETECTED); ++ + /* Enable internal VCO needed for interruptions */ + if (nau8821->dapm->bias_level < SND_SOC_BIAS_PREPARE) + nau8821_configure_sysclk(nau8821, NAU8821_CLK_INTERNAL, 0); +@@ -1169,17 +1181,18 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, + NAU8821_JACK_DET_DB_BYPASS, 0); + ++ /* Unmask & enable the ejection IRQs */ + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, +- NAU8821_IRQ_EJECT_EN, 0); ++ NAU8821_IRQ_EJECT_EN, 0); + regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL, +- NAU8821_IRQ_EJECT_DIS, 0); ++ NAU8821_IRQ_EJECT_DIS, 0); + } + + static irqreturn_t nau8821_interrupt(int irq, void *data) + { + struct nau8821 *nau8821 = (struct nau8821 *)data; + struct regmap *regmap = nau8821->regmap; +- int active_irq, clear_irq = 0, event = 0, event_mask = 0; ++ int active_irq, event = 0, event_mask = 0; + + if (regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq)) { + dev_err(nau8821->dev, "failed to read irq status\n"); +@@ -1195,14 +1208,13 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); + event_mask |= SND_JACK_HEADSET; +- clear_irq = NAU8821_JACK_EJECT_IRQ_MASK; + } else if (active_irq & NAU8821_KEY_SHORT_PRESS_IRQ) { + event |= NAU8821_BUTTON; + event_mask |= NAU8821_BUTTON; +- clear_irq = NAU8821_KEY_SHORT_PRESS_IRQ; ++ nau8821_irq_status_clear(regmap, NAU8821_KEY_SHORT_PRESS_IRQ); + } else if (active_irq & NAU8821_KEY_RELEASE_IRQ) { + event_mask = NAU8821_BUTTON; +- clear_irq = NAU8821_KEY_RELEASE_IRQ; ++ nau8821_irq_status_clear(regmap, NAU8821_KEY_RELEASE_IRQ); + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { + cancel_work_sync(&nau8821->jdet_work); +@@ -1212,27 +1224,17 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + /* detect microphone and jack type */ + schedule_work(&nau8821->jdet_work); + /* Turn off insertion interruption at manual mode */ +- regmap_update_bits(regmap, +- NAU8821_R12_INTERRUPT_DIS_CTRL, +- NAU8821_IRQ_INSERT_DIS, +- NAU8821_IRQ_INSERT_DIS); +- regmap_update_bits(regmap, +- NAU8821_R0F_INTERRUPT_MASK, +- NAU8821_IRQ_INSERT_EN, +- NAU8821_IRQ_INSERT_EN); + nau8821_setup_inserted_irq(nau8821); + } else { + dev_warn(nau8821->dev, + "Inserted IRQ fired but not connected\n"); + nau8821_eject_jack(nau8821); + } ++ } else { ++ /* Clear the rightmost interrupt */ ++ nau8821_irq_status_clear(regmap, active_irq); + } + +- if (!clear_irq) +- clear_irq = active_irq; +- /* clears the rightmost interruption */ +- regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, clear_irq); +- + if (event_mask) + snd_soc_jack_report(nau8821->jack, event, event_mask); + +-- +2.51.0 + diff --git a/queue-6.17/asoc-nau8821-generalize-helper-to-clear-irq-status.patch b/queue-6.17/asoc-nau8821-generalize-helper-to-clear-irq-status.patch new file mode 100644 index 0000000000..41d7e77be2 --- /dev/null +++ b/queue-6.17/asoc-nau8821-generalize-helper-to-clear-irq-status.patch @@ -0,0 +1,78 @@ +From c9a6e722d65669044b6bab930fd371db58015456 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:24 +0300 +Subject: ASoC: nau8821: Generalize helper to clear IRQ status + +From: Cristian Ciocaltea + +[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ] + +Instead of adding yet another utility function for dealing with the +interrupt clearing register, generalize nau8821_int_status_clear_all() +by renaming it to nau8821_irq_status_clear(), whilst introducing a +second parameter to allow restricting the operation scope to a single +interrupt instead of the whole range of active IRQs. + +While at it, also fix a spelling typo in the comment block. + +Note this is mainly a prerequisite for subsequent patches aiming to +address some deficiencies in the implementation of the interrupt +handler. Thus the presence of the Fixes tag below is intentional, to +facilitate backporting. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index fed5d51fa5c3b..cefce97893123 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1021,12 +1021,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap) + return active_high == is_high; + } + +-static void nau8821_int_status_clear_all(struct regmap *regmap) ++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq) + { +- int active_irq, clear_irq, i; ++ int clear_irq, i; + +- /* Reset the intrruption status from rightmost bit if the corres- +- * ponding irq event occurs. ++ if (active_irq) { ++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq); ++ return; ++ } ++ ++ /* Reset the interruption status from rightmost bit if the ++ * corresponding irq event occurs. + */ + regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq); + for (i = 0; i < NAU8821_REG_DATA_LEN; i++) { +@@ -1053,7 +1058,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + snd_soc_dapm_sync(dapm); + + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable the insertion interruption, disable the ejection inter- + * ruption, and then bypass de-bounce circuit. +@@ -1522,7 +1527,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821) + nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0); + if (nau8821->irq) { + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable both insertion and ejection interruptions, and then + * bypass de-bounce circuit. +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-fix-stale-tag-depth-for-shared-sched-tags-in-.patch b/queue-6.17/blk-mq-fix-stale-tag-depth-for-shared-sched-tags-in-.patch new file mode 100644 index 0000000000..64fc13508b --- /dev/null +++ b/queue-6.17/blk-mq-fix-stale-tag-depth-for-shared-sched-tags-in-.patch @@ -0,0 +1,93 @@ +From d876c5f1c159cde8dc165572ebeae10c2266b1a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 09:48:27 +0800 +Subject: blk-mq: fix stale tag depth for shared sched tags in + blk_mq_update_nr_requests() + +From: Yu Kuai + +[ Upstream commit dc96cefef0d3032c69e46a21b345c60e56b18934 ] + +Commit 7f2799c546db ("blk-mq: cleanup shared tags case in +blk_mq_update_nr_requests()") moves blk_mq_tag_update_sched_shared_tags() +before q->nr_requests is updated, however, it's still using the old +q->nr_requests to resize tag depth. + +Fix this problem by passing in expected new tag depth. + +Fixes: 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") +Signed-off-by: Yu Kuai +Reviewed-by: Ming Lei +Reviewed-by: Nilay Shroff +Reported-by: Chris Mason +Link: https://lore.kernel.org/linux-block/20251014130507.4187235-2-clm@meta.com/ +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sched.c | 2 +- + block/blk-mq-tag.c | 5 +++-- + block/blk-mq.c | 2 +- + block/blk-mq.h | 3 ++- + 4 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index d06bb137a7437..e0bed16485c34 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -557,7 +557,7 @@ int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e, + if (blk_mq_is_shared_tags(flags)) { + /* Shared tags are stored at index 0 in @et->tags. */ + q->sched_shared_tags = et->tags[0]; +- blk_mq_tag_update_sched_shared_tags(q); ++ blk_mq_tag_update_sched_shared_tags(q, et->nr_requests); + } + + queue_for_each_hw_ctx(q, hctx, i) { +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index aed84c5d5c2b2..12f48e7a0f774 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -622,10 +622,11 @@ void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, unsigned int size + sbitmap_queue_resize(&tags->bitmap_tags, size - set->reserved_tags); + } + +-void blk_mq_tag_update_sched_shared_tags(struct request_queue *q) ++void blk_mq_tag_update_sched_shared_tags(struct request_queue *q, ++ unsigned int nr) + { + sbitmap_queue_resize(&q->sched_shared_tags->bitmap_tags, +- q->nr_requests - q->tag_set->reserved_tags); ++ nr - q->tag_set->reserved_tags); + } + + /** +diff --git a/block/blk-mq.c b/block/blk-mq.c +index f8a8a23b90402..19f62b070ca9d 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4942,7 +4942,7 @@ struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q, + * tags can't grow, see blk_mq_alloc_sched_tags(). + */ + if (q->elevator) +- blk_mq_tag_update_sched_shared_tags(q); ++ blk_mq_tag_update_sched_shared_tags(q, nr); + else + blk_mq_tag_resize_shared_tags(set, nr); + } else if (!q->elevator) { +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 6c9d03625ba12..2fdc8eeb40040 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -188,7 +188,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + struct blk_mq_tags **tags, unsigned int depth); + void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, + unsigned int size); +-void blk_mq_tag_update_sched_shared_tags(struct request_queue *q); ++void blk_mq_tag_update_sched_shared_tags(struct request_queue *q, ++ unsigned int nr); + + void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags, bool); + void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_tag_iter_fn *fn, +-- +2.51.0 + diff --git a/queue-6.17/block-remove-elevator_lock-usage-from-blkg_conf-froz.patch b/queue-6.17/block-remove-elevator_lock-usage-from-blkg_conf-froz.patch new file mode 100644 index 0000000000..c22b7b8b25 --- /dev/null +++ b/queue-6.17/block-remove-elevator_lock-usage-from-blkg_conf-froz.patch @@ -0,0 +1,83 @@ +From 03d679d784a116012e4b8df3590511be2d0170c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 18:30:39 +0800 +Subject: block: Remove elevator_lock usage from blkg_conf frozen operations + +From: Ming Lei + +[ Upstream commit 08823e89e3e269bf4c4a20b4c24a8119920cc7a4 ] + +Remove the acquisition and release of q->elevator_lock in the +blkg_conf_open_bdev_frozen() and blkg_conf_exit_frozen() functions. The +elevator lock is no longer needed in these code paths since commit +78c271344b6f ("block: move wbt_enable_default() out of queue freezing +from sched ->exit()") which introduces `disk->rqos_state_mutex` for +protecting wbt state change, and not necessary to abuse elevator_lock +for this purpose. + +This change helps to solve the lockdep warning reported from Yu Kuai[1]. + +Pass blktests/throtl with lockdep enabled. + +Links: https://lore.kernel.org/linux-block/e5e7ac3f-2063-473a-aafb-4d8d43e5576e@yukuai.org.cn/ [1] +Fixes: commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") +Signed-off-by: Ming Lei +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 7246fc2563152..091e9623bc294 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -812,8 +812,7 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx) + } + /* + * Similar to blkg_conf_open_bdev, but additionally freezes the queue, +- * acquires q->elevator_lock, and ensures the correct locking order +- * between q->elevator_lock and q->rq_qos_mutex. ++ * ensures the correct locking order between freeze queue and q->rq_qos_mutex. + * + * This function returns negative error on failure. On success it returns + * memflags which must be saved and later passed to blkg_conf_exit_frozen +@@ -834,13 +833,11 @@ unsigned long __must_check blkg_conf_open_bdev_frozen(struct blkg_conf_ctx *ctx) + * At this point, we haven’t started protecting anything related to QoS, + * so we release q->rq_qos_mutex here, which was first acquired in blkg_ + * conf_open_bdev. Later, we re-acquire q->rq_qos_mutex after freezing +- * the queue and acquiring q->elevator_lock to maintain the correct +- * locking order. ++ * the queue to maintain the correct locking order. + */ + mutex_unlock(&ctx->bdev->bd_queue->rq_qos_mutex); + + memflags = blk_mq_freeze_queue(ctx->bdev->bd_queue); +- mutex_lock(&ctx->bdev->bd_queue->elevator_lock); + mutex_lock(&ctx->bdev->bd_queue->rq_qos_mutex); + + return memflags; +@@ -1002,9 +999,8 @@ void blkg_conf_exit(struct blkg_conf_ctx *ctx) + EXPORT_SYMBOL_GPL(blkg_conf_exit); + + /* +- * Similar to blkg_conf_exit, but also unfreezes the queue and releases +- * q->elevator_lock. Should be used when blkg_conf_open_bdev_frozen +- * is used to open the bdev. ++ * Similar to blkg_conf_exit, but also unfreezes the queue. Should be used ++ * when blkg_conf_open_bdev_frozen is used to open the bdev. + */ + void blkg_conf_exit_frozen(struct blkg_conf_ctx *ctx, unsigned long memflags) + { +@@ -1012,7 +1008,6 @@ void blkg_conf_exit_frozen(struct blkg_conf_ctx *ctx, unsigned long memflags) + struct request_queue *q = ctx->bdev->bd_queue; + + blkg_conf_exit(ctx); +- mutex_unlock(&q->elevator_lock); + blk_mq_unfreeze_queue(q, memflags); + } + } +-- +2.51.0 + diff --git a/queue-6.17/can-j1939-add-missing-calls-in-netdev_unregister-not.patch b/queue-6.17/can-j1939-add-missing-calls-in-netdev_unregister-not.patch new file mode 100644 index 0000000000..1154ae3ee9 --- /dev/null +++ b/queue-6.17/can-j1939-add-missing-calls-in-netdev_unregister-not.patch @@ -0,0 +1,56 @@ +From d8613170af5bce5e9bfc2d9856792c48dc330ba1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Sep 2025 21:11:16 +0900 +Subject: can: j1939: add missing calls in NETDEV_UNREGISTER notification + handler + +From: Tetsuo Handa + +[ Upstream commit 93a27b5891b8194a8c083c9a80d2141d4bf47ba8 ] + +Currently NETDEV_UNREGISTER event handler is not calling +j1939_cancel_active_session() and j1939_sk_queue_drop_all(). +This will result in these calls being skipped when j1939_sk_release() is +called. And I guess that the reason syzbot is still reporting + + unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 + +is caused by lack of these calls. + +Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can +be covered by calling j1939_cancel_active_session(priv, NULL) from +j1939_netdev_notify(). + +Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered +by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify(). + +Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and +j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler. + +Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler") +Signed-off-by: Tetsuo Handa +Tested-by: Oleksij Rempel +Acked-by: Oleksij Rempel +Link: https://patch.msgid.link/3ad3c7f8-5a74-4b07-a193-cb0725823558@I-love.SAKURA.ne.jp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/j1939/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c +index 3706a872ecafd..a93af55df5fd5 100644 +--- a/net/can/j1939/main.c ++++ b/net/can/j1939/main.c +@@ -378,6 +378,8 @@ static int j1939_netdev_notify(struct notifier_block *nb, + j1939_ecu_unmap_all(priv); + break; + case NETDEV_UNREGISTER: ++ j1939_cancel_active_session(priv, NULL); ++ j1939_sk_netdev_event_netdown(priv); + j1939_sk_netdev_event_unregister(priv); + break; + } +-- +2.51.0 + diff --git a/queue-6.17/can-m_can-fix-can-state-in-system-pm.patch b/queue-6.17/can-m_can-fix-can-state-in-system-pm.patch new file mode 100644 index 0000000000..1220b4c318 --- /dev/null +++ b/queue-6.17/can-m_can-fix-can-state-in-system-pm.patch @@ -0,0 +1,68 @@ +From aade88b12113b6a01bf3a2a596ad570076ea352c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 16:58:31 +0200 +Subject: can: m_can: fix CAN state in system PM + +From: Marc Kleine-Budde + +[ Upstream commit a9e30a22d6f23a2684c248871cad4c3061181639 ] + +A suspend/resume cycle on a down interface results in the interface +coming up in Error Active state. A suspend/resume cycle on an Up +interface will always result in Error Active state, regardless of the +actual CAN state. + +During suspend, only set running interfaces to CAN_STATE_SLEEPING. +During resume only touch the CAN state of running interfaces. For +wakeup sources, set the CAN state depending on the Protocol Status +Regitser (PSR), for non wakeup source interfaces m_can_start() will do +the same. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 9eafd135fcb43..c82ea6043d408 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -2505,12 +2505,11 @@ int m_can_class_suspend(struct device *dev) + } + + m_can_clk_stop(cdev); ++ cdev->can.state = CAN_STATE_SLEEPING; + } + + pinctrl_pm_select_sleep_state(dev); + +- cdev->can.state = CAN_STATE_SLEEPING; +- + return ret; + } + EXPORT_SYMBOL_GPL(m_can_class_suspend); +@@ -2523,8 +2522,6 @@ int m_can_class_resume(struct device *dev) + + pinctrl_pm_select_default_state(dev); + +- cdev->can.state = CAN_STATE_ERROR_ACTIVE; +- + if (netif_running(ndev)) { + ret = m_can_clk_start(cdev); + if (ret) +@@ -2542,6 +2539,8 @@ int m_can_class_resume(struct device *dev) + if (cdev->ops->init) + ret = cdev->ops->init(cdev); + ++ cdev->can.state = m_can_state_get_by_psr(cdev); ++ + m_can_write(cdev, M_CAN_IE, cdev->active_interrupts); + } else { + ret = m_can_start(ndev); +-- +2.51.0 + diff --git a/queue-6.17/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch b/queue-6.17/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch new file mode 100644 index 0000000000..23f0d92f1a --- /dev/null +++ b/queue-6.17/can-m_can-m_can_chip_config-bring-up-interface-in-co.patch @@ -0,0 +1,44 @@ +From 33c07d78928d664bab3601214fc965301f1eeace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 18:24:12 +0200 +Subject: can: m_can: m_can_chip_config(): bring up interface in correct state + +From: Marc Kleine-Budde + +[ Upstream commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 ] + +In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the +CAN state and CAN error counters over an internal reset cycle. An +external reset is not always possible, due to the shared reset with +the other CAN core. This caused the core not always be in Error Active +state when bringing up the controller. + +Instead of always setting the CAN state to Error Active in +m_can_chip_config(), fix this by reading and decoding the Protocol +Status Regitser (PSR) and set the CAN state accordingly. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 4826b8dcad0f7..9eafd135fcb43 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1617,7 +1617,7 @@ static int m_can_start(struct net_device *dev) + netdev_queue_set_dql_min_limit(netdev_get_tx_queue(cdev->net, 0), + cdev->tx_max_coalesced_frames); + +- cdev->can.state = CAN_STATE_ERROR_ACTIVE; ++ cdev->can.state = m_can_state_get_by_psr(cdev); + + m_can_enable_all_interrupts(cdev); + +-- +2.51.0 + diff --git a/queue-6.17/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch b/queue-6.17/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch new file mode 100644 index 0000000000..53aa523c42 --- /dev/null +++ b/queue-6.17/can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch @@ -0,0 +1,123 @@ +From 6e1e453c1bc3d8541ad46f8b9c9da3d52a2b71f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 16:56:15 +0200 +Subject: can: m_can: m_can_handle_state_errors(): fix CAN state transition to + Error Active + +From: Marc Kleine-Budde + +[ Upstream commit 3d9db29b45f970d81acf61cf91a65442efbeb997 ] + +The CAN Error State is determined by the receive and transmit error +counters. The CAN error counters decrease when reception/transmission +is successful, so that a status transition back to the Error Active +status is possible. This transition is not handled by +m_can_handle_state_errors(). + +Add the missing detection of the Error Active state to +m_can_handle_state_errors() and extend the handling of this state in +m_can_handle_state_change(). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 53 +++++++++++++++++++++-------------- + 1 file changed, 32 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index fe74dbd2c9663..4826b8dcad0f7 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -812,6 +812,9 @@ static int m_can_handle_state_change(struct net_device *dev, + u32 timestamp = 0; + + switch (new_state) { ++ case CAN_STATE_ERROR_ACTIVE: ++ cdev->can.state = CAN_STATE_ERROR_ACTIVE; ++ break; + case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cdev->can.can_stats.error_warning++; +@@ -841,6 +844,12 @@ static int m_can_handle_state_change(struct net_device *dev, + __m_can_get_berr_counter(dev, &bec); + + switch (new_state) { ++ case CAN_STATE_ERROR_ACTIVE: ++ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT; ++ cf->data[1] = CAN_ERR_CRTL_ACTIVE; ++ cf->data[6] = bec.txerr; ++ cf->data[7] = bec.rxerr; ++ break; + case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT; +@@ -877,30 +886,33 @@ static int m_can_handle_state_change(struct net_device *dev, + return 1; + } + +-static int m_can_handle_state_errors(struct net_device *dev, u32 psr) ++static enum can_state ++m_can_state_get_by_psr(struct m_can_classdev *cdev) + { +- struct m_can_classdev *cdev = netdev_priv(dev); +- int work_done = 0; ++ u32 reg_psr; + +- if (psr & PSR_EW && cdev->can.state != CAN_STATE_ERROR_WARNING) { +- netdev_dbg(dev, "entered error warning state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_ERROR_WARNING); +- } ++ reg_psr = m_can_read(cdev, M_CAN_PSR); + +- if (psr & PSR_EP && cdev->can.state != CAN_STATE_ERROR_PASSIVE) { +- netdev_dbg(dev, "entered error passive state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_ERROR_PASSIVE); +- } ++ if (reg_psr & PSR_BO) ++ return CAN_STATE_BUS_OFF; ++ if (reg_psr & PSR_EP) ++ return CAN_STATE_ERROR_PASSIVE; ++ if (reg_psr & PSR_EW) ++ return CAN_STATE_ERROR_WARNING; + +- if (psr & PSR_BO && cdev->can.state != CAN_STATE_BUS_OFF) { +- netdev_dbg(dev, "entered error bus off state\n"); +- work_done += m_can_handle_state_change(dev, +- CAN_STATE_BUS_OFF); +- } ++ return CAN_STATE_ERROR_ACTIVE; ++} + +- return work_done; ++static int m_can_handle_state_errors(struct net_device *dev) ++{ ++ struct m_can_classdev *cdev = netdev_priv(dev); ++ enum can_state new_state; ++ ++ new_state = m_can_state_get_by_psr(cdev); ++ if (new_state == cdev->can.state) ++ return 0; ++ ++ return m_can_handle_state_change(dev, new_state); + } + + static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus) +@@ -1031,8 +1043,7 @@ static int m_can_rx_handler(struct net_device *dev, int quota, u32 irqstatus) + } + + if (irqstatus & IR_ERR_STATE) +- work_done += m_can_handle_state_errors(dev, +- m_can_read(cdev, M_CAN_PSR)); ++ work_done += m_can_handle_state_errors(dev); + + if (irqstatus & IR_ERR_BUS_30X) + work_done += m_can_handle_bus_errors(dev, irqstatus, +-- +2.51.0 + diff --git a/queue-6.17/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch b/queue-6.17/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch new file mode 100644 index 0000000000..759d54f5f3 --- /dev/null +++ b/queue-6.17/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch @@ -0,0 +1,46 @@ +From 7e9eb893d8e44518730890281110a34ac6baa659 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 17:46:32 +0200 +Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() + +From: Marc Kleine-Budde + +[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ] + +Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to +m_can_platform") moved the PM runtime enable from the m_can core +driver into the m_can_platform. + +That patch forgot to move the pm_runtime_disable() to +m_can_plat_remove(), so that unloading the m_can_platform driver +causes an "Unbalanced pm_runtime_enable!" error message. + +Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the +problem. + +Cc: Patrik Flykt +Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index b832566efda04..057eaa7b8b4b2 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -180,7 +180,7 @@ static void m_can_plat_remove(struct platform_device *pdev) + struct m_can_classdev *mcan_class = &priv->cdev; + + m_can_class_unregister(mcan_class); +- ++ pm_runtime_disable(mcan_class->dev); + m_can_class_free_dev(mcan_class->net); + } + +-- +2.51.0 + diff --git a/queue-6.17/coredump-fix-core_pattern-input-validation.patch b/queue-6.17/coredump-fix-core_pattern-input-validation.patch new file mode 100644 index 0000000000..9a14eefdb5 --- /dev/null +++ b/queue-6.17/coredump-fix-core_pattern-input-validation.patch @@ -0,0 +1,56 @@ +From 2e85077725a435c635caaa2b93ad65c73b3d64c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 11:32:42 +0200 +Subject: coredump: fix core_pattern input validation + +From: Christian Brauner + +[ Upstream commit a779e27f24aeb679969ddd1fdd7f636e22ddbc1e ] + +In be1e0283021e ("coredump: don't pointlessly check and spew warnings") +we tried to fix input validation so it only happens during a write to +core_pattern. This would avoid needlessly logging a lot of warnings +during a read operation. However the logic accidently got inverted in +this commit. Fix it so the input validation only happens on write and is +skipped on read. + +Fixes: be1e0283021e ("coredump: don't pointlessly check and spew warnings") +Fixes: 16195d2c7dd2 ("coredump: validate socket name as it is written") +Reviewed-by: Jan Kara +Reported-by: Yu Watanabe +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/coredump.c | 2 +- + fs/exec.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/coredump.c b/fs/coredump.c +index 60bc9685e1498..c5e9a855502dd 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -1466,7 +1466,7 @@ static int proc_dostring_coredump(const struct ctl_table *table, int write, + ssize_t retval; + char old_core_pattern[CORENAME_MAX_SIZE]; + +- if (write) ++ if (!write) + return proc_dostring(table, write, buffer, lenp, ppos); + + retval = strscpy(old_core_pattern, core_pattern, CORENAME_MAX_SIZE); +diff --git a/fs/exec.c b/fs/exec.c +index e861a4b7ffda9..a69a2673f6311 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -2048,7 +2048,7 @@ static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int writ + { + int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + +- if (!error && !write) ++ if (!error && write) + validate_coredump_safety(); + return error; + } +-- +2.51.0 + diff --git a/queue-6.17/cxl-features-add-check-for-no-entries-in-cxl_feature.patch b/queue-6.17/cxl-features-add-check-for-no-entries-in-cxl_feature.patch new file mode 100644 index 0000000000..cb380a3591 --- /dev/null +++ b/queue-6.17/cxl-features-add-check-for-no-entries-in-cxl_feature.patch @@ -0,0 +1,52 @@ +From 22af17f6041330546776e23b0ec9feb3b85ce7bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 08:40:01 -0700 +Subject: cxl/features: Add check for no entries in cxl_feature_info + +From: Dave Jiang + +[ Upstream commit a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e ] + +cxl EDAC calls cxl_feature_info() to get the feature information and +if the hardware has no Features support, cxlfs may be passed in as +NULL. + +[ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008 +[ 51.965571] #PF: supervisor read access in kernel mode +[ 51.971559] #PF: error_code(0x0000) - not-present page +[ 51.977542] PGD 17e4f6067 P4D 0 +[ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI +[ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj +test+ #64 PREEMPT(voluntary) +[ 51.997355] Hardware name: +[ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core] + +Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if +there is no cxlfs created due to no hardware support. + +Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") +Reviewed-by: Davidlohr Bueso +Reviewed-by: Alison Schofield +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/features.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c +index 7c750599ea690..4bc484b46f439 100644 +--- a/drivers/cxl/core/features.c ++++ b/drivers/cxl/core/features.c +@@ -371,6 +371,9 @@ cxl_feature_info(struct cxl_features_state *cxlfs, + { + struct cxl_feat_entry *feat; + ++ if (!cxlfs || !cxlfs->entries) ++ return ERR_PTR(-EOPNOTSUPP); ++ + for (int i = 0; i < cxlfs->entries->num_features; i++) { + feat = &cxlfs->entries->ent[i]; + if (uuid_equal(uuid, &feat->uuid)) +-- +2.51.0 + diff --git a/queue-6.17/cxl-trace-subtract-to-find-an-hpa_alias0-in-cxl_pois.patch b/queue-6.17/cxl-trace-subtract-to-find-an-hpa_alias0-in-cxl_pois.patch new file mode 100644 index 0000000000..744104aee8 --- /dev/null +++ b/queue-6.17/cxl-trace-subtract-to-find-an-hpa_alias0-in-cxl_pois.patch @@ -0,0 +1,40 @@ +From af695e4787e74b1e14855828b8e3c4a5b11276d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 14:38:49 -0700 +Subject: cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events + +From: Alison Schofield + +[ Upstream commit a4bbb493a3247ef32f6191fd8b2a0657139f8e08 ] + +Traces of cxl_poison events include an hpa_alias0 field if the poison +address is in a region configured with an ELC, Extended Linear Cache. + +Since the ELC always comes first in the region, the calculation needs +to subtract the ELC size from the calculated HPA address. + +Fixes: 8c520c5f1e76 ("cxl: Add extended linear cache address alias emission for cxl events") +Signed-off-by: Alison Schofield +Reviewed-by: Dave Jiang +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h +index a53ec4798b12f..a972e4ef19368 100644 +--- a/drivers/cxl/core/trace.h ++++ b/drivers/cxl/core/trace.h +@@ -1068,7 +1068,7 @@ TRACE_EVENT(cxl_poison, + __entry->hpa = cxl_dpa_to_hpa(cxlr, cxlmd, + __entry->dpa); + if (__entry->hpa != ULLONG_MAX && cxlr->params.cache_size) +- __entry->hpa_alias0 = __entry->hpa + ++ __entry->hpa_alias0 = __entry->hpa - + cxlr->params.cache_size; + else + __entry->hpa_alias0 = ULLONG_MAX; +-- +2.51.0 + diff --git a/queue-6.17/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-6.17/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..5a70ab474a --- /dev/null +++ b/queue-6.17/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From d4738c7d4eb54d0083b11b40968f82fd00188a80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 20ecf652c129d..260e063e3bc2d 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1752,7 +1752,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-6.17/doc-fix-seg6_flowlabel-path.patch b/queue-6.17/doc-fix-seg6_flowlabel-path.patch new file mode 100644 index 0000000000..36ec4dc566 --- /dev/null +++ b/queue-6.17/doc-fix-seg6_flowlabel-path.patch @@ -0,0 +1,38 @@ +From e15706936fd76d66e2be260f39590fba1a671ed9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:18:59 +0200 +Subject: doc: fix seg6_flowlabel path + +From: Nicolas Dichtel + +[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ] + +This sysctl is not per interface; it's global per netns. + +Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") +Reported-by: Philippe Guibert +Signed-off-by: Nicolas Dichtel +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/seg6-sysctl.rst | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst +index 07c20e470bafe..1b6af4779be11 100644 +--- a/Documentation/networking/seg6-sysctl.rst ++++ b/Documentation/networking/seg6-sysctl.rst +@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER + + Default is 0. + ++/proc/sys/net/ipv6/seg6_* variables: ++==================================== ++ + seg6_flowlabel - INTEGER + Controls the behaviour of computing the flowlabel of outer + IPv6 header in case of SR T.encaps +-- +2.51.0 + diff --git a/queue-6.17/dpll-zl3073x-handle-missing-or-corrupted-flash-confi.patch b/queue-6.17/dpll-zl3073x-handle-missing-or-corrupted-flash-confi.patch new file mode 100644 index 0000000000..c33e8b4155 --- /dev/null +++ b/queue-6.17/dpll-zl3073x-handle-missing-or-corrupted-flash-confi.patch @@ -0,0 +1,92 @@ +From b64e18706404f7181e804092bf8ce473b0e13f0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 16:14:45 +0200 +Subject: dpll: zl3073x: Handle missing or corrupted flash configuration + +From: Ivan Vecera + +[ Upstream commit fcb8b32a68fd40b0440cb9468cf6f6ab9de9f3c5 ] + +If the internal flash contains missing or corrupted configuration, +basic communication over the bus still functions, but the device +is not capable of normal operation (for example, using mailboxes). + +This condition is indicated in the info register by the ready bit. +If this bit is cleared, the probe procedure times out while fetching +the device state. + +Handle this case by checking the ready bit value in zl3073x_dev_start() +and skipping DPLL device and pin registration if it is cleared. +Do not report this condition as an error, allowing the devlink device +to be registered and enabling the user to flash the correct configuration. + +Prior this patch: +[ 31.112299] zl3073x-i2c 1-0070: Failed to fetch input state: -ETIMEDOUT +[ 31.116332] zl3073x-i2c 1-0070: error -ETIMEDOUT: Failed to start device +[ 31.136881] zl3073x-i2c 1-0070: probe with driver zl3073x-i2c failed with error -110 + +After this patch: +[ 41.011438] zl3073x-i2c 1-0070: FW not fully ready - missing or corrupted config + +Fixes: 75a71ecc24125 ("dpll: zl3073x: Register DPLL devices and pins") +Signed-off-by: Ivan Vecera +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20251008141445.841113-1-ivecera@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/dpll/zl3073x/core.c | 21 +++++++++++++++++++++ + drivers/dpll/zl3073x/regs.h | 3 +++ + 2 files changed, 24 insertions(+) + +diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c +index 0df210cec08da..59c75b470efbf 100644 +--- a/drivers/dpll/zl3073x/core.c ++++ b/drivers/dpll/zl3073x/core.c +@@ -864,8 +864,29 @@ zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev) + int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full) + { + struct zl3073x_dpll *zldpll; ++ u8 info; + int rc; + ++ rc = zl3073x_read_u8(zldev, ZL_REG_INFO, &info); ++ if (rc) { ++ dev_err(zldev->dev, "Failed to read device status info\n"); ++ return rc; ++ } ++ ++ if (!FIELD_GET(ZL_INFO_READY, info)) { ++ /* The ready bit indicates that the firmware was successfully ++ * configured and is ready for normal operation. If it is ++ * cleared then the configuration stored in flash is wrong ++ * or missing. In this situation the driver will expose ++ * only devlink interface to give an opportunity to flash ++ * the correct config. ++ */ ++ dev_info(zldev->dev, ++ "FW not fully ready - missing or corrupted config\n"); ++ ++ return 0; ++ } ++ + if (full) { + /* Fetch device state */ + rc = zl3073x_dev_state_fetch(zldev); +diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h +index 614e33128a5c9..bb9965b8e8c75 100644 +--- a/drivers/dpll/zl3073x/regs.h ++++ b/drivers/dpll/zl3073x/regs.h +@@ -67,6 +67,9 @@ + * Register Page 0, General + **************************/ + ++#define ZL_REG_INFO ZL_REG(0, 0x00, 1) ++#define ZL_INFO_READY BIT(7) ++ + #define ZL_REG_ID ZL_REG(0, 0x01, 2) + #define ZL_REG_REVISION ZL_REG(0, 0x03, 2) + #define ZL_REG_FW_VER ZL_REG(0, 0x05, 2) +-- +2.51.0 + diff --git a/queue-6.17/dpll-zl3073x-refactor-dpll-initialization.patch b/queue-6.17/dpll-zl3073x-refactor-dpll-initialization.patch new file mode 100644 index 0000000000..7277e4ba4c --- /dev/null +++ b/queue-6.17/dpll-zl3073x-refactor-dpll-initialization.patch @@ -0,0 +1,363 @@ +From 9ae1b53123cf537f0bac74e70cc55905dcde7995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:15:31 +0200 +Subject: dpll: zl3073x: Refactor DPLL initialization + +From: Ivan Vecera + +[ Upstream commit ebb1031c51377829b21e1c58e8eccc479e4921b7 ] + +Refactor DPLL initialization and move DPLL (de)registration, monitoring +control, fetching device invariant parameters and phase offset +measurement block setup to separate functions. + +Use these new functions during device probe and teardown functions and +during changes to the clock_id devlink parameter. + +These functions will also be used in the next patch implementing devlink +flash, where this functionality is likewise required. + +Reviewed-by: Przemek Kitszel +Signed-off-by: Ivan Vecera +Link: https://patch.msgid.link/20250909091532.11790-5-ivecera@redhat.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: fcb8b32a68fd ("dpll: zl3073x: Handle missing or corrupted flash configuration") +Signed-off-by: Sasha Levin +--- + drivers/dpll/zl3073x/core.c | 207 +++++++++++++++++++++------------ + drivers/dpll/zl3073x/core.h | 3 + + drivers/dpll/zl3073x/devlink.c | 18 +-- + 3 files changed, 142 insertions(+), 86 deletions(-) + +diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c +index 7ebcfc5ec1f09..0df210cec08da 100644 +--- a/drivers/dpll/zl3073x/core.c ++++ b/drivers/dpll/zl3073x/core.c +@@ -809,21 +809,142 @@ zl3073x_dev_periodic_work(struct kthread_work *work) + msecs_to_jiffies(500)); + } + ++/** ++ * zl3073x_dev_phase_meas_setup - setup phase offset measurement ++ * @zldev: pointer to zl3073x_dev structure ++ * ++ * Enable phase offset measurement block, set measurement averaging factor ++ * and enable DPLL-to-its-ref phase measurement for all DPLLs. ++ * ++ * Returns: 0 on success, <0 on error ++ */ ++static int ++zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev) ++{ ++ struct zl3073x_dpll *zldpll; ++ u8 dpll_meas_ctrl, mask = 0; ++ int rc; ++ ++ /* Read DPLL phase measurement control register */ ++ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, &dpll_meas_ctrl); ++ if (rc) ++ return rc; ++ ++ /* Setup phase measurement averaging factor */ ++ dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR; ++ dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, 3); ++ ++ /* Enable DPLL measurement block */ ++ dpll_meas_ctrl |= ZL_DPLL_MEAS_CTRL_EN; ++ ++ /* Update phase measurement control register */ ++ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl); ++ if (rc) ++ return rc; ++ ++ /* Enable DPLL-to-connected-ref measurement for each channel */ ++ list_for_each_entry(zldpll, &zldev->dplls, list) ++ mask |= BIT(zldpll->id); ++ ++ return zl3073x_write_u8(zldev, ZL_REG_DPLL_PHASE_ERR_READ_MASK, mask); ++} ++ ++/** ++ * zl3073x_dev_start - Start normal operation ++ * @zldev: zl3073x device pointer ++ * @full: perform full initialization ++ * ++ * The function starts normal operation, which means registering all DPLLs and ++ * their pins, and starting monitoring. If full initialization is requested, ++ * the function additionally initializes the phase offset measurement block and ++ * fetches hardware-invariant parameters. ++ * ++ * Return: 0 on success, <0 on error ++ */ ++int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full) ++{ ++ struct zl3073x_dpll *zldpll; ++ int rc; ++ ++ if (full) { ++ /* Fetch device state */ ++ rc = zl3073x_dev_state_fetch(zldev); ++ if (rc) ++ return rc; ++ ++ /* Setup phase offset measurement block */ ++ rc = zl3073x_dev_phase_meas_setup(zldev); ++ if (rc) { ++ dev_err(zldev->dev, ++ "Failed to setup phase measurement\n"); ++ return rc; ++ } ++ } ++ ++ /* Register all DPLLs */ ++ list_for_each_entry(zldpll, &zldev->dplls, list) { ++ rc = zl3073x_dpll_register(zldpll); ++ if (rc) { ++ dev_err_probe(zldev->dev, rc, ++ "Failed to register DPLL%u\n", ++ zldpll->id); ++ return rc; ++ } ++ } ++ ++ /* Perform initial firmware fine phase correction */ ++ rc = zl3073x_dpll_init_fine_phase_adjust(zldev); ++ if (rc) { ++ dev_err_probe(zldev->dev, rc, ++ "Failed to init fine phase correction\n"); ++ return rc; ++ } ++ ++ /* Start monitoring */ ++ kthread_queue_delayed_work(zldev->kworker, &zldev->work, 0); ++ ++ return 0; ++} ++ ++/** ++ * zl3073x_dev_stop - Stop normal operation ++ * @zldev: zl3073x device pointer ++ * ++ * The function stops the normal operation that mean deregistration of all ++ * DPLLs and their pins and stop monitoring. ++ * ++ * Return: 0 on success, <0 on error ++ */ ++void zl3073x_dev_stop(struct zl3073x_dev *zldev) ++{ ++ struct zl3073x_dpll *zldpll; ++ ++ /* Stop monitoring */ ++ kthread_cancel_delayed_work_sync(&zldev->work); ++ ++ /* Unregister all DPLLs */ ++ list_for_each_entry(zldpll, &zldev->dplls, list) { ++ if (zldpll->dpll_dev) ++ zl3073x_dpll_unregister(zldpll); ++ } ++} ++ + static void zl3073x_dev_dpll_fini(void *ptr) + { + struct zl3073x_dpll *zldpll, *next; + struct zl3073x_dev *zldev = ptr; + +- /* Stop monitoring thread */ ++ /* Stop monitoring and unregister DPLLs */ ++ zl3073x_dev_stop(zldev); ++ ++ /* Destroy monitoring thread */ + if (zldev->kworker) { +- kthread_cancel_delayed_work_sync(&zldev->work); + kthread_destroy_worker(zldev->kworker); + zldev->kworker = NULL; + } + +- /* Release DPLLs */ ++ /* Free all DPLLs */ + list_for_each_entry_safe(zldpll, next, &zldev->dplls, list) { +- zl3073x_dpll_unregister(zldpll); + list_del(&zldpll->list); + zl3073x_dpll_free(zldpll); + } +@@ -839,7 +960,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) + + INIT_LIST_HEAD(&zldev->dplls); + +- /* Initialize all DPLLs */ ++ /* Allocate all DPLLs */ + for (i = 0; i < num_dplls; i++) { + zldpll = zl3073x_dpll_alloc(zldev, i); + if (IS_ERR(zldpll)) { +@@ -849,25 +970,9 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) + goto error; + } + +- rc = zl3073x_dpll_register(zldpll); +- if (rc) { +- dev_err_probe(zldev->dev, rc, +- "Failed to register DPLL%u\n", i); +- zl3073x_dpll_free(zldpll); +- goto error; +- } +- + list_add_tail(&zldpll->list, &zldev->dplls); + } + +- /* Perform initial firmware fine phase correction */ +- rc = zl3073x_dpll_init_fine_phase_adjust(zldev); +- if (rc) { +- dev_err_probe(zldev->dev, rc, +- "Failed to init fine phase correction\n"); +- goto error; +- } +- + /* Initialize monitoring thread */ + kthread_init_delayed_work(&zldev->work, zl3073x_dev_periodic_work); + kworker = kthread_run_worker(0, "zl3073x-%s", dev_name(zldev->dev)); +@@ -875,9 +980,14 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) + rc = PTR_ERR(kworker); + goto error; + } +- + zldev->kworker = kworker; +- kthread_queue_delayed_work(zldev->kworker, &zldev->work, 0); ++ ++ /* Start normal operation */ ++ rc = zl3073x_dev_start(zldev, true); ++ if (rc) { ++ dev_err_probe(zldev->dev, rc, "Failed to start device\n"); ++ goto error; ++ } + + /* Add devres action to release DPLL related resources */ + rc = devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev); +@@ -892,46 +1002,6 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) + return rc; + } + +-/** +- * zl3073x_dev_phase_meas_setup - setup phase offset measurement +- * @zldev: pointer to zl3073x_dev structure +- * @num_channels: number of DPLL channels +- * +- * Enable phase offset measurement block, set measurement averaging factor +- * and enable DPLL-to-its-ref phase measurement for all DPLLs. +- * +- * Returns: 0 on success, <0 on error +- */ +-static int +-zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev, int num_channels) +-{ +- u8 dpll_meas_ctrl, mask; +- int i, rc; +- +- /* Read DPLL phase measurement control register */ +- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, &dpll_meas_ctrl); +- if (rc) +- return rc; +- +- /* Setup phase measurement averaging factor */ +- dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR; +- dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, 3); +- +- /* Enable DPLL measurement block */ +- dpll_meas_ctrl |= ZL_DPLL_MEAS_CTRL_EN; +- +- /* Update phase measurement control register */ +- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl); +- if (rc) +- return rc; +- +- /* Enable DPLL-to-connected-ref measurement for each channel */ +- for (i = 0, mask = 0; i < num_channels; i++) +- mask |= BIT(i); +- +- return zl3073x_write_u8(zldev, ZL_REG_DPLL_PHASE_ERR_READ_MASK, mask); +-} +- + /** + * zl3073x_dev_probe - initialize zl3073x device + * @zldev: pointer to zl3073x device +@@ -999,17 +1069,6 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, + return dev_err_probe(zldev->dev, rc, + "Failed to initialize mutex\n"); + +- /* Fetch device state */ +- rc = zl3073x_dev_state_fetch(zldev); +- if (rc) +- return rc; +- +- /* Setup phase offset measurement block */ +- rc = zl3073x_dev_phase_meas_setup(zldev, chip_info->num_channels); +- if (rc) +- return dev_err_probe(zldev->dev, rc, +- "Failed to setup phase measurement\n"); +- + /* Register DPLL channels */ + rc = zl3073x_devm_dpll_init(zldev, chip_info->num_channels); + if (rc) +diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h +index 71af2c8001109..84e52d5521a34 100644 +--- a/drivers/dpll/zl3073x/core.h ++++ b/drivers/dpll/zl3073x/core.h +@@ -111,6 +111,9 @@ struct zl3073x_dev *zl3073x_devm_alloc(struct device *dev); + int zl3073x_dev_probe(struct zl3073x_dev *zldev, + const struct zl3073x_chip_info *chip_info); + ++int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full); ++void zl3073x_dev_stop(struct zl3073x_dev *zldev); ++ + /********************** + * Registers operations + **********************/ +diff --git a/drivers/dpll/zl3073x/devlink.c b/drivers/dpll/zl3073x/devlink.c +index 7e7fe726ee37a..c2e9f7aca3c84 100644 +--- a/drivers/dpll/zl3073x/devlink.c ++++ b/drivers/dpll/zl3073x/devlink.c +@@ -86,14 +86,12 @@ zl3073x_devlink_reload_down(struct devlink *devlink, bool netns_change, + struct netlink_ext_ack *extack) + { + struct zl3073x_dev *zldev = devlink_priv(devlink); +- struct zl3073x_dpll *zldpll; + + if (action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT) + return -EOPNOTSUPP; + +- /* Unregister all DPLLs */ +- list_for_each_entry(zldpll, &zldev->dplls, list) +- zl3073x_dpll_unregister(zldpll); ++ /* Stop normal operation */ ++ zl3073x_dev_stop(zldev); + + return 0; + } +@@ -107,7 +105,6 @@ zl3073x_devlink_reload_up(struct devlink *devlink, + { + struct zl3073x_dev *zldev = devlink_priv(devlink); + union devlink_param_value val; +- struct zl3073x_dpll *zldpll; + int rc; + + if (action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT) +@@ -125,13 +122,10 @@ zl3073x_devlink_reload_up(struct devlink *devlink, + zldev->clock_id = val.vu64; + } + +- /* Re-register all DPLLs */ +- list_for_each_entry(zldpll, &zldev->dplls, list) { +- rc = zl3073x_dpll_register(zldpll); +- if (rc) +- dev_warn(zldev->dev, +- "Failed to re-register DPLL%u\n", zldpll->id); +- } ++ /* Restart normal operation */ ++ rc = zl3073x_dev_start(zldev, false); ++ if (rc) ++ dev_warn(zldev->dev, "Failed to re-start normal operation\n"); + + *actions_performed = BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT); + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-6.17/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..86b8fdf45d --- /dev/null +++ b/queue-6.17/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From b20d0d39b0e22b238e99f1989775ff4cba82ca06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 8da882c518565..9b28c07282699 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5444,8 +5444,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + thermal_data->sw_ctf_threshold = thermal_data->max; + +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch b/queue-6.17/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch new file mode 100644 index 0000000000..1948287a97 --- /dev/null +++ b/queue-6.17/drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch @@ -0,0 +1,111 @@ +From 76352502791e415f02947b986f7d8ff2d9ee4920 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 10:12:36 -0400 +Subject: drm/amdgpu: add ip offset support for cyan skillfish + +From: Alex Deucher + +[ Upstream commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c ] + +For chips that don't have IP discovery tables. + +Signed-off-by: Alex Deucher +Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/Makefile | 3 +- + .../drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/nv.h | 1 + + 3 files changed, 59 insertions(+), 1 deletion(-) + create mode 100644 drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c + +diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile b/drivers/gpu/drm/amd/amdgpu/Makefile +index 930de203d533c..2d0fea87af79f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/Makefile ++++ b/drivers/gpu/drm/amd/amdgpu/Makefile +@@ -84,7 +84,8 @@ amdgpu-y += \ + vega20_reg_init.o nbio_v7_4.o nbio_v2_3.o nv.o arct_reg_init.o mxgpu_nv.o \ + nbio_v7_2.o hdp_v4_0.o hdp_v5_0.o aldebaran_reg_init.o aldebaran.o soc21.o soc24.o \ + sienna_cichlid.o smu_v13_0_10.o nbio_v4_3.o hdp_v6_0.o nbio_v7_7.o hdp_v5_2.o lsdma_v6_0.o \ +- nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o ++ nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o \ ++ cyan_skillfish_reg_init.o + + # add DF block + amdgpu-y += \ +diff --git a/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c +new file mode 100644 +index 0000000000000..96616a865aac7 +--- /dev/null ++++ b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c +@@ -0,0 +1,56 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright 2018 Advanced Micro Devices, Inc. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR ++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ * ++ */ ++#include "amdgpu.h" ++#include "nv.h" ++ ++#include "soc15_common.h" ++#include "soc15_hw_ip.h" ++#include "cyan_skillfish_ip_offset.h" ++ ++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev) ++{ ++ /* HW has more IP blocks, only initialized the blocke needed by driver */ ++ uint32_t i; ++ ++ adev->gfx.xcc_mask = 1; ++ for (i = 0 ; i < MAX_INSTANCE ; ++i) { ++ adev->reg_offset[GC_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[HDP_HWIP][i] = (uint32_t *)(&(HDP_BASE.instance[i])); ++ adev->reg_offset[MMHUB_HWIP][i] = (uint32_t *)(&(MMHUB_BASE.instance[i])); ++ adev->reg_offset[ATHUB_HWIP][i] = (uint32_t *)(&(ATHUB_BASE.instance[i])); ++ adev->reg_offset[NBIO_HWIP][i] = (uint32_t *)(&(NBIO_BASE.instance[i])); ++ adev->reg_offset[MP0_HWIP][i] = (uint32_t *)(&(MP0_BASE.instance[i])); ++ adev->reg_offset[MP1_HWIP][i] = (uint32_t *)(&(MP1_BASE.instance[i])); ++ adev->reg_offset[VCN_HWIP][i] = (uint32_t *)(&(UVD0_BASE.instance[i])); ++ adev->reg_offset[DF_HWIP][i] = (uint32_t *)(&(DF_BASE.instance[i])); ++ adev->reg_offset[DCE_HWIP][i] = (uint32_t *)(&(DMU_BASE.instance[i])); ++ adev->reg_offset[OSSSYS_HWIP][i] = (uint32_t *)(&(OSSSYS_BASE.instance[i])); ++ adev->reg_offset[SDMA0_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[SDMA1_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i])); ++ adev->reg_offset[SMUIO_HWIP][i] = (uint32_t *)(&(SMUIO_BASE.instance[i])); ++ adev->reg_offset[THM_HWIP][i] = (uint32_t *)(&(THM_BASE.instance[i])); ++ adev->reg_offset[CLK_HWIP][i] = (uint32_t *)(&(CLK_BASE.instance[i])); ++ } ++ return 0; ++} +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.h b/drivers/gpu/drm/amd/amdgpu/nv.h +index 83e9782aef39d..8f4817404f10d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.h ++++ b/drivers/gpu/drm/amd/amdgpu/nv.h +@@ -31,5 +31,6 @@ extern const struct amdgpu_ip_block_version nv_common_ip_block; + void nv_grbm_select(struct amdgpu_device *adev, + u32 me, u32 pipe, u32 queue, u32 vmid); + void nv_set_virt_ops(struct amdgpu_device *adev); ++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev); + + #endif +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch b/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch new file mode 100644 index 0000000000..96bff076b5 --- /dev/null +++ b/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch @@ -0,0 +1,62 @@ +From 2d7557b7689ccc9adb449189fb343b0dc9eb3c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 10:18:46 -0400 +Subject: drm/amdgpu: add support for cyan skillfish without IP discovery + +From: Alex Deucher + +[ Upstream commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 ] + +For platforms without an IP discovery table. + +Signed-off-by: Alex Deucher +Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 30 +++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index efe0058b48ca8..38c4ebc063db2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -2746,6 +2746,36 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 6, 0); + adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0); + break; ++ case CHIP_CYAN_SKILLFISH: ++ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2) { ++ r = amdgpu_discovery_reg_base_init(adev); ++ if (r) ++ return -EINVAL; ++ ++ amdgpu_discovery_harvest_ip(adev); ++ amdgpu_discovery_get_gfx_info(adev); ++ amdgpu_discovery_get_mall_info(adev); ++ amdgpu_discovery_get_vcn_info(adev); ++ } else { ++ cyan_skillfish_reg_base_init(adev); ++ adev->sdma.num_instances = 2; ++ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3); ++ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3); ++ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[HDP_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[SDMA0_HWIP][0] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[SDMA1_HWIP][1] = IP_VERSION(5, 0, 1); ++ adev->ip_versions[DF_HWIP][0] = IP_VERSION(3, 5, 0); ++ adev->ip_versions[NBIO_HWIP][0] = IP_VERSION(2, 1, 1); ++ adev->ip_versions[UMC_HWIP][0] = IP_VERSION(8, 1, 1); ++ adev->ip_versions[MP0_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[MP1_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[THM_HWIP][0] = IP_VERSION(11, 0, 1); ++ adev->ip_versions[SMUIO_HWIP][0] = IP_VERSION(11, 0, 8); ++ adev->ip_versions[GC_HWIP][0] = IP_VERSION(10, 1, 3); ++ adev->ip_versions[UVD_HWIP][0] = IP_VERSION(2, 0, 3); ++ } ++ break; + default: + r = amdgpu_discovery_reg_base_init(adev); + if (r) { +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-drop-unused-structures-in-amdgpu_drm.h.patch b/queue-6.17/drm-amdgpu-drop-unused-structures-in-amdgpu_drm.h.patch new file mode 100644 index 0000000000..ddc4020268 --- /dev/null +++ b/queue-6.17/drm-amdgpu-drop-unused-structures-in-amdgpu_drm.h.patch @@ -0,0 +1,56 @@ +From d6d229e32c73b1c60187c95434bfe0ef3d6a29b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:40:57 -0400 +Subject: drm/amdgpu: drop unused structures in amdgpu_drm.h + +From: Alex Deucher + +[ Upstream commit ef38b4eab146715bc68d45029257f5e69ea3f2cd ] + +These were never used and are duplicated with the +interface that is used. Maybe leftovers from a previous +revision of the patch that added them. + +Fixes: 90c448fef312 ("drm/amdgpu: add new AMDGPU_INFO subquery for userq objects") +Reviewed-by: Prike Liang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + include/uapi/drm/amdgpu_drm.h | 21 --------------------- + 1 file changed, 21 deletions(-) + +diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h +index bdedbaccf776d..0b3827cd6f4a3 100644 +--- a/include/uapi/drm/amdgpu_drm.h ++++ b/include/uapi/drm/amdgpu_drm.h +@@ -1497,27 +1497,6 @@ struct drm_amdgpu_info_hw_ip { + __u32 userq_num_slots; + }; + +-/* GFX metadata BO sizes and alignment info (in bytes) */ +-struct drm_amdgpu_info_uq_fw_areas_gfx { +- /* shadow area size */ +- __u32 shadow_size; +- /* shadow area base virtual mem alignment */ +- __u32 shadow_alignment; +- /* context save area size */ +- __u32 csa_size; +- /* context save area base virtual mem alignment */ +- __u32 csa_alignment; +-}; +- +-/* IP specific fw related information used in the +- * subquery AMDGPU_INFO_UQ_FW_AREAS +- */ +-struct drm_amdgpu_info_uq_fw_areas { +- union { +- struct drm_amdgpu_info_uq_fw_areas_gfx gfx; +- }; +-}; +- + struct drm_amdgpu_info_num_handles { + /** Max handles as supported by firmware for UVD */ + __u32 uvd_max_handles; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch b/queue-6.17/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch new file mode 100644 index 0000000000..3fb8dc0c18 --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch @@ -0,0 +1,116 @@ +From a148d9916d97e12cd10d1e36db7098f0f17f3484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 17:31:32 -0400 +Subject: drm/amdgpu: fix handling of harvesting for ip_discovery firmware + +From: Alex Deucher + +[ Upstream commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 ] + +Chips which use the IP discovery firmware loaded by the driver +reported incorrect harvesting information in the ip discovery +table in sysfs because the driver only uses the ip discovery +firmware for populating sysfs and not for direct parsing for the +driver itself as such, the fields that are used to print the +harvesting info in sysfs report incorrect data for some IPs. Populate +the relevant fields for this case as well. + +Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery") +Acked-by: Tom St Denis +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index 38c4ebc063db2..e814da2b14225 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -1033,7 +1033,9 @@ static uint8_t amdgpu_discovery_get_harvest_info(struct amdgpu_device *adev, + /* Until a uniform way is figured, get mask based on hwid */ + switch (hw_id) { + case VCN_HWID: +- harvest = ((1 << inst) & adev->vcn.inst_mask) == 0; ++ /* VCN vs UVD+VCE */ ++ if (!amdgpu_ip_version(adev, VCE_HWIP, 0)) ++ harvest = ((1 << inst) & adev->vcn.inst_mask) == 0; + break; + case DMU_HWID: + if (adev->harvest_ip_mask & AMD_HARVEST_IP_DMU_MASK) +@@ -2562,7 +2564,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 0, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 0, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 0); +@@ -2589,7 +2593,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 3, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 3, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 1); +@@ -2616,8 +2622,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega10_reg_base_init(adev); + adev->sdma.num_instances = 1; ++ adev->sdma.sdma_mask = 1; + adev->vcn.num_vcn_inst = 1; + adev->gmc.num_umc = 2; ++ adev->gfx.xcc_mask = 1; + if (adev->apu_flags & AMD_APU_IS_RAVEN2) { + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 2, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 2, 0); +@@ -2662,7 +2670,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + vega20_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; + adev->gmc.num_umc = 8; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 0); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 0); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 0); +@@ -2690,8 +2700,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + arct_reg_base_init(adev); + adev->sdma.num_instances = 8; ++ adev->sdma.sdma_mask = 0xff; + adev->vcn.num_vcn_inst = 2; + adev->gmc.num_umc = 8; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 1); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 1); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 1); +@@ -2723,8 +2735,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + amdgpu_discovery_init(adev); + aldebaran_reg_base_init(adev); + adev->sdma.num_instances = 5; ++ adev->sdma.sdma_mask = 0x1f; + adev->vcn.num_vcn_inst = 2; + adev->gmc.num_umc = 4; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 2); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 2); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 4, 0); +@@ -2759,6 +2773,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) + } else { + cyan_skillfish_reg_base_init(adev); + adev->sdma.num_instances = 2; ++ adev->sdma.sdma_mask = 3; ++ adev->gfx.xcc_mask = 1; + adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3); + adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3); + adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1); +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-handle-wrap-around-in-reemit-handling.patch b/queue-6.17/drm-amdgpu-handle-wrap-around-in-reemit-handling.patch new file mode 100644 index 0000000000..ea366a3943 --- /dev/null +++ b/queue-6.17/drm-amdgpu-handle-wrap-around-in-reemit-handling.patch @@ -0,0 +1,62 @@ +From 7729492571a4fb27da7663df270df132b9e169d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 12:37:32 -0400 +Subject: drm/amdgpu: handle wrap around in reemit handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit 1f22fcb88bfef26a966e9eb242c692c6bf253d47 ] + +Compare the sequence numbers directly. + +Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +index 9e7506965cab2..bb17af79c24a6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -791,14 +791,19 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring, + struct dma_fence *unprocessed; + struct dma_fence __rcu **ptr; + struct amdgpu_fence *fence; +- u64 wptr, i, seqno; ++ u64 wptr; ++ u32 seq, last_seq; + +- seqno = amdgpu_fence_read(ring); ++ last_seq = amdgpu_fence_read(ring) & ring->fence_drv.num_fences_mask; ++ seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask; + wptr = ring->fence_drv.signalled_wptr; + ring->ring_backup_entries_to_copy = 0; + +- for (i = seqno + 1; i <= ring->fence_drv.sync_seq; ++i) { +- ptr = &ring->fence_drv.fences[i & ring->fence_drv.num_fences_mask]; ++ do { ++ last_seq++; ++ last_seq &= ring->fence_drv.num_fences_mask; ++ ++ ptr = &ring->fence_drv.fences[last_seq]; + rcu_read_lock(); + unprocessed = rcu_dereference(*ptr); + +@@ -814,7 +819,7 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring, + wptr = fence->wptr; + } + rcu_read_unlock(); +- } ++ } while (last_seq != seq); + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-set-an-error-on-all-fences-from-a-bad-con.patch b/queue-6.17/drm-amdgpu-set-an-error-on-all-fences-from-a-bad-con.patch new file mode 100644 index 0000000000..15a940da27 --- /dev/null +++ b/queue-6.17/drm-amdgpu-set-an-error-on-all-fences-from-a-bad-con.patch @@ -0,0 +1,111 @@ +From 0a9ddb5368c1c21aff72143c1ee8329f822f9971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 13:48:23 -0400 +Subject: drm/amdgpu: set an error on all fences from a bad context +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit ff780f4f80323148d43198f2052c14160c8428d3 ] + +When we backup ring contents to reemit after a queue reset, +we don't backup ring contents from the bad context. When +we signal the fences, we should set an error on those +fences as well. + +v2: misc cleanups +v3: add locking for fence error, fix comment (Christian) +v4: fix wrap around, locking (Christian) + +Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 39 ++++++++++++++++++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 2 +- + 3 files changed, 37 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +index bb17af79c24a6..9f79f0cc5ff83 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -759,11 +759,42 @@ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring) + * @fence: fence of the ring to signal + * + */ +-void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *fence) ++void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af) + { +- dma_fence_set_error(&fence->base, -ETIME); +- amdgpu_fence_write(fence->ring, fence->seq); +- amdgpu_fence_process(fence->ring); ++ struct dma_fence *unprocessed; ++ struct dma_fence __rcu **ptr; ++ struct amdgpu_fence *fence; ++ struct amdgpu_ring *ring = af->ring; ++ unsigned long flags; ++ u32 seq, last_seq; ++ ++ last_seq = amdgpu_fence_read(ring) & ring->fence_drv.num_fences_mask; ++ seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask; ++ ++ /* mark all fences from the guilty context with an error */ ++ spin_lock_irqsave(&ring->fence_drv.lock, flags); ++ do { ++ last_seq++; ++ last_seq &= ring->fence_drv.num_fences_mask; ++ ++ ptr = &ring->fence_drv.fences[last_seq]; ++ rcu_read_lock(); ++ unprocessed = rcu_dereference(*ptr); ++ ++ if (unprocessed && !dma_fence_is_signaled_locked(unprocessed)) { ++ fence = container_of(unprocessed, struct amdgpu_fence, base); ++ ++ if (fence == af) ++ dma_fence_set_error(&fence->base, -ETIME); ++ else if (fence->context == af->context) ++ dma_fence_set_error(&fence->base, -ECANCELED); ++ } ++ rcu_read_unlock(); ++ } while (last_seq != seq); ++ spin_unlock_irqrestore(&ring->fence_drv.lock, flags); ++ /* signal the guilty fence */ ++ amdgpu_fence_write(ring, af->seq); ++ amdgpu_fence_process(ring); + } + + void amdgpu_fence_save_wptr(struct dma_fence *fence) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index 8f6ce948c6841..5ec5c3ff22bb0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -811,7 +811,7 @@ int amdgpu_ring_reset_helper_end(struct amdgpu_ring *ring, + if (r) + return r; + +- /* signal the fence of the bad job */ ++ /* signal the guilty fence and set an error on all fences from the context */ + if (guilty_fence) + amdgpu_fence_driver_guilty_force_completion(guilty_fence); + /* Re-emit the non-guilty commands */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +index 12783ea3ba0f1..869b486168f3e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +@@ -155,7 +155,7 @@ extern const struct drm_sched_backend_ops amdgpu_sched_ops; + void amdgpu_fence_driver_clear_job_fences(struct amdgpu_ring *ring); + void amdgpu_fence_driver_set_error(struct amdgpu_ring *ring, int error); + void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring); +-void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *fence); ++void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af); + void amdgpu_fence_save_wptr(struct dma_fence *fence); + + int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring); +-- +2.51.0 + diff --git a/queue-6.17/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch b/queue-6.17/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch new file mode 100644 index 0000000000..bb0e0e7a6d --- /dev/null +++ b/queue-6.17/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch @@ -0,0 +1,45 @@ +From 747de3eb7db28c802dce609cf22807d5fb22b7d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 12:59:53 +0200 +Subject: drm/bridge: lt9211: Drop check for last nibble of version register + +From: Marek Vasut + +[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ] + +There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . +The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the +driver checks for right now. Since there is a possibility there will be +yet another revision of the LT9211 in the future, drop the last version +nibble check to allow all future revisions of the chip to work with this +driver. + +This fix makes LT9211 rev. U5 work with this driver. + +Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c +index 399fa7eebd49c..03fc8fd10f20a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9211.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c +@@ -121,8 +121,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) + } + + /* Test for known Chip ID. */ +- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE || +- chipid[2] != REG_CHIPID2_VALUE) { ++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) { + dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n", + chipid[0], chipid[1], chipid[2]); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch b/queue-6.17/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch new file mode 100644 index 0000000000..c8d50a7b74 --- /dev/null +++ b/queue-6.17/drm-draw-fix-color-truncation-in-drm_draw_fill24.patch @@ -0,0 +1,54 @@ +From 32b03fee8e393ab24baafb2bd3b891a96d495dd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 12:33:03 +0200 +Subject: drm/draw: fix color truncation in drm_draw_fill24 + +From: Francesco Valla + +[ Upstream commit 095232711f23179053ca26bcf046ca121a91a465 ] + +The color parameter passed to drm_draw_fill24() was truncated to 16 +bits, leading to an incorrect color drawn to the target iosys_map. +Fix this behavior, widening the parameter to 32 bits. + +Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw") + +Signed-off-by: Francesco Valla +Reviewed-by: Jocelyn Falempe +Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it +Signed-off-by: Jocelyn Falempe +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_draw.c | 2 +- + drivers/gpu/drm/drm_draw_internal.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_draw.c b/drivers/gpu/drm/drm_draw.c +index 9dc0408fbbead..5b956229c82fb 100644 +--- a/drivers/gpu/drm/drm_draw.c ++++ b/drivers/gpu/drm/drm_draw.c +@@ -127,7 +127,7 @@ EXPORT_SYMBOL(drm_draw_fill16); + + void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +- u16 color) ++ u32 color) + { + unsigned int y, x; + +diff --git a/drivers/gpu/drm/drm_draw_internal.h b/drivers/gpu/drm/drm_draw_internal.h +index f121ee7339dc1..20cb404e23ea6 100644 +--- a/drivers/gpu/drm/drm_draw_internal.h ++++ b/drivers/gpu/drm/drm_draw_internal.h +@@ -47,7 +47,7 @@ void drm_draw_fill16(struct iosys_map *dmap, unsigned int dpitch, + + void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +- u16 color); ++ u32 color); + + void drm_draw_fill32(struct iosys_map *dmap, unsigned int dpitch, + unsigned int height, unsigned int width, +-- +2.51.0 + diff --git a/queue-6.17/drm-i915-fb-fix-the-set_tiling-vs.-addfb-race-again.patch b/queue-6.17/drm-i915-fb-fix-the-set_tiling-vs.-addfb-race-again.patch new file mode 100644 index 0000000000..7791c9c62f --- /dev/null +++ b/queue-6.17/drm-i915-fb-fix-the-set_tiling-vs.-addfb-race-again.patch @@ -0,0 +1,156 @@ +From 8495e8cd8a1e4f841cc2bb93eea77cd76b5f7af0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 17:57:31 +0300 +Subject: drm/i915/fb: Fix the set_tiling vs. addfb race, again +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 86af6b90e0556fcefbc6e98eb78bdce90327ee76 ] + +intel_frontbuffer_get() is what locks out subsequent set_tiling +changes to the bo. Thus the fence vs. modifier check must be done +after intel_frontbuffer_get(), or else a concurrent set_tiling ioctl +might sneak in and change the fence after the check has been done. + +Close the race again. See commit dd689287b977 ("drm/i915: Prevent +concurrent tiling/framebuffer modifications") for the previous +instance. + +v2: Reorder intel_user_framebuffer_destroy() to match the unwind (Jani) + +Cc: Jouni Högander +Reviewed-by: Jani Nikula +Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-3-ville.syrjala@linux.intel.com +(cherry picked from commit 1d1e4ded216017f8febd91332ee337f0e0e79285) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_fb.c | 38 +++++++++++++------------ + 1 file changed, 20 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c +index 0da842bd2f2f1..974e5b547d886 100644 +--- a/drivers/gpu/drm/i915/display/intel_fb.c ++++ b/drivers/gpu/drm/i915/display/intel_fb.c +@@ -2111,10 +2111,10 @@ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb) + if (intel_fb_uses_dpt(fb)) + intel_dpt_destroy(intel_fb->dpt_vm); + +- intel_frontbuffer_put(intel_fb->frontbuffer); +- + intel_fb_bo_framebuffer_fini(intel_fb_bo(fb)); + ++ intel_frontbuffer_put(intel_fb->frontbuffer); ++ + kfree(intel_fb); + } + +@@ -2216,15 +2216,17 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + int ret = -EINVAL; + int i; + ++ /* ++ * intel_frontbuffer_get() must be done before ++ * intel_fb_bo_framebuffer_init() to avoid set_tiling vs. addfb race. ++ */ ++ intel_fb->frontbuffer = intel_frontbuffer_get(obj); ++ if (!intel_fb->frontbuffer) ++ return -ENOMEM; ++ + ret = intel_fb_bo_framebuffer_init(fb, obj, mode_cmd); + if (ret) +- return ret; +- +- intel_fb->frontbuffer = intel_frontbuffer_get(obj); +- if (!intel_fb->frontbuffer) { +- ret = -ENOMEM; +- goto err; +- } ++ goto err_frontbuffer_put; + + ret = -EINVAL; + if (!drm_any_plane_has_format(display->drm, +@@ -2233,7 +2235,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + drm_dbg_kms(display->drm, + "unsupported pixel format %p4cc / modifier 0x%llx\n", + &mode_cmd->pixel_format, mode_cmd->modifier[0]); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + + max_stride = intel_fb_max_stride(display, mode_cmd->pixel_format, +@@ -2244,7 +2246,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + mode_cmd->modifier[0] != DRM_FORMAT_MOD_LINEAR ? + "tiled" : "linear", + mode_cmd->pitches[0], max_stride); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + + /* FIXME need to adjust LINOFF/TILEOFF accordingly. */ +@@ -2252,7 +2254,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + drm_dbg_kms(display->drm, + "plane 0 offset (0x%08x) must be 0\n", + mode_cmd->offsets[0]); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + + drm_helper_mode_fill_fb_struct(display->drm, fb, info, mode_cmd); +@@ -2262,7 +2264,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + + if (mode_cmd->handles[i] != mode_cmd->handles[0]) { + drm_dbg_kms(display->drm, "bad plane %d handle\n", i); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + + stride_alignment = intel_fb_stride_alignment(fb, i); +@@ -2270,7 +2272,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + drm_dbg_kms(display->drm, + "plane %d pitch (%d) must be at least %u byte aligned\n", + i, fb->pitches[i], stride_alignment); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + + if (intel_fb_is_gen12_ccs_aux_plane(fb, i)) { +@@ -2280,7 +2282,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + drm_dbg_kms(display->drm, + "ccs aux plane %d pitch (%d) must be %d\n", + i, fb->pitches[i], ccs_aux_stride); +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + } + } + +@@ -2289,7 +2291,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + + ret = intel_fill_fb_info(display, intel_fb); + if (ret) +- goto err_frontbuffer_put; ++ goto err_bo_framebuffer_fini; + + if (intel_fb_uses_dpt(fb)) { + struct i915_address_space *vm; +@@ -2315,10 +2317,10 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + err_free_dpt: + if (intel_fb_uses_dpt(fb)) + intel_dpt_destroy(intel_fb->dpt_vm); ++err_bo_framebuffer_fini: ++ intel_fb_bo_framebuffer_fini(obj); + err_frontbuffer_put: + intel_frontbuffer_put(intel_fb->frontbuffer); +-err: +- intel_fb_bo_framebuffer_fini(obj); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-i915-frontbuffer-move-bo-refcounting-intel_front.patch b/queue-6.17/drm-i915-frontbuffer-move-bo-refcounting-intel_front.patch new file mode 100644 index 0000000000..68352e896f --- /dev/null +++ b/queue-6.17/drm-i915-frontbuffer-move-bo-refcounting-intel_front.patch @@ -0,0 +1,96 @@ +From 5a937ed6189ca94457e3597f791b9b059b8d35f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 17:57:30 +0300 +Subject: drm/i915/frontbuffer: Move bo refcounting + intel_frontbuffer_{get,release}() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 760039c95c78490c5c66ef584fcd536797ed6a2f ] + +Currently xe's intel_frontbuffer implementation forgets to +hold a reference on the bo. This makes the entire thing +extremely fragile as the cleanup order now depends on bo +references held by other things +(namely intel_fb_bo_framebuffer_fini()). + +Move the bo refcounting to intel_frontbuffer_{get,release}() +so that both i915 and xe do this the same way. + +I first tried to fix this by having xe do the refcounting +from its intel_bo_set_frontbuffer() implementation +(which is what i915 does currently), but turns out xe's +drm_gem_object_free() can sleep and thus drm_gem_object_put() +isn't safe to call while we hold fb_tracking.lock. + +Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-2-ville.syrjala@linux.intel.com +Reviewed-by: Jani Nikula +(cherry picked from commit eb4d490729a5fd8dc5a76d334f8d01fec7c14bbe) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_frontbuffer.c | 10 +++++++++- + drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 2 -- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_frontbuffer.c b/drivers/gpu/drm/i915/display/intel_frontbuffer.c +index 43be5377ddc1a..73ed28ac95734 100644 +--- a/drivers/gpu/drm/i915/display/intel_frontbuffer.c ++++ b/drivers/gpu/drm/i915/display/intel_frontbuffer.c +@@ -270,6 +270,8 @@ static void frontbuffer_release(struct kref *ref) + spin_unlock(&display->fb_tracking.lock); + + i915_active_fini(&front->write); ++ ++ drm_gem_object_put(obj); + kfree_rcu(front, rcu); + } + +@@ -287,6 +289,8 @@ intel_frontbuffer_get(struct drm_gem_object *obj) + if (!front) + return NULL; + ++ drm_gem_object_get(obj); ++ + front->obj = obj; + kref_init(&front->ref); + atomic_set(&front->bits, 0); +@@ -299,8 +303,12 @@ intel_frontbuffer_get(struct drm_gem_object *obj) + spin_lock(&display->fb_tracking.lock); + cur = intel_bo_set_frontbuffer(obj, front); + spin_unlock(&display->fb_tracking.lock); +- if (cur != front) ++ ++ if (cur != front) { ++ drm_gem_object_put(obj); + kfree(front); ++ } ++ + return cur; + } + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h +index b6dc3d1b9bb13..b682969e3a293 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h +@@ -89,12 +89,10 @@ i915_gem_object_set_frontbuffer(struct drm_i915_gem_object *obj, + + if (!front) { + RCU_INIT_POINTER(obj->frontbuffer, NULL); +- drm_gem_object_put(intel_bo_to_drm_bo(obj)); + } else if (rcu_access_pointer(obj->frontbuffer)) { + cur = rcu_dereference_protected(obj->frontbuffer, true); + kref_get(&cur->ref); + } else { +- drm_gem_object_get(intel_bo_to_drm_bo(obj)); + rcu_assign_pointer(obj->frontbuffer, front); + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-i915-guc-skip-communication-warning-on-reset-in-.patch b/queue-6.17/drm-i915-guc-skip-communication-warning-on-reset-in-.patch new file mode 100644 index 0000000000..98099c304a --- /dev/null +++ b/queue-6.17/drm-i915-guc-skip-communication-warning-on-reset-in-.patch @@ -0,0 +1,52 @@ +From 9d3e6431110fb0aeadd78749c3c050b30d753678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:29:04 -0400 +Subject: drm/i915/guc: Skip communication warning on reset in progress + +From: Zhanjun Dong + +[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ] + +GuC IRQ and tasklet handler receive just single G2H message, and let other +messages to be received from next tasklet. During this chained tasklet +process, if reset process started, communication will be disabled. +Skip warning for this condition. + +Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018 +Signed-off-by: Zhanjun Dong +Reviewed-by: Vinay Belgaumkar +Signed-off-by: Daniele Ceraolo Spurio +Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com +(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +index 0d5197c0824a9..5cf3a516ccfb3 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +@@ -1324,9 +1324,16 @@ static int ct_receive(struct intel_guc_ct *ct) + + static void ct_try_receive_message(struct intel_guc_ct *ct) + { ++ struct intel_guc *guc = ct_to_guc(ct); + int ret; + +- if (GEM_WARN_ON(!ct->enabled)) ++ if (!ct->enabled) { ++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress); ++ return; ++ } ++ ++ /* When interrupt disabled, message handling is not expected */ ++ if (!guc->interrupts.enabled) + return; + + ret = ct_receive(ct); +-- +2.51.0 + diff --git a/queue-6.17/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch b/queue-6.17/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch new file mode 100644 index 0000000000..f11e4b433d --- /dev/null +++ b/queue-6.17/drm-panthor-ensure-mcu-is-disabled-on-suspend.patch @@ -0,0 +1,49 @@ +From 5acbf0c634d4ad2aa8839ae94a0e3e47a54e77ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 12:51:11 +0200 +Subject: drm/panthor: Ensure MCU is disabled on suspend + +From: Ketil Johnsen + +[ Upstream commit e07e10ae83bdf429f59c8c149173a8c4f29c481e ] + +Currently the Panthor driver needs the GPU to be powered down +between suspend and resume. If this is not done, then the +MCU_CONTROL register will be preserved as AUTO, which again will +cause a premature FW boot on resume. The FW will go directly into +fatal state in this case. + +This case needs to be handled as there is no guarantee that the +GPU will be powered down after the suspend callback on all platforms. + +The fix is to call panthor_fw_stop() in "pre-reset" path to ensure +the MCU_CONTROL register is cleared (set DISABLE). This matches +well with the already existing call to panthor_fw_start() from the +"post-reset" path. + +Signed-off-by: Ketil Johnsen +Acked-by: Boris Brezillon +Reviewed-by: Steven Price +Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") +Signed-off-by: Steven Price +Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_fw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c +index 36f1034839c27..44a9958351889 100644 +--- a/drivers/gpu/drm/panthor/panthor_fw.c ++++ b/drivers/gpu/drm/panthor/panthor_fw.c +@@ -1099,6 +1099,7 @@ void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang) + } + + panthor_job_irq_suspend(&ptdev->fw->irq); ++ panthor_fw_stop(ptdev); + } + + /** +-- +2.51.0 + diff --git a/queue-6.17/drm-rockchip-vop2-use-correct-destination-rectangle-.patch b/queue-6.17/drm-rockchip-vop2-use-correct-destination-rectangle-.patch new file mode 100644 index 0000000000..f895a9451e --- /dev/null +++ b/queue-6.17/drm-rockchip-vop2-use-correct-destination-rectangle-.patch @@ -0,0 +1,40 @@ +From 656c1b8462024bfde8592f120ee3ba9e4a540c9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 07:20:01 -0700 +Subject: drm/rockchip: vop2: use correct destination rectangle height check + +From: Alok Tiwari + +[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ] + +The vop2_plane_atomic_check() function incorrectly checks +drm_rect_width(dest) twice instead of verifying both width and height. +Fix the second condition to use drm_rect_height(dest) so that invalid +destination rectangles with height < 4 are correctly rejected. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Alok Tiwari +Reviewed-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index b50927a824b40..7ec7bea5e38e6 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -1031,7 +1031,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane, + return format; + + if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 || +- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) { ++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) { + drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n", + drm_rect_width(src) >> 16, drm_rect_height(src) >> 16, + drm_rect_width(dest), drm_rect_height(dest)); +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-enable-media-sampler-power-gating.patch b/queue-6.17/drm-xe-enable-media-sampler-power-gating.patch new file mode 100644 index 0000000000..f3d2e94837 --- /dev/null +++ b/queue-6.17/drm-xe-enable-media-sampler-power-gating.patch @@ -0,0 +1,74 @@ +From 17e8a732b018fdd0e66107caaa8e6d932f31194f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 18:10:47 -0700 +Subject: drm/xe: Enable media sampler power gating + +From: Vinay Belgaumkar + +[ Upstream commit 1852d27aa998272696680607b65a2ceac966104e ] + +Where applicable, enable media sampler power gating. Also, add +it to the powergate_info debugfs. + +v2: Remove the sampler powergate status since it is cleared quickly anyway. +v3: Use vcs mask (Rodrigo) and fix the version check for media +v4: Remove extra spaces +v5: Media samplers are independent of vcs mask, + use Media version 1255 (Matt Roper) + +Fixes: 38e8c4184ea0 ("drm/xe: Enable Coarse Power Gating") +Cc: Rodrigo Vivi +Cc: Matt Roper +Reviewed-by: Rodrigo Vivi +Signed-off-by: Vinay Belgaumkar +Link: https://lore.kernel.org/r/20251010011047.2047584-1-vinay.belgaumkar@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit 4cbc08649a54c3d533df9832342d52d409dfbbf0) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + + drivers/gpu/drm/xe/xe_gt_idle.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/xe/regs/xe_gt_regs.h b/drivers/gpu/drm/xe/regs/xe_gt_regs.h +index 5cd5ab8529c5c..9994887fc73f9 100644 +--- a/drivers/gpu/drm/xe/regs/xe_gt_regs.h ++++ b/drivers/gpu/drm/xe/regs/xe_gt_regs.h +@@ -342,6 +342,7 @@ + #define POWERGATE_ENABLE XE_REG(0xa210) + #define RENDER_POWERGATE_ENABLE REG_BIT(0) + #define MEDIA_POWERGATE_ENABLE REG_BIT(1) ++#define MEDIA_SAMPLERS_POWERGATE_ENABLE REG_BIT(2) + #define VDN_HCP_POWERGATE_ENABLE(n) REG_BIT(3 + 2 * (n)) + #define VDN_MFXVDENC_POWERGATE_ENABLE(n) REG_BIT(4 + 2 * (n)) + +diff --git a/drivers/gpu/drm/xe/xe_gt_idle.c b/drivers/gpu/drm/xe/xe_gt_idle.c +index ffb210216aa99..9bd197da60279 100644 +--- a/drivers/gpu/drm/xe/xe_gt_idle.c ++++ b/drivers/gpu/drm/xe/xe_gt_idle.c +@@ -124,6 +124,9 @@ void xe_gt_idle_enable_pg(struct xe_gt *gt) + if (xe_gt_is_main_type(gt)) + gtidle->powergate_enable |= RENDER_POWERGATE_ENABLE; + ++ if (MEDIA_VERx100(xe) >= 1100 && MEDIA_VERx100(xe) < 1255) ++ gtidle->powergate_enable |= MEDIA_SAMPLERS_POWERGATE_ENABLE; ++ + if (xe->info.platform != XE_DG1) { + for (i = XE_HW_ENGINE_VCS0, j = 0; i <= XE_HW_ENGINE_VCS7; ++i, ++j) { + if ((gt->info.engine_mask & BIT(i))) +@@ -246,6 +249,11 @@ int xe_gt_idle_pg_print(struct xe_gt *gt, struct drm_printer *p) + drm_printf(p, "Media Slice%d Power Gate Status: %s\n", n, + str_up_down(pg_status & media_slices[n].status_bit)); + } ++ ++ if (MEDIA_VERx100(xe) >= 1100 && MEDIA_VERx100(xe) < 1255) ++ drm_printf(p, "Media Samplers Power Gating Enabled: %s\n", ++ str_yes_no(pg_enabled & MEDIA_SAMPLERS_POWERGATE_ENABLE)); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-xe-evict-drop-bogus-assert.patch b/queue-6.17/drm-xe-evict-drop-bogus-assert.patch new file mode 100644 index 0000000000..2456503129 --- /dev/null +++ b/queue-6.17/drm-xe-evict-drop-bogus-assert.patch @@ -0,0 +1,62 @@ +From 27fab65ad9a317e83a084a38121dec2bcf2f9296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:24:58 +0100 +Subject: drm/xe/evict: drop bogus assert +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +[ Upstream commit 225bc03d85427e7e3821d6f99f4f2d4a09350dda ] + +This assert can trigger here with non pin_map users that select +LATE_RESTORE, since the vmap is allowed to be NULL given that +save/restore can now use the blitter instead. The check here doesn't +seem to have much value anymore given that we no longer move pinned +memory, so any existing vmap is left well alone, and doesn't need to be +recreated upon restore, so just drop the assert here. + +Fixes: 86f69c26113c ("drm/xe: use backup object for pinned save/restore") +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6213 +Signed-off-by: Matthew Auld +Cc: Thomas Hellström +Cc: Matthew Brost +Reviewed-by: Thomas Hellström +Link: https://lore.kernel.org/r/20251010152457.177884-2-matthew.auld@intel.com +(cherry picked from commit a10b4a69c7f8f596d2c5218fbe84430734fab3b2) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_bo_evict.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c +index d5dbc51e8612d..bc5b4c5fab812 100644 +--- a/drivers/gpu/drm/xe/xe_bo_evict.c ++++ b/drivers/gpu/drm/xe/xe_bo_evict.c +@@ -182,7 +182,6 @@ int xe_bo_evict_all(struct xe_device *xe) + + static int xe_bo_restore_and_map_ggtt(struct xe_bo *bo) + { +- struct xe_device *xe = xe_bo_device(bo); + int ret; + + ret = xe_bo_restore_pinned(bo); +@@ -201,13 +200,6 @@ static int xe_bo_restore_and_map_ggtt(struct xe_bo *bo) + } + } + +- /* +- * We expect validate to trigger a move VRAM and our move code +- * should setup the iosys map. +- */ +- xe_assert(xe, !(bo->flags & XE_BO_FLAG_PINNED_LATE_RESTORE) || +- !iosys_map_is_null(&bo->vmap)); +- + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/hid-hid-input-only-ignore-0-battery-events-for-digit.patch b/queue-6.17/hid-hid-input-only-ignore-0-battery-events-for-digit.patch new file mode 100644 index 0000000000..3e74282103 --- /dev/null +++ b/queue-6.17/hid-hid-input-only-ignore-0-battery-events-for-digit.patch @@ -0,0 +1,53 @@ +From ca91d6619f068b851ea160213f9825fb59bf27b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 21:28:44 -0700 +Subject: HID: hid-input: only ignore 0 battery events for digitizers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ] + +Commit 581c4484769e ("HID: input: map digitizer battery usage") added +handling of battery events for digitizers (typically for batteries +presented in stylii). Digitizers typically report correct battery levels +only when stylus is actively touching the surface, and in other cases +they may report battery level of 0. To avoid confusing consumers of the +battery information the code was added to filer out reports with 0 +battery levels. + +However there exist other kinds of devices that may legitimately report +0 battery levels. Fix this by filtering out 0-level reports only for +digitizer usages, and continue reporting them for other kinds of devices +(Smart Batteries, etc). + +Reported-by: 卢国宏 +Fixes: 581c4484769e ("HID: input: map digitizer battery usage") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f45f856a127fe..2c743e35c1d33 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, + return; + } + +- if (value == 0 || value < dev->battery_min || value > dev->battery_max) ++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0) ++ return; ++ ++ if (value < dev->battery_min || value > dev->battery_max) + return; + + capacity = hidinput_scale_battery_capacity(dev, value); +-- +2.51.0 + diff --git a/queue-6.17/hid-intel-thc-hid-intel-quickspi-switch-first-interr.patch b/queue-6.17/hid-intel-thc-hid-intel-quickspi-switch-first-interr.patch new file mode 100644 index 0000000000..4e58aee792 --- /dev/null +++ b/queue-6.17/hid-intel-thc-hid-intel-quickspi-switch-first-interr.patch @@ -0,0 +1,51 @@ +From 57c902699cc3e7cd08ef6e05dfcc8e8f3906b081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:09:39 +0800 +Subject: HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level + to edge detection + +From: Even Xu + +[ Upstream commit 8fe2cd8ec84b3592b57f40b080f9d5aeebd553af ] + +The original implementation used level detection for the first interrupt +after device reset to avoid potential interrupt line noise and missed +interrupts during the initialization phase. However, this approach +introduced unintended side effects when tested with certain touch panels, +including: + - Delayed hardware interrupt response + - Multiple spurious interrupt triggers + +Switching back to edge detection for the first interrupt resolves these +issues while maintaining reliable interrupt handling. + +Extensive testing across multiple platforms with touch panels from +various vendors confirms this change introduces no regressions. + +[jkosina@suse.com: properly capitalize shortlog] +Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation") +Tested-by: Rui Zhang +Signed-off-by: Even Xu +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c +index e6ba2ddcc9cbc..16f780bc879b1 100644 +--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c ++++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c +@@ -280,8 +280,7 @@ int reset_tic(struct quickspi_device *qsdev) + + qsdev->reset_ack = false; + +- /* First interrupt uses level trigger to avoid missing interrupt */ +- thc_int_trigger_type_select(qsdev->thc_hw, false); ++ thc_int_trigger_type_select(qsdev->thc_hw, true); + + ret = acpi_tic_reset(qsdev); + if (ret) +-- +2.51.0 + diff --git a/queue-6.17/hid-multitouch-fix-name-of-stylus-input-devices.patch b/queue-6.17/hid-multitouch-fix-name-of-stylus-input-devices.patch new file mode 100644 index 0000000000..81755015fb --- /dev/null +++ b/queue-6.17/hid-multitouch-fix-name-of-stylus-input-devices.patch @@ -0,0 +1,51 @@ +From 2d105452cdc0fd2694a021533d27b3127fbb8bb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 09:40:33 -0300 +Subject: HID: multitouch: fix name of Stylus input devices + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ] + +HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by +commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). +However, on multitouch devices, these suffixes may be overridden. Before +that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after +that, multitouch would override them to have an "UNKNOWN" suffix. Just add +HID_DG_PEN to the list of non-overriden suffixes in multitouch. + +Before this fix: + +[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 +ELAN9008:00 04F3:2E14 UNKNOWN + +After this fix: + +[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 + +ELAN9008:00 04F3:2E14 Stylus + +Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Mika Westerberg +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 7587a7748a82d..a9ff84f0bd9bb 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1711,6 +1711,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + case HID_CP_CONSUMER_CONTROL: + case HID_GD_WIRELESS_RADIO_CTLS: + case HID_GD_SYSTEM_MULTIAXIS: ++ case HID_DG_PEN: + /* already handled by hid core */ + break; + case HID_DG_TOUCHSCREEN: +-- +2.51.0 + diff --git a/queue-6.17/idpf-cleanup-remaining-skbs-in-ptp-flows.patch b/queue-6.17/idpf-cleanup-remaining-skbs-in-ptp-flows.patch new file mode 100644 index 0000000000..2c182f1e82 --- /dev/null +++ b/queue-6.17/idpf-cleanup-remaining-skbs-in-ptp-flows.patch @@ -0,0 +1,62 @@ +From 2ba7fd6f17b849b99cdf2e2093d95b259e24f10d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 17:03:46 -0700 +Subject: idpf: cleanup remaining SKBs in PTP flows + +From: Milena Olech + +[ Upstream commit a3f8c0a273120fd2638f03403e786c3de2382e72 ] + +When the driver requests Tx timestamp value, one of the first steps is +to clone SKB using skb_get. It increases the reference counter for that +SKB to prevent unexpected freeing by another component. +However, there may be a case where the index is requested, SKB is +assigned and never consumed by PTP flows - for example due to reset during +running PTP apps. + +Add a check in release timestamping function to verify if the SKB +assigned to Tx timestamp latch was freed, and release remaining SKBs. + +Fixes: 4901e83a94ef ("idpf: add Tx timestamp capabilities negotiation") +Signed-off-by: Milena Olech +Signed-off-by: Anton Nadezhdin +Reviewed-by: Aleksandr Loktionov +Tested-by: Samuel Salin +Signed-off-by: Jacob Keller +Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-1-ef32a425b92a@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_ptp.c | 3 +++ + drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_ptp.c +index ee21f2ff0cad9..63a41e688733b 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_ptp.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_ptp.c +@@ -855,6 +855,9 @@ static void idpf_ptp_release_vport_tstamp(struct idpf_vport *vport) + head = &vport->tx_tstamp_caps->latches_in_use; + list_for_each_entry_safe(ptp_tx_tstamp, tmp, head, list_member) { + list_del(&ptp_tx_tstamp->list_member); ++ if (ptp_tx_tstamp->skb) ++ consume_skb(ptp_tx_tstamp->skb); ++ + kfree(ptp_tx_tstamp); + } + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c +index 4f1fb0cefe516..688a6f4e0acc8 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c +@@ -517,6 +517,7 @@ idpf_ptp_get_tstamp_value(struct idpf_vport *vport, + shhwtstamps.hwtstamp = ns_to_ktime(tstamp); + skb_tstamp_tx(ptp_tx_tstamp->skb, &shhwtstamps); + consume_skb(ptp_tx_tstamp->skb); ++ ptp_tx_tstamp->skb = NULL; + + list_add(&ptp_tx_tstamp->list_member, + &tx_tstamp_caps->latches_free); +-- +2.51.0 + diff --git a/queue-6.17/ixgbe-fix-too-early-devlink_free-in-ixgbe_remove.patch b/queue-6.17/ixgbe-fix-too-early-devlink_free-in-ixgbe_remove.patch new file mode 100644 index 0000000000..efcc7dce4a --- /dev/null +++ b/queue-6.17/ixgbe-fix-too-early-devlink_free-in-ixgbe_remove.patch @@ -0,0 +1,86 @@ +From fb942643fc1d063b5868760f377b586d0d427493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 17:03:51 -0700 +Subject: ixgbe: fix too early devlink_free() in ixgbe_remove() + +From: Koichiro Den + +[ Upstream commit 5feef67b646d8f5064bac288e22204ffba2b9a4a ] + +Since ixgbe_adapter is embedded in devlink, calling devlink_free() +prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() +to the end. + +KASAN report: + + BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] + Read of size 8 at addr ffff0000adf813e0 by task bash/2095 + CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) + [...] + Call trace: + show_stack+0x30/0x90 (C) + dump_stack_lvl+0x9c/0xd0 + print_address_description.constprop.0+0x90/0x310 + print_report+0x104/0x1f0 + kasan_report+0x88/0x180 + __asan_report_load8_noabort+0x20/0x30 + ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] + ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] + ixgbe_remove+0x2d0/0x8c0 [ixgbe] + pci_device_remove+0xa0/0x220 + device_remove+0xb8/0x170 + device_release_driver_internal+0x318/0x490 + device_driver_detach+0x40/0x68 + unbind_store+0xec/0x118 + drv_attr_store+0x64/0xb8 + sysfs_kf_write+0xcc/0x138 + kernfs_fop_write_iter+0x294/0x440 + new_sync_write+0x1fc/0x588 + vfs_write+0x480/0x6a0 + ksys_write+0xf0/0x1e0 + __arm64_sys_write+0x70/0xc0 + invoke_syscall.constprop.0+0xcc/0x280 + el0_svc_common.constprop.0+0xa8/0x248 + do_el0_svc+0x44/0x68 + el0_svc+0x54/0x160 + el0t_64_sync_handler+0xa0/0xe8 + el0t_64_sync+0x1b0/0x1b8 + +Fixes: a0285236ab93 ("ixgbe: add initial devlink support") +Signed-off-by: Koichiro Den +Tested-by: Rinitha S +Reviewed-by: Jedrzej Jagielski +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Paul Menzel +Signed-off-by: Jacob Keller +Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-6-ef32a425b92a@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 6218bdb7f941f..86b9caece1042 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -12091,7 +12091,6 @@ static void ixgbe_remove(struct pci_dev *pdev) + + devl_port_unregister(&adapter->devlink_port); + devl_unlock(adapter->devlink); +- devlink_free(adapter->devlink); + + ixgbe_stop_ipsec_offload(adapter); + ixgbe_clear_interrupt_scheme(adapter); +@@ -12127,6 +12126,8 @@ static void ixgbe_remove(struct pci_dev *pdev) + + if (disable_dev) + pci_disable_device(pdev); ++ ++ devlink_free(adapter->devlink); + } + + /** +-- +2.51.0 + diff --git a/queue-6.17/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch b/queue-6.17/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch new file mode 100644 index 0000000000..647e1b5c18 --- /dev/null +++ b/queue-6.17/ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch @@ -0,0 +1,163 @@ +From 3718a923a04fbfa98eb12729fed6be4bb7ae3c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 09:25:46 +0200 +Subject: ksmbd: fix recursive locking in RPC handle list access + +From: Marios Makassikis + +[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ] + +Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list +access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. + +This causes hung connections / tasks when a client attempts to open +a named pipe. Using Samba's rpcclient tool: + + $ rpcclient //192.168.1.254 -U user%password + $ rpcclient $> srvinfo + + +Kernel side: + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 + Workqueue: ksmbd-io handle_ksmbd_work + Call trace: + __schedule from schedule+0x3c/0x58 + schedule from schedule_preempt_disabled+0xc/0x10 + schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 + rwsem_down_read_slowpath from down_read+0x28/0x30 + down_read from ksmbd_session_rpc_method+0x18/0x3c + ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 + ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 + ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 + create_smb2_pipe from smb2_open+0x10c/0x27ac + smb2_open from handle_ksmbd_work+0x238/0x3dc + handle_ksmbd_work from process_scheduled_works+0x160/0x25c + process_scheduled_works from worker_thread+0x16c/0x1e8 + worker_thread from kthread+0xa8/0xb8 + kthread from ret_from_fork+0x14/0x38 + Exception stack(0x8529ffb0 to 0x8529fff8) + +The task deadlocks because the lock is already held: + ksmbd_session_rpc_open + down_write(&sess->rpc_lock) + ksmbd_rpc_open + ksmbd_session_rpc_method + down_read(&sess->rpc_lock) <-- deadlock + +Adjust ksmbd_session_rpc_method() callers to take the lock when necessary. + +Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access") +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/mgmt/user_session.c | 7 ++----- + fs/smb/server/smb2pdu.c | 9 ++++++++- + fs/smb/server/transport_ipc.c | 12 ++++++++++++ + 3 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c +index b36d0676dbe58..00805aed0b07d 100644 +--- a/fs/smb/server/mgmt/user_session.c ++++ b/fs/smb/server/mgmt/user_session.c +@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id) + int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id) + { + struct ksmbd_session_rpc *entry; +- int method; + +- down_read(&sess->rpc_lock); ++ lockdep_assert_held(&sess->rpc_lock); + entry = xa_load(&sess->rpc_handle_list, id); +- method = entry ? entry->method : 0; +- up_read(&sess->rpc_lock); + +- return method; ++ return entry ? entry->method : 0; + } + + void ksmbd_session_destroy(struct ksmbd_session *sess) +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index a1db006ab6e92..287200d7c0764 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -4624,8 +4624,15 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess, + * pipe without opening it, checking error condition here + */ + id = req->VolatileFileId; +- if (!ksmbd_session_rpc_method(sess, id)) ++ ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); ++ if (!ksmbd_session_rpc_method(sess, id)) { ++ up_read(&sess->rpc_lock); + return -ENOENT; ++ } ++ up_read(&sess->rpc_lock); + + ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n", + req->FileInfoClass, req->VolatileFileId); +diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c +index 2aa1b29bea080..46f87fd1ce1cd 100644 +--- a/fs/smb/server/transport_ipc.c ++++ b/fs/smb/server/transport_ipc.c +@@ -825,6 +825,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -833,6 +836,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle + req->flags |= KSMBD_RPC_WRITE_METHOD; + req->payload_sz = payload_sz; + memcpy(req->payload, payload, payload_sz); ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +@@ -849,6 +853,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle) + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -856,6 +863,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle) + req->flags |= rpc_context_flags(sess); + req->flags |= KSMBD_RPC_READ_METHOD; + req->payload_sz = 0; ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +@@ -876,6 +884,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle + if (!msg) + return NULL; + ++ lockdep_assert_not_held(&sess->rpc_lock); ++ ++ down_read(&sess->rpc_lock); + msg->type = KSMBD_EVENT_RPC_REQUEST; + req = (struct ksmbd_rpc_command *)msg->payload; + req->handle = handle; +@@ -884,6 +895,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle + req->flags |= KSMBD_RPC_IOCTL_METHOD; + req->payload_sz = payload_sz; + memcpy(req->payload, payload, payload_sz); ++ up_read(&sess->rpc_lock); + + resp = ipc_msg_send_request(msg, req->handle); + ipc_msg_free(msg); +-- +2.51.0 + diff --git a/queue-6.17/net-airoha-take-into-account-out-of-order-tx-complet.patch b/queue-6.17/net-airoha-take-into-account-out-of-order-tx-complet.patch new file mode 100644 index 0000000000..6749150dbd --- /dev/null +++ b/queue-6.17/net-airoha-take-into-account-out-of-order-tx-complet.patch @@ -0,0 +1,64 @@ +From 63d39e190520694ad6db64da322862f13781542a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 11:19:44 +0200 +Subject: net: airoha: Take into account out-of-order tx completions in + airoha_dev_xmit() + +From: Lorenzo Bianconi + +[ Upstream commit bd5afca115f181c85f992d42a57cd497bc823ccb ] + +Completion napi can free out-of-order tx descriptors if hw QoS is +enabled and packets with different priority are queued to same DMA ring. +Take into account possible out-of-order reports checking if the tx queue +is full using circular buffer head/tail pointer instead of the number of +queued packets. + +Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") +Suggested-by: Simon Horman +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20251012-airoha-tx-busy-queue-v2-1-a600b08bab2d@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/airoha/airoha_eth.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c +index 6d23c5c049b9a..ffb10c758c293 100644 +--- a/drivers/net/ethernet/airoha/airoha_eth.c ++++ b/drivers/net/ethernet/airoha/airoha_eth.c +@@ -1872,6 +1872,20 @@ static u32 airoha_get_dsa_tag(struct sk_buff *skb, struct net_device *dev) + #endif + } + ++static bool airoha_dev_tx_queue_busy(struct airoha_queue *q, u32 nr_frags) ++{ ++ u32 tail = q->tail <= q->head ? q->tail + q->ndesc : q->tail; ++ u32 index = q->head + nr_frags; ++ ++ /* completion napi can free out-of-order tx descriptors if hw QoS is ++ * enabled and packets with different priorities are queued to the same ++ * DMA ring. Take into account possible out-of-order reports checking ++ * if the tx queue is full using circular buffer head/tail pointers ++ * instead of the number of queued packets. ++ */ ++ return index >= tail; ++} ++ + static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, + struct net_device *dev) + { +@@ -1925,7 +1939,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, + txq = netdev_get_tx_queue(dev, qid); + nr_frags = 1 + skb_shinfo(skb)->nr_frags; + +- if (q->queued + nr_frags > q->ndesc) { ++ if (airoha_dev_tx_queue_busy(q, nr_frags)) { + /* not enough space in the queue */ + netif_tx_stop_queue(txq); + spin_unlock_bh(&q->lock); +-- +2.51.0 + diff --git a/queue-6.17/net-core-fix-lockdep-splat-on-device-unregister.patch b/queue-6.17/net-core-fix-lockdep-splat-on-device-unregister.patch new file mode 100644 index 0000000000..c9fdcd7c5c --- /dev/null +++ b/queue-6.17/net-core-fix-lockdep-splat-on-device-unregister.patch @@ -0,0 +1,113 @@ +From 368b2d237925ffeaedb437a19506e9865d8fd748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:50:52 +0200 +Subject: net: core: fix lockdep splat on device unregister + +From: Florian Westphal + +[ Upstream commit 7f0fddd817ba6daebea1445ae9fab4b6d2294fa8 ] + +Since blamed commit, unregister_netdevice_many_notify() takes the netdev +mutex if the device needs it. + +If the device list is too long, this will lock more device mutexes than +lockdep can handle: + +unshare -n \ + bash -c 'for i in $(seq 1 100);do ip link add foo$i type dummy;done' + +BUG: MAX_LOCK_DEPTH too low! +turning off the locking correctness validator. +depth: 48 max: 48! +48 locks held by kworker/u16:1/69: + #0: ..148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work + #1: ..d40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work + #2: ..bd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net + #3: ..aa8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch + #4: ..cb0 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify +[..] + +Add a helper to close and then unlock a list of net_devices. +Devices that are not up have to be skipped - netif_close_many always +removes them from the list without any other actions taken, so they'd +remain in locked state. + +Close devices whenever we've used up half of the tracking slots or we +processed entire list without hitting the limit. + +Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") +Signed-off-by: Florian Westphal +Link: https://patch.msgid.link/20251013185052.14021-1-fw@strlen.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 40 +++++++++++++++++++++++++++++++++++----- + 1 file changed, 35 insertions(+), 5 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 8d49b2198d072..5194b70769cc5 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -12088,6 +12088,35 @@ static void dev_memory_provider_uninstall(struct net_device *dev) + } + } + ++/* devices must be UP and netdev_lock()'d */ ++static void netif_close_many_and_unlock(struct list_head *close_head) ++{ ++ struct net_device *dev, *tmp; ++ ++ netif_close_many(close_head, false); ++ ++ /* ... now unlock them */ ++ list_for_each_entry_safe(dev, tmp, close_head, close_list) { ++ netdev_unlock(dev); ++ list_del_init(&dev->close_list); ++ } ++} ++ ++static void netif_close_many_and_unlock_cond(struct list_head *close_head) ++{ ++#ifdef CONFIG_LOCKDEP ++ /* We can only track up to MAX_LOCK_DEPTH locks per task. ++ * ++ * Reserve half the available slots for additional locks possibly ++ * taken by notifiers and (soft)irqs. ++ */ ++ unsigned int limit = MAX_LOCK_DEPTH / 2; ++ ++ if (lockdep_depth(current) > limit) ++ netif_close_many_and_unlock(close_head); ++#endif ++} ++ + void unregister_netdevice_many_notify(struct list_head *head, + u32 portid, const struct nlmsghdr *nlh) + { +@@ -12120,17 +12149,18 @@ void unregister_netdevice_many_notify(struct list_head *head, + + /* If device is running, close it first. Start with ops locked... */ + list_for_each_entry(dev, head, unreg_list) { ++ if (!(dev->flags & IFF_UP)) ++ continue; + if (netdev_need_ops_lock(dev)) { + list_add_tail(&dev->close_list, &close_head); + netdev_lock(dev); + } ++ netif_close_many_and_unlock_cond(&close_head); + } +- netif_close_many(&close_head, true); +- /* ... now unlock them and go over the rest. */ ++ netif_close_many_and_unlock(&close_head); ++ /* ... now go over the rest. */ + list_for_each_entry(dev, head, unreg_list) { +- if (netdev_need_ops_lock(dev)) +- netdev_unlock(dev); +- else ++ if (!netdev_need_ops_lock(dev)) + list_add_tail(&dev->close_list, &close_head); + } + netif_close_many(&close_head, true); +-- +2.51.0 + diff --git a/queue-6.17/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-6.17/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..7df9ac62f0 --- /dev/null +++ b/queue-6.17/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From f1672549e01700b9d081b0d896f902fb6b42f3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 1996d2e4e3e2c..7077d705e471f 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -508,25 +508,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-6.17/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-6.17/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..c9dc457454 --- /dev/null +++ b/queue-6.17/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 3c4e7a01e8363344ae172ac0626d0a53f192f7e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 8cf1380f36562..63154c8faecc3 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -609,6 +609,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index aaeb5d16f0c9a..158a30ae7c5f2 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -568,20 +568,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 3262e81223dfc..6405072050e0e 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1257,8 +1257,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-6.17/net-mtk-wed-add-dma-mask-limitation-and-gfp_dma32-fo.patch b/queue-6.17/net-mtk-wed-add-dma-mask-limitation-and-gfp_dma32-fo.patch new file mode 100644 index 0000000000..4672944fd5 --- /dev/null +++ b/queue-6.17/net-mtk-wed-add-dma-mask-limitation-and-gfp_dma32-fo.patch @@ -0,0 +1,63 @@ +From 938f6172ae5f6d40068433fec7a49dbfc5f479ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 08:29:34 +0200 +Subject: net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with + more than 4GB DRAM + +From: Rex Lu + +[ Upstream commit 3abc0e55ea1fa2250e52bc860e8f24b2b9a2093a ] + +Limit tx/rx buffer address to 32-bit address space for board with more +than 4GB DRAM. + +Fixes: 804775dfc2885 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") +Fixes: 6757d345dd7db ("net: ethernet: mtk_wed: introduce hw_rro support for MT7988") +Tested-by: Daniel Pawlik +Tested-by: Matteo Croce +Signed-off-by: Rex Lu +Co-developed-by: Lorenzo Bianconi +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_wed.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c +index 0a80d8f8cff7f..16aa7e4138d36 100644 +--- a/drivers/net/ethernet/mediatek/mtk_wed.c ++++ b/drivers/net/ethernet/mediatek/mtk_wed.c +@@ -670,7 +670,7 @@ mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev) + void *buf; + int s; + +- page = __dev_alloc_page(GFP_KERNEL); ++ page = __dev_alloc_page(GFP_KERNEL | GFP_DMA32); + if (!page) + return -ENOMEM; + +@@ -793,7 +793,7 @@ mtk_wed_hwrro_buffer_alloc(struct mtk_wed_device *dev) + struct page *page; + int s; + +- page = __dev_alloc_page(GFP_KERNEL); ++ page = __dev_alloc_page(GFP_KERNEL | GFP_DMA32); + if (!page) + return -ENOMEM; + +@@ -2405,6 +2405,10 @@ mtk_wed_attach(struct mtk_wed_device *dev) + dev->version = hw->version; + dev->hw->pcie_base = mtk_wed_get_pcie_base(dev); + ++ ret = dma_set_mask_and_coherent(hw->dev, DMA_BIT_MASK(32)); ++ if (ret) ++ goto out; ++ + if (hw->eth->dma_dev == hw->eth->dev && + of_dma_is_coherent(hw->eth->dev->of_node)) + mtk_eth_set_dma_device(hw->eth, hw->dev); +-- +2.51.0 + diff --git a/queue-6.17/net-phy-bcm54811-fix-gmii-mii-mii-lite-selection.patch b/queue-6.17/net-phy-bcm54811-fix-gmii-mii-mii-lite-selection.patch new file mode 100644 index 0000000000..2214634260 --- /dev/null +++ b/queue-6.17/net-phy-bcm54811-fix-gmii-mii-mii-lite-selection.patch @@ -0,0 +1,81 @@ +From ed7bc017784014b34c965e1b655bea7d847ebe92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 15:06:56 +0200 +Subject: net: phy: bcm54811: Fix GMII/MII/MII-Lite selection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Horák - 2N + +[ Upstream commit e4d0c909bf8328d986bf3aadba0c33a72b5ae30d ] + +The Broadcom bcm54811 is hardware-strapped to select among RGMII and +GMII/MII/MII-Lite modes. However, the corresponding bit, RGMII Enable +in Miscellaneous Control Register must be also set to select desired +RGMII or MII(-lite)/GMII mode. + +Fixes: 3117a11fff5af9e7 ("net: phy: bcm54811: PHY initialization") +Signed-off-by: Kamil Horák - 2N +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20251009130656.1308237-2-kamilh@axis.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 20 +++++++++++++++++++- + include/linux/brcmphy.h | 1 + + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index a60e58ef90c4e..6884eaccc3e1d 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -407,7 +407,7 @@ static int bcm5481x_set_brrmode(struct phy_device *phydev, bool on) + static int bcm54811_config_init(struct phy_device *phydev) + { + struct bcm54xx_phy_priv *priv = phydev->priv; +- int err, reg, exp_sync_ethernet; ++ int err, reg, exp_sync_ethernet, aux_rgmii_en; + + /* Enable CLK125 MUX on LED4 if ref clock is enabled. */ + if (!(phydev->dev_flags & PHY_BRCM_RX_REFCLK_UNUSED)) { +@@ -436,6 +436,24 @@ static int bcm54811_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ /* Enable RGMII if configured */ ++ if (phy_interface_is_rgmii(phydev)) ++ aux_rgmii_en = MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN | ++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; ++ else ++ aux_rgmii_en = 0; ++ ++ /* Also writing Reserved bits 6:5 because the documentation requires ++ * them to be written to 0b11 ++ */ ++ err = bcm54xx_auxctl_write(phydev, ++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC, ++ MII_BCM54XX_AUXCTL_MISC_WREN | ++ aux_rgmii_en | ++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD); ++ if (err < 0) ++ return err; ++ + return bcm5481x_set_brrmode(phydev, priv->brr_mode); + } + +diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h +index 15c35655f4826..115a964f30069 100644 +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -137,6 +137,7 @@ + + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 ++#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD 0x0060 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100 + #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200 +-- +2.51.0 + diff --git a/queue-6.17/net-phy-realtek-avoid-phycr2-access-if-phycr2-not-pr.patch b/queue-6.17/net-phy-realtek-avoid-phycr2-access-if-phycr2-not-pr.patch new file mode 100644 index 0000000000..f6ffca663f --- /dev/null +++ b/queue-6.17/net-phy-realtek-avoid-phycr2-access-if-phycr2-not-pr.patch @@ -0,0 +1,71 @@ +From 0c7ddfda82bf28bc46fe58421ab6179b2b836b62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 13:02:49 +0200 +Subject: net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present + +From: Marek Vasut + +[ Upstream commit 2c67301584f2671e320236df6bbe75ae09feb4d0 ] + +The driver is currently checking for PHYCR2 register presence in +rtl8211f_config_init(), but it does so after accessing PHYCR2 to +disable EEE. This was introduced in commit bfc17c165835 ("net: +phy: realtek: disable PHY-mode EEE"). Move the PHYCR2 presence +test before the EEE disablement and simplify the code. + +Fixes: bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE") +Signed-off-by: Marek Vasut +Reviewed-by: Maxime Chevallier +Reviewed-by: Russell King (Oracle) +Link: https://patch.msgid.link/20251011110309.12664-1-marek.vasut@mailbox.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/realtek/realtek_main.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c +index dd0d675149ad7..64af3b96f0288 100644 +--- a/drivers/net/phy/realtek/realtek_main.c ++++ b/drivers/net/phy/realtek/realtek_main.c +@@ -589,26 +589,25 @@ static int rtl8211f_config_init(struct phy_device *phydev) + str_enabled_disabled(val_rxdly)); + } + ++ if (!priv->has_phycr2) ++ return 0; ++ + /* Disable PHY-mode EEE so LPI is passed to the MAC */ + ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR2, + RTL8211F_PHYCR2_PHY_EEE_ENABLE, 0); + if (ret) + return ret; + +- if (priv->has_phycr2) { +- ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE, +- RTL8211F_PHYCR2, RTL8211F_CLKOUT_EN, +- priv->phycr2); +- if (ret < 0) { +- dev_err(dev, "clkout configuration failed: %pe\n", +- ERR_PTR(ret)); +- return ret; +- } +- +- return genphy_soft_reset(phydev); ++ ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE, ++ RTL8211F_PHYCR2, RTL8211F_CLKOUT_EN, ++ priv->phycr2); ++ if (ret < 0) { ++ dev_err(dev, "clkout configuration failed: %pe\n", ++ ERR_PTR(ret)); ++ return ret; + } + +- return 0; ++ return genphy_soft_reset(phydev); + } + + static int rtl821x_suspend(struct phy_device *phydev) +-- +2.51.0 + diff --git a/queue-6.17/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-6.17/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..d0f1521d26 --- /dev/null +++ b/queue-6.17/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From ef3c2ce81f743068d5ca502a7155a6715008ec37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 5ccbe6ae2ebe9..e0c425779e67f 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3244,10 +3244,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -3256,6 +3252,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.17/netdevsim-set-the-carrier-when-the-device-goes-up.patch b/queue-6.17/netdevsim-set-the-carrier-when-the-device-goes-up.patch new file mode 100644 index 0000000000..ac1b872b29 --- /dev/null +++ b/queue-6.17/netdevsim-set-the-carrier-when-the-device-goes-up.patch @@ -0,0 +1,56 @@ +From 3f488fbd80a5304be97c57689f12bb208ba7242a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 02:17:25 -0700 +Subject: netdevsim: set the carrier when the device goes up + +From: Breno Leitao + +[ Upstream commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 ] + +Bringing a linked netdevsim device down and then up causes communication +failure because both interfaces lack carrier. Basically a ifdown/ifup on +the interface make the link broken. + +Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported +for NAPI, calling netif_carrier_off() in nsim_stop(). This patch +re-enables the carrier symmetrically on nsim_open(), in case the device +is linked and the peer is up. + +Signed-off-by: Breno Leitao +Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support") +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdev.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c +index 0178219f0db53..d7938e11f24de 100644 +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -528,6 +528,7 @@ static void nsim_enable_napi(struct netdevsim *ns) + static int nsim_open(struct net_device *dev) + { + struct netdevsim *ns = netdev_priv(dev); ++ struct netdevsim *peer; + int err; + + netdev_assert_locked(dev); +@@ -538,6 +539,12 @@ static int nsim_open(struct net_device *dev) + + nsim_enable_napi(ns); + ++ peer = rtnl_dereference(ns->peer); ++ if (peer && netif_running(peer->netdev)) { ++ netif_carrier_on(dev); ++ netif_carrier_on(peer->netdev); ++ } ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/nvme-auth-update-sc_c-in-host-response.patch b/queue-6.17/nvme-auth-update-sc_c-in-host-response.patch new file mode 100644 index 0000000000..5657a4616a --- /dev/null +++ b/queue-6.17/nvme-auth-update-sc_c-in-host-response.patch @@ -0,0 +1,66 @@ +From 8a354e57b4c1627b325fae79c322cd9bdfe51164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 22:54:57 +0530 +Subject: nvme-auth: update sc_c in host response + +From: Martin George + +[ Upstream commit 7e091add9c433bab6912228799bf508e2414acc3 ] + +The sc_c field is currently not updated in the host response to the +controller challenge leading to failures while attempting secure +channel concatenation. Fix this by adding a new sc_c variable to the +dhchap queue context structure which is appropriately set during +negotiate and then used in the host response. + +Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") +Signed-off-by: Martin George +Signed-off-by: Prashanth Adurthi +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index 012fcfc79a73b..a01178caf15bb 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -36,6 +36,7 @@ struct nvme_dhchap_queue_context { + u8 status; + u8 dhgroup_id; + u8 hash_id; ++ u8 sc_c; + size_t hash_len; + u8 c1[64]; + u8 c2[64]; +@@ -154,6 +155,8 @@ static int nvme_auth_set_dhchap_negotiate_data(struct nvme_ctrl *ctrl, + data->auth_protocol[0].dhchap.idlist[34] = NVME_AUTH_DHGROUP_6144; + data->auth_protocol[0].dhchap.idlist[35] = NVME_AUTH_DHGROUP_8192; + ++ chap->sc_c = data->sc_c; ++ + return size; + } + +@@ -489,7 +492,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl, + ret = crypto_shash_update(shash, buf, 2); + if (ret) + goto out; +- memset(buf, 0, sizeof(buf)); ++ *buf = chap->sc_c; + ret = crypto_shash_update(shash, buf, 1); + if (ret) + goto out; +@@ -500,6 +503,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl, + strlen(ctrl->opts->host->nqn)); + if (ret) + goto out; ++ memset(buf, 0, sizeof(buf)); + ret = crypto_shash_update(shash, buf, 1); + if (ret) + goto out; +-- +2.51.0 + diff --git a/queue-6.17/nvme-multipath-skip-nr_active-increments-in-retry-di.patch b/queue-6.17/nvme-multipath-skip-nr_active-increments-in-retry-di.patch new file mode 100644 index 0000000000..0443a80cb2 --- /dev/null +++ b/queue-6.17/nvme-multipath-skip-nr_active-increments-in-retry-di.patch @@ -0,0 +1,60 @@ +From 2ab7548de49e3f799abeaaf9a59fc8390167bc84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 12:08:22 -0700 +Subject: nvme-multipath: Skip nr_active increments in RETRY disposition + +From: Amit Chaudhary + +[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ] + +For queue-depth I/O policy, this patch fixes unbalanced I/Os across +nvme multipaths. + +Issue Description: + +The RETRY disposition incorrectly increments ns->ctrl->nr_active +counter and reinitializes iostat start-time. In such cases nr_active +counter never goes back to zero until that path disconnects and +reconnects. + +Such a path is not chosen for new I/Os if multiple RETRY cases on a given +a path cause its queue-depth counter to be artificially higher compared +to other paths. This leads to unbalanced I/Os across paths. + +The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already +set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set. + +base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a +Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device") +Signed-off-by: Amit Chaudhary +Reviewed-by: Randy Jennings +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 3da980dc60d91..543e17aead12b 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -182,12 +182,14 @@ void nvme_mpath_start_request(struct request *rq) + struct nvme_ns *ns = rq->q->queuedata; + struct gendisk *disk = ns->head->disk; + +- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) { ++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) && ++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) { + atomic_inc(&ns->ctrl->nr_active); + nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE; + } + +- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq)) ++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) || ++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS)) + return; + + nvme_req(rq)->flags |= NVME_MPATH_IO_STATS; +-- +2.51.0 + diff --git a/queue-6.17/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch b/queue-6.17/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch new file mode 100644 index 0000000000..6300722c02 --- /dev/null +++ b/queue-6.17/nvme-tcp-handle-tls-partially-sent-records-in-write_.patch @@ -0,0 +1,48 @@ +From e130b2ae1d5e87e7c128da28473e4f59b5f70e5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 17:19:42 +1000 +Subject: nvme/tcp: handle tls partially sent records in write_space() + +From: Wilfred Mallawa + +[ Upstream commit 5a869d017793399fd1d2609ff27e900534173eb3 ] + +With TLS enabled, records that are encrypted and appended to TLS TX +list can fail to see a retry if the underlying TCP socket is busy, for +example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known +to the NVMe TCP driver, as the TLS layer successfully generated a record. + +Typically, the TLS write_space() callback would ensure such records are +retried, but in the NVMe TCP Host driver, write_space() invokes +nvme_tcp_write_space(). This causes a partially sent record in the TLS TX +list to timeout after not being retried. + +This patch fixes the above by calling queue->write_space(), which calls +into the TLS layer to retry any pending records. + +Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") +Signed-off-by: Wilfred Mallawa +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 1413788ca7d52..9a96df1a511c0 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1081,6 +1081,9 @@ static void nvme_tcp_write_space(struct sock *sk) + queue = sk->sk_user_data; + if (likely(queue && sk_stream_is_writeable(sk))) { + clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); ++ /* Ensure pending TLS partial records are retried */ ++ if (nvme_tcp_queue_tls(queue)) ++ queue->write_space(sk); + queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work); + } + read_unlock_bh(&sk->sk_callback_lock); +-- +2.51.0 + diff --git a/queue-6.17/octeontx2-af-fix-missing-error-code-in-cgx_probe.patch b/queue-6.17/octeontx2-af-fix-missing-error-code-in-cgx_probe.patch new file mode 100644 index 0000000000..58871bf44d --- /dev/null +++ b/queue-6.17/octeontx2-af-fix-missing-error-code-in-cgx_probe.patch @@ -0,0 +1,39 @@ +From e8cfb28b872db448db23f2c84cb3c4985e9db4db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 13:42:39 -0700 +Subject: Octeontx2-af: Fix missing error code in cgx_probe() + +From: Harshit Mogalapalli + +[ Upstream commit c5705a2a4aa35350e504b72a94b5c71c3754833c ] + +When CGX fails mapping to NIX, set the error code to -ENODEV, currently +err is zero and that is treated as success path. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/aLAdlCg2_Yv7Y-3h@stanley.mountain/ +Fixes: d280233fc866 ("Octeontx2-af: Fix NIX X2P calibration failures") +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20251010204239.94237-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 69324ae093973..31310018c3cac 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -1981,6 +1981,7 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id) + !is_cgx_mapped_to_nix(pdev->subsystem_device, cgx->cgx_id)) { + dev_notice(dev, "CGX %d not mapped to NIX, skipping probe\n", + cgx->cgx_id); ++ err = -ENODEV; + goto err_release_regions; + } + +-- +2.51.0 + diff --git a/queue-6.17/powerpc-fadump-skip-parameter-area-allocation-when-f.patch b/queue-6.17/powerpc-fadump-skip-parameter-area-allocation-when-f.patch new file mode 100644 index 0000000000..b01ef9dad6 --- /dev/null +++ b/queue-6.17/powerpc-fadump-skip-parameter-area-allocation-when-f.patch @@ -0,0 +1,43 @@ +From d1e75c3d344a5e787554984dfcdd22098726d445 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 08:59:34 +0530 +Subject: powerpc/fadump: skip parameter area allocation when fadump is + disabled + +From: Sourabh Jain + +[ Upstream commit 0843ba458439f38efdc14aa359c14ad0127edb01 ] + +Fadump allocates memory to pass additional kernel command-line argument +to the fadump kernel. However, this allocation is not needed when fadump +is disabled. So avoid allocating memory for the additional parameter +area in such cases. + +Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") +Reviewed-by: Hari Bathini +Signed-off-by: Sourabh Jain +Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20251008032934.262683-1-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/fadump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 5782e743fd270..4ebc333dd786f 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -1747,6 +1747,9 @@ void __init fadump_setup_param_area(void) + { + phys_addr_t range_start, range_end; + ++ if (!fw_dump.fadump_enabled) ++ return; ++ + if (!fw_dump.param_area_supported || fw_dump.dump_active) + return; + +-- +2.51.0 + diff --git a/queue-6.17/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-6.17/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..f78537fb74 --- /dev/null +++ b/queue-6.17/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From 3a7f3387ed1b37dac430660246f876be65b138fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 9c601f271c02b..4b0ac73565ea9 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4994,8 +4994,9 @@ static int rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_runtime_resume(device); +-- +2.51.0 + diff --git a/queue-6.17/riscv-kprobes-fix-probe-address-validation.patch b/queue-6.17/riscv-kprobes-fix-probe-address-validation.patch new file mode 100644 index 0000000000..7190da27fd --- /dev/null +++ b/queue-6.17/riscv-kprobes-fix-probe-address-validation.patch @@ -0,0 +1,64 @@ +From ef55ae3703d35b1fe0419e4f5b0901149208369d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:25:13 +0200 +Subject: riscv: kprobes: Fix probe address validation + +From: Fabian Vogt + +[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ] + +When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", +arch_check_kprobe would start iterating all instructions starting from +_text until the probed address. Not only is this very inefficient, but +literal values in there (e.g. left by function patching) are +misinterpreted in a way that causes a desync. + +Fix this by doing it like x86: start the iteration at the closest +preceding symbol instead of the given starting point. + +Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") +Signed-off-by: Fabian Vogt +Signed-off-by: Marvin Friedrich +Acked-by: Guo Ren +Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index c0738d6c6498a..8723390c7cad5 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + +-static bool __kprobes arch_check_kprobe(struct kprobe *p) ++static bool __kprobes arch_check_kprobe(unsigned long addr) + { +- unsigned long tmp = (unsigned long)p->addr - p->offset; +- unsigned long addr = (unsigned long)p->addr; ++ unsigned long tmp, offset; ++ ++ /* start iterating at the closest preceding symbol */ ++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) ++ return false; ++ ++ tmp = addr - offset; + + while (tmp <= addr) { + if (tmp == addr) +@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if ((unsigned long)insn & 0x1) + return -EILSEQ; + +- if (!arch_check_kprobe(p)) ++ if (!arch_check_kprobe((unsigned long)p->addr)) + return -EILSEQ; + + /* copy instruction */ +-- +2.51.0 + diff --git a/queue-6.17/rust-cpufreq-fix-formatting.patch b/queue-6.17/rust-cpufreq-fix-formatting.patch new file mode 100644 index 0000000000..12d89837c3 --- /dev/null +++ b/queue-6.17/rust-cpufreq-fix-formatting.patch @@ -0,0 +1,40 @@ +From b8384fcf947f8db716c1773faaa727c291918164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 19:43:51 +0200 +Subject: rust: cpufreq: fix formatting + +From: Miguel Ojeda + +[ Upstream commit 32f072d9eaf9c31c2b0527a4a3370570a731e3cc ] + +We do our best to keep the repository `rustfmt`-clean, thus run the tool +to fix the formatting issue. + +Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting +Link: https://rust-for-linux.com/contributing#submit-checklist-addendum +Fixes: f97aef092e19 ("cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency") +Acked-by: Viresh Kumar +Reviewed-by: Benno Lossin +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + rust/kernel/cpufreq.rs | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs +index b762ecdc22b00..cb15f612028ed 100644 +--- a/rust/kernel/cpufreq.rs ++++ b/rust/kernel/cpufreq.rs +@@ -39,8 +39,7 @@ use macros::vtable; + const CPUFREQ_NAME_LEN: usize = bindings::CPUFREQ_NAME_LEN as usize; + + /// Default transition latency value in nanoseconds. +-pub const DEFAULT_TRANSITION_LATENCY_NS: u32 = +- bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS; ++pub const DEFAULT_TRANSITION_LATENCY_NS: u32 = bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS; + + /// CPU frequency driver flags. + pub mod flags { +-- +2.51.0 + diff --git a/queue-6.17/sched-deadline-stop-dl_server-before-cpu-goes-offlin.patch b/queue-6.17/sched-deadline-stop-dl_server-before-cpu-goes-offlin.patch new file mode 100644 index 0000000000..bedb4b7556 --- /dev/null +++ b/queue-6.17/sched-deadline-stop-dl_server-before-cpu-goes-offlin.patch @@ -0,0 +1,84 @@ +From 95e227b36fa658b2a631b5fe2fa53359a152ce04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:17:27 +0530 +Subject: sched/deadline: Stop dl_server before CPU goes offline + +From: Peter Zijlstra (Intel) + +[ Upstream commit ee6e44dfe6e50b4a5df853d933a96bdff5309e6e ] + +IBM CI tool reported kernel warning[1] when running a CPU removal +operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1" + +WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170 +NIP [c0000000002b6ed8] cpudl_set+0x58/0x170 +LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 +Call Trace: +[c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable) +[c0000000002b7cb8] dl_server_timer+0x168/0x2a0 +[c00000000034df84] __hrtimer_run_queues+0x1a4/0x390 +[c00000000034f624] hrtimer_interrupt+0x124/0x300 +[c00000000002a230] timer_interrupt+0x140/0x320 + +Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") + +This happens since: +- dl_server hrtimer gets enqueued close to cpu offline, when + kthread_park enqueues a fair task. +- CPU goes offline and drmgr removes it from cpu_present_mask. +- hrtimer fires and warning is hit. + +Fix it by stopping the dl_server before CPU is marked dead. + +[1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/ +[2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr + +[sshegde: wrote the changelog and tested it] +Fixes: 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") +Closes: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com +Signed-off-by: Peter Zijlstra (Intel) +Reported-by: Venkat Rao Bagalkote +Signed-off-by: Shrikanth Hegde +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Marek Szyprowski +Tested-by: Shrikanth Hegde +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 ++ + kernel/sched/deadline.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ccba6fc3c3fed..8575d67cbf738 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8603,10 +8603,12 @@ int sched_cpu_dying(unsigned int cpu) + sched_tick_stop(cpu); + + rq_lock_irqsave(rq, &rf); ++ update_rq_clock(rq); + if (rq->nr_running != 1 || rq_has_pinned_tasks(rq)) { + WARN(true, "Dying CPU not properly vacated!"); + dump_rq_tasks(rq, KERN_WARNING); + } ++ dl_server_stop(&rq->fair_server); + rq_unlock_irqrestore(rq, &rf); + + calc_load_migrate(rq); +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 615411a0a8813..7b7671060bf9e 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1582,6 +1582,9 @@ void dl_server_start(struct sched_dl_entity *dl_se) + if (!dl_server(dl_se) || dl_se->dl_server_active) + return; + ++ if (WARN_ON_ONCE(!cpu_online(cpu_of(rq)))) ++ return; ++ + dl_se->dl_server_active = 1; + enqueue_dl_entity(dl_se, ENQUEUE_WAKEUP); + if (!dl_task(dl_se->rq->curr) || dl_entity_preempt(dl_se, &rq->curr->dl)) +-- +2.51.0 + diff --git a/queue-6.17/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-6.17/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..d38fa10c49 --- /dev/null +++ b/queue-6.17/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From 633327d761ca853ac6c2d2296167f74d1e8149d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 8ce56a8d507f9..8f0b1acace0ad 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -8829,21 +8829,21 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-6.17/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch b/queue-6.17/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch new file mode 100644 index 0000000000..2b19feec91 --- /dev/null +++ b/queue-6.17/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch @@ -0,0 +1,42 @@ +From 7b582140c19e64142cb7c9e2f199f7b4cabd58c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Oct 2025 11:53:30 +0800 +Subject: selftests: arg_parsing: Ensure data is flushed to disk before + reading. + +From: Xing Guo + +[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ] + +test_parse_test_list_file writes some data to +/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read +the data back. However, after writing data to that file, we forget to +call fsync() and it's causing testing failure in my laptop. This patch +helps fix it by adding the missing fsync() call. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Xing Guo +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index fbf0d9c2f58b3..e27d66b75fb1f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void) + if (!ASSERT_OK(ferror(fp), "prepare tmp")) + goto out_fclose; + ++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp")) ++ goto out_fclose; ++ + init_test_filter_set(&set); + + if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch b/queue-6.17/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch new file mode 100644 index 0000000000..9dc6e0d8e8 --- /dev/null +++ b/queue-6.17/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch @@ -0,0 +1,63 @@ +From 72eadd505de917e389f0120fee665e8a0fdd153b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 13:20:37 -0700 +Subject: selftests/bpf: make arg_parsing.c more robust to crashes + +From: Andrii Nakryiko + +[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ] + +We started getting a crash in BPF CI, which seems to originate from +test_parse_test_list_file() test and is happening at this line: + + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + +One way we can crash there is if set.cnt zero, which is checked for with +ASSERT_EQ() above, but we proceed after this regardless of the outcome. +Instead of crashing, we should bail out with test failure early. + +Similarly, if parse_test_list_file() fails, we shouldn't be even looking +at set, so bail even earlier if ASSERT_OK() fails. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Andrii Nakryiko +Tested-by: Ihor Solodrai +Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index bb143de68875c..fbf0d9c2f58b3 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void) + + init_test_filter_set(&set); + +- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"); ++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) ++ goto out_fclose; ++ ++ if (!ASSERT_EQ(set.cnt, 4, "test count")) ++ goto out_free_set; + +- ASSERT_EQ(set.cnt, 4, "test count"); + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count"); + ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name"); +@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void) + ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name"); + ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name"); + ++out_free_set: + free_test_filter_set(&set); +- + out_fclose: + fclose(fp); + out_remove: +-- +2.51.0 + diff --git a/queue-6.17/selftests-net-check-jq-command-is-supported.patch b/queue-6.17/selftests-net-check-jq-command-is-supported.patch new file mode 100644 index 0000000000..3a49c0d0b1 --- /dev/null +++ b/queue-6.17/selftests-net-check-jq-command-is-supported.patch @@ -0,0 +1,69 @@ +From 5d0494c5ab69c8ebe73b063f3edf09792a4fe2f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 16:00:39 +0800 +Subject: selftests: net: check jq command is supported + +From: Wang Liang + +[ Upstream commit 4f86eb0a38bc719ba966f155071a6f0594327f34 ] + +The jq command is used in vlan_bridge_binding.sh, if it is not supported, +the test will spam the following log. + + # ./vlan_bridge_binding.sh: line 51: jq: command not found + # ./vlan_bridge_binding.sh: line 51: jq: command not found + # ./vlan_bridge_binding.sh: line 51: jq: command not found + # ./vlan_bridge_binding.sh: line 51: jq: command not found + # ./vlan_bridge_binding.sh: line 51: jq: command not found + # TEST: Test bridge_binding on->off when lower down [FAIL] + # Got operstate of , expected 0 + +The rtnetlink.sh has the same problem. It makes sense to check if jq is +installed before running these tests. After this patch, the +vlan_bridge_binding.sh skipped if jq is not supported: + + # timeout set to 3600 + # selftests: net: vlan_bridge_binding.sh + # TEST: jq not installed [SKIP] + +Fixes: dca12e9ab760 ("selftests: net: Add a VLAN bridge binding selftest") +Fixes: 6a414fd77f61 ("selftests: rtnetlink: Add an address proto test") +Signed-off-by: Wang Liang +Reviewed-by: Hangbin Liu +Link: https://patch.msgid.link/20251013080039.3035898-1-wangliang74@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/rtnetlink.sh | 2 ++ + tools/testing/selftests/net/vlan_bridge_binding.sh | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh +index d6c00efeb6642..281758e407888 100755 +--- a/tools/testing/selftests/net/rtnetlink.sh ++++ b/tools/testing/selftests/net/rtnetlink.sh +@@ -1453,6 +1453,8 @@ usage: ${0##*/} OPTS + EOF + } + ++require_command jq ++ + #check for needed privileges + if [ "$(id -u)" -ne 0 ];then + end_test "SKIP: Need root privileges" +diff --git a/tools/testing/selftests/net/vlan_bridge_binding.sh b/tools/testing/selftests/net/vlan_bridge_binding.sh +index e7cb8c678bdee..fe5472d844243 100755 +--- a/tools/testing/selftests/net/vlan_bridge_binding.sh ++++ b/tools/testing/selftests/net/vlan_bridge_binding.sh +@@ -249,6 +249,8 @@ test_binding_toggle_off_when_upper_down() + do_test_binding_off : "on->off when upper down" + } + ++require_command jq ++ + trap defer_scopes_cleanup EXIT + setup_prepare + tests_run +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series index ced56f6db1..86282c9372 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -55,3 +55,82 @@ usb-gadget-f_acm-refactor-bind-path-to-use-__free.patch usb-gadget-f_ecm-refactor-bind-path-to-use-__free.patch usb-gadget-f_ncm-refactor-bind-path-to-use-__free.patch hid-multitouch-fix-sticky-fingers.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +coredump-fix-core_pattern-input-validation.patch +can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch +can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch +can-m_can-m_can_chip_config-bring-up-interface-in-co.patch +can-m_can-fix-can-state-in-system-pm.patch +net-mtk-wed-add-dma-mask-limitation-and-gfp_dma32-fo.patch +net-dlink-handle-dma_map_single-failure-properly.patch +doc-fix-seg6_flowlabel-path.patch +can-j1939-add-missing-calls-in-netdev_unregister-not.patch +dpll-zl3073x-refactor-dpll-initialization.patch +dpll-zl3073x-handle-missing-or-corrupted-flash-confi.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-phy-bcm54811-fix-gmii-mii-mii-lite-selection.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +idpf-cleanup-remaining-skbs-in-ptp-flows.patch +ixgbe-fix-too-early-devlink_free-in-ixgbe_remove.patch +net-phy-realtek-avoid-phycr2-access-if-phycr2-not-pr.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +octeontx2-af-fix-missing-error-code-in-cgx_probe.patch +usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +net-airoha-take-into-account-out-of-order-tx-complet.patch +selftests-net-check-jq-command-is-supported.patch +net-core-fix-lockdep-splat-on-device-unregister.patch +ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +tls-trim-encrypted-message-to-match-the-plaintext-on.patch +tls-wait-for-async-encrypt-in-case-of-error-during-l.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch +tls-don-t-rely-on-tx_work-during-send.patch +netdevsim-set-the-carrier-when-the-device-goes-up.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +drm-panthor-ensure-mcu-is-disabled-on-suspend.patch +nvme-multipath-skip-nr_active-increments-in-retry-di.patch +riscv-kprobes-fix-probe-address-validation.patch +drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch +powerpc-fadump-skip-parameter-area-allocation-when-f.patch +asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch +asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch +asoc-nau8821-generalize-helper-to-clear-irq-status.patch +asoc-nau8821-consistently-clear-interrupts-before-un.patch +asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch +drm-i915-guc-skip-communication-warning-on-reset-in-.patch +drm-i915-frontbuffer-move-bo-refcounting-intel_front.patch +drm-i915-fb-fix-the-set_tiling-vs.-addfb-race-again.patch +drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch +drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch +drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch +drm-amdgpu-handle-wrap-around-in-reemit-handling.patch +drm-amdgpu-set-an-error-on-all-fences-from-a-bad-con.patch +drm-amdgpu-drop-unused-structures-in-amdgpu_drm.h.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +drm-xe-enable-media-sampler-power-gating.patch +cxl-features-add-check-for-no-entries-in-cxl_feature.patch +x86-mm-fix-smp-ordering-in-switch_mm_irqs_off.patch +drm-draw-fix-color-truncation-in-drm_draw_fill24.patch +drm-rockchip-vop2-use-correct-destination-rectangle-.patch +hid-intel-thc-hid-intel-quickspi-switch-first-interr.patch +sched-deadline-stop-dl_server-before-cpu-goes-offlin.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch +accel-qaic-fix-bootlog-initialization-ordering.patch +accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch +accel-qaic-synchronize-access-to-dbc-request-queue-h.patch +nvme-auth-update-sc_c-in-host-response.patch +cxl-trace-subtract-to-find-an-hpa_alias0-in-cxl_pois.patch +selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch +alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch +blk-mq-fix-stale-tag-depth-for-shared-sched-tags-in-.patch +block-remove-elevator_lock-usage-from-blkg_conf-froz.patch +hid-hid-input-only-ignore-0-battery-events-for-digit.patch +hid-multitouch-fix-name-of-stylus-input-devices.patch +asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch +drm-xe-evict-drop-bogus-assert.patch +selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch +nvme-tcp-handle-tls-partially-sent-records-in-write_.patch +rust-cpufreq-fix-formatting.patch diff --git a/queue-6.17/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-6.17/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..16988b29ca --- /dev/null +++ b/queue-6.17/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From 0527c3c699fd55467205ed12bafbdee015c4b86b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index caf11920a8786..16251d8e1b592 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2219,7 +2219,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2281,9 +2282,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-6.17/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-6.17/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..124c9d554b --- /dev/null +++ b/queue-6.17/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From b4417266fa4342d4a8c827421519bdb6ac757a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index b4dc93a487184..8b64e4667c21c 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5803,7 +5803,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5944,9 +5944,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-6.17/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-6.17/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..7da37ca8a8 --- /dev/null +++ b/queue-6.17/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From 159388788f0787e45486246a0e059dc98ad78d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index a3ccb3135e51a..39a2ab47fe720 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -255,12 +255,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/tls-don-t-rely-on-tx_work-during-send.patch b/queue-6.17/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..b17febdfe7 --- /dev/null +++ b/queue-6.17/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From e86eb295b45d4714922b907f857ab1a51d6ab016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index e3d852091e7a4..d171353699800 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + } else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-6.17/tls-trim-encrypted-message-to-match-the-plaintext-on.patch b/queue-6.17/tls-trim-encrypted-message-to-match-the-plaintext-on.patch new file mode 100644 index 0000000000..10805a32e5 --- /dev/null +++ b/queue-6.17/tls-trim-encrypted-message-to-match-the-plaintext-on.patch @@ -0,0 +1,49 @@ +From 5aea4d29d081c4512445b7e01d6bcb2062a329eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:56 +0200 +Subject: tls: trim encrypted message to match the plaintext on short splice + +From: Sabrina Dubroca + +[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ] + +During tls_sw_sendmsg_locked, we pre-allocate the encrypted message +for the size we're expecting to send during the current iteration, but +we may end up sending less, for example when splicing: if we're +getting the data from small fragments of memory, we may fill up all +the slots in the skmsg with less data than expected. + +In this case, we need to trim the encrypted message to only the length +we actually need, to avoid pushing uninitialized bytes down the +underlying TCP socket. + +Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index daac9fd4be7eb..36ca3011ab876 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + tls_ctx->pending_open_record_frags = true; + +- if (sk_msg_full(msg_pl)) ++ if (sk_msg_full(msg_pl)) { + full_record = true; ++ sk_msg_trim(sk, msg_en, ++ msg_pl->sg.size + prot->overhead_size); ++ } + + if (full_record || eor) + goto copied; +-- +2.51.0 + diff --git a/queue-6.17/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch b/queue-6.17/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch new file mode 100644 index 0000000000..c4c6a90696 --- /dev/null +++ b/queue-6.17/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch @@ -0,0 +1,67 @@ +From 3bfb4c7b18cd944f834b9a417f20da87b07a8092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:57 +0200 +Subject: tls: wait for async encrypt in case of error during latter iterations + of sendmsg + +From: Sabrina Dubroca + +[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ] + +If we hit an error during the main loop of tls_sw_sendmsg_locked (eg +failed allocation), we jump to send_end and immediately +return. Previous iterations may have queued async encryption requests +that are still pending. We should wait for those before returning, as +we could otherwise be reading from memory that userspace believes +we're not using anymore, which would be a sort of use-after-free. + +This is similar to what tls_sw_recvmsg already does: failures during +the main loop jump to the "wait for async" code, not straight to the +unlock/return. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 36ca3011ab876..1478d515badc8 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + if (ret == -EINPROGRESS) + num_async++; + else if (ret != -EAGAIN) +- goto send_end; ++ goto end; + } + } + +@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto alloc_encrypted; + } + ++send_end: + if (!num_async) { +- goto send_end; ++ goto end; + } else if (num_zc || eor) { + int err; + +@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + tls_tx_records(sk, msg->msg_flags); + } + +-send_end: ++end: + ret = sk_stream_error(sk, msg->msg_flags, ret); + return copied > 0 ? copied : ret; + } +-- +2.51.0 + diff --git a/queue-6.17/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch b/queue-6.17/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch new file mode 100644 index 0000000000..3740a179d5 --- /dev/null +++ b/queue-6.17/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch @@ -0,0 +1,47 @@ +From a241f9ebd35414cf2a96fe585f68d52107470f15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:59 +0200 +Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails + +From: Sabrina Dubroca + +[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ] + +Async decryption calls tls_strp_msg_hold to create a clone of the +input skb to hold references to the memory it uses. If we fail to +allocate that clone, proceeding with async decryption can lead to +various issues (UAF on the skb, writing into userspace memory after +the recv() call has returned). + +In this case, wait for all pending decryption requests. + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1478d515badc8..e3d852091e7a4 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1641,8 +1641,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov, + + if (unlikely(darg->async)) { + err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold); +- if (err) +- __skb_queue_tail(&ctx->async_hold, darg->skb); ++ if (err) { ++ err = tls_decrypt_async_wait(ctx); ++ darg->async = false; ++ } + return err; + } + +-- +2.51.0 + diff --git a/queue-6.17/usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch b/queue-6.17/usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch new file mode 100644 index 0000000000..58f9f51aeb --- /dev/null +++ b/queue-6.17/usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch @@ -0,0 +1,76 @@ +From ce83f147a89e4dd8d12b50908ffdf9cc2418805e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 15:05:18 +0800 +Subject: usbnet: Fix using smp_processor_id() in preemptible code warnings + +From: Zqiang + +[ Upstream commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 ] + +Syzbot reported the following warning: + +BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 +caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 +CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 + check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 + usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 + usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 + usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 + __dev_set_mtu net/core/dev.c:9443 [inline] + netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 + netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 + dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 + dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 + dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 + sock_do_ioctl+0x19d/0x280 net/socket.c:1204 + sock_ioctl+0x42f/0x6a0 net/socket.c:1311 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl fs/ioctl.c:892 [inline] + __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +For historical and portability reasons, the netif_rx() is usually +run in the softirq or interrupt context, this commit therefore add +local_bh_disable/enable() protection in the usbnet_resume_rx(). + +Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change") +Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1e1 +Suggested-by: Jakub Kicinski +Signed-off-by: Zqiang +Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/usbnet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 511c4154cf742..bf01f27285318 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -702,6 +702,7 @@ void usbnet_resume_rx(struct usbnet *dev) + struct sk_buff *skb; + int num = 0; + ++ local_bh_disable(); + clear_bit(EVENT_RX_PAUSED, &dev->flags); + + while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) { +@@ -710,6 +711,7 @@ void usbnet_resume_rx(struct usbnet *dev) + } + + queue_work(system_bh_wq, &dev->bh_work); ++ local_bh_enable(); + + netif_dbg(dev, rx_status, dev->net, + "paused rx queue disabled, %d skbs requeued\n", num); +-- +2.51.0 + diff --git a/queue-6.17/x86-mm-fix-smp-ordering-in-switch_mm_irqs_off.patch b/queue-6.17/x86-mm-fix-smp-ordering-in-switch_mm_irqs_off.patch new file mode 100644 index 0000000000..3a179ce248 --- /dev/null +++ b/queue-6.17/x86-mm-fix-smp-ordering-in-switch_mm_irqs_off.patch @@ -0,0 +1,69 @@ +From 0244c8d122992b5a47cc3d1b1514c5a2882683d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 15:43:04 +0200 +Subject: x86/mm: Fix SMP ordering in switch_mm_irqs_off() + +From: Ingo Molnar + +[ Upstream commit 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 ] + +Stephen noted that it is possible to not have an smp_mb() between +the loaded_mm store and the tlb_gen load in switch_mm(), meaning the +ordering against flush_tlb_mm_range() goes out the window, and it +becomes possible for switch_mm() to not observe a recent tlb_gen +update and fail to flush the TLBs. + +[ dhansen: merge conflict fixed by Ingo ] + +Fixes: 209954cbc7d0 ("x86/mm/tlb: Update mm_cpumask lazily") +Reported-by: Stephen Dolan +Closes: https://lore.kernel.org/all/CAHDw0oGd0B4=uuv8NGqbUQ_ZVmSheU2bN70e4QhFXWvuAZdt2w@mail.gmail.com/ +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Signed-off-by: Dave Hansen +Signed-off-by: Sasha Levin +--- + arch/x86/mm/tlb.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c +index 39f80111e6f17..5d221709353e0 100644 +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -911,11 +911,31 @@ void switch_mm_irqs_off(struct mm_struct *unused, struct mm_struct *next, + * CR3 and cpu_tlbstate.loaded_mm are not all in sync. + */ + this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING); +- barrier(); + +- /* Start receiving IPIs and then read tlb_gen (and LAM below) */ ++ /* ++ * Make sure this CPU is set in mm_cpumask() such that we'll ++ * receive invalidation IPIs. ++ * ++ * Rely on the smp_mb() implied by cpumask_set_cpu()'s atomic ++ * operation, or explicitly provide one. Such that: ++ * ++ * switch_mm_irqs_off() flush_tlb_mm_range() ++ * smp_store_release(loaded_mm, SWITCHING); atomic64_inc_return(tlb_gen) ++ * smp_mb(); // here // smp_mb() implied ++ * atomic64_read(tlb_gen); this_cpu_read(loaded_mm); ++ * ++ * we properly order against flush_tlb_mm_range(), where the ++ * loaded_mm load can happen in mative_flush_tlb_multi() -> ++ * should_flush_tlb(). ++ * ++ * This way switch_mm() must see the new tlb_gen or ++ * flush_tlb_mm_range() must see the new loaded_mm, or both. ++ */ + if (next != &init_mm && !cpumask_test_cpu(cpu, mm_cpumask(next))) + cpumask_set_cpu(cpu, mm_cpumask(next)); ++ else ++ smp_mb(); ++ + next_tlb_gen = atomic64_read(&next->context.tlb_gen); + + ns = choose_new_asid(next, next_tlb_gen); +-- +2.51.0 + diff --git a/queue-6.6/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch b/queue-6.6/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch new file mode 100644 index 0000000000..970bb6b2a1 --- /dev/null +++ b/queue-6.6/accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch @@ -0,0 +1,49 @@ +From 76fcec5867489726b4a2d62d856d555877a41aef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Oct 2025 14:23:20 +0200 +Subject: accel/qaic: Treat remaining == 0 as error in + find_and_map_user_pages() + +From: Youssef Samir + +[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ] + +Currently, if find_and_map_user_pages() takes a DMA xfer request from the +user with a length field set to 0, or in a rare case, the host receives +QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size +is equal to the requested transaction size, the function will return 0 +before allocating an sgt or setting the fields of the dma_xfer struct. +In that case, encode_addr_size_pairs() will try to access the sgt which +will lead to a general protection fault. + +Return an EINVAL in case the user provides a zero-sized ALP, or the device +requests continuation after all of the bytes have been transferred. + +Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") +Signed-off-by: Youssef Samir +Signed-off-by: Youssef Samir +Reviewed-by: Jeff Hugo +Reviewed-by: Carl Vanderlip +Signed-off-by: Jeff Hugo +Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/accel/qaic/qaic_control.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c +index f3db3fa91dd52..08b78f5678532 100644 +--- a/drivers/accel/qaic/qaic_control.c ++++ b/drivers/accel/qaic/qaic_control.c +@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, + return -EINVAL; + remaining = in_trans->size - resources->xferred_dma_size; + if (remaining == 0) +- return 0; ++ return -EINVAL; + + if (check_add_overflow(xfer_start_addr, remaining, &end)) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch b/queue-6.6/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch new file mode 100644 index 0000000000..7e6b9d3fdd --- /dev/null +++ b/queue-6.6/alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch @@ -0,0 +1,39 @@ +From 64ac609e8703199470096d3540bec51928d6395d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:05:52 -0700 +Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ] + +Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. + +Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' +Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' + +Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") +Signed-off-by: Randy Dunlap +Reviewed-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index 775db3fc4959f..ec10270c2cce3 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -32,7 +32,7 @@ + * allows 5 times as large as IEC 61883-6 defines. + * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include + * valid EOH. +- * @CIP_NO_HEADERS: a lack of headers in packets ++ * @CIP_NO_HEADER: a lack of headers in packets + * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch b/queue-6.6/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch new file mode 100644 index 0000000000..002a29ccbc --- /dev/null +++ b/queue-6.6/alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch @@ -0,0 +1,50 @@ +From 919edb8699e182037458d566370fe985149bcbfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 13:16:45 +0800 +Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card + +From: Jiaming Zhang + +[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ] + +In try_to_register_card(), the return value of usb_ifnum_to_if() is +passed directly to usb_interface_claimed() without a NULL check, which +will lead to a NULL pointer dereference when creating an invalid +USB audio device. Fix this by adding a check to ensure the interface +pointer is valid before passing it to usb_interface_claimed(). + +Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") +Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ +Signed-off-by: Jiaming Zhang +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 7743ea983b1a8..9335bc20c56df 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -754,10 +754,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id) + */ + static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) + { ++ struct usb_interface *iface; ++ + if (check_delayed_register_option(chip) == ifnum || +- chip->last_iface == ifnum || +- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) ++ chip->last_iface == ifnum) ++ return snd_card_register(chip->card); ++ ++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface); ++ if (iface && usb_interface_claimed(iface)) + return snd_card_register(chip->card); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch b/queue-6.6/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch new file mode 100644 index 0000000000..c3455b19ca --- /dev/null +++ b/queue-6.6/amd-xgbe-avoid-spurious-link-down-messages-during-in.patch @@ -0,0 +1,56 @@ +From 8bd76c534410eab5cbe0b4ca434f84e44dbb9225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 12:21:42 +0530 +Subject: amd-xgbe: Avoid spurious link down messages during interface toggle + +From: Raju Rangoju + +[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ] + +During interface toggle operations (ifdown/ifup), the driver currently +resets the local helper variable 'phy_link' to -1. This causes the link +state machine to incorrectly interpret the state as a link change event, +resulting in spurious "Link is down" messages being logged when the +interface is brought back up. + +Preserve the phy_link state across interface toggles to avoid treating +the -1 sentinel value as a legitimate link state transition. + +Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") +Signed-off-by: Raju Rangoju +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 - + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 34d45cebefb5d..b4d57da71de2a 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata) + + static int xgbe_phy_reset(struct xgbe_prv_data *pdata) + { +- pdata->phy_link = -1; + pdata->phy_speed = SPEED_UNKNOWN; + + return pdata->phy_if.phy_reset(pdata); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 8345d439184eb..63012119f2c8e 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1664,6 +1664,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + pdata->phy.duplex = DUPLEX_FULL; + } + ++ pdata->phy_link = 0; + pdata->phy.link = 0; + + pdata->phy.pause_autoneg = pdata->pause_autoneg; +-- +2.51.0 + diff --git a/queue-6.6/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch b/queue-6.6/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch new file mode 100644 index 0000000000..3213195324 --- /dev/null +++ b/queue-6.6/asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch @@ -0,0 +1,54 @@ +From 3ec991bd6f0a6a78d31c457a1fef016cef122c14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 19:03:13 +0200 +Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec + +From: Christophe Leroy + +[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ] + +The gain ranges specified in Renesas IDT821034 codec documentation +are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the +receive path (DAC). Allthough the registers allow programming values +outside those ranges, the signal S/N and distorsion are only +guaranteed in the specified ranges. + +Set ranges to the specified ones. + +Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec") +Signed-off-by: Christophe Leroy +Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/idt821034.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c +index 2cc7b9166e695..068a5448e273e 100644 +--- a/sound/soc/codecs/idt821034.c ++++ b/sound/soc/codecs/idt821034.c +@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol, + return ret; + } + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306); +-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */ +-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300); ++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */ ++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */ + #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */ + +-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029); +-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/ +-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */ ++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300); ++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */ ++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */ + #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */ + + static const struct snd_kcontrol_new idt821034_controls[] = { +-- +2.51.0 + diff --git a/queue-6.6/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch b/queue-6.6/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch new file mode 100644 index 0000000000..0a903ab42c --- /dev/null +++ b/queue-6.6/asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch @@ -0,0 +1,103 @@ +From a0c2268c8be79db09489618842fe8bb02ffc7928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:26 +0300 +Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit + +From: Cristian Ciocaltea + +[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ] + +Stress testing the audio jack hotplug handling on a few Steam Deck units +revealed that the debounce circuit is responsible for having a negative +impact on the detection reliability, e.g. in some cases the ejection +interrupt is not fired, while in other instances it goes into a kind of +invalid state and generates a flood of misleading interrupts. + +Add new entries to the DMI table introduced via commit 1bc40efdaf4a +("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") +and extend the quirk logic to allow bypassing the debounce circuit used +for jack detection on Valve Steam Deck LCD and OLED models. + +While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to +NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability +by differentiating from similarly named register bits. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 432b47340dbc7..48ed75c3a7db2 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -26,7 +26,8 @@ + #include + #include "nau8821.h" + +-#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0) ++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1) + + static int nau8821_quirk; + static int quirk_override = -1; +@@ -1171,9 +1172,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821) + regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2, + NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE); + +- /* Not bypass de-bounce circuit */ +- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, +- NAU8821_JACK_DET_DB_BYPASS, 0); ++ /* Do not bypass de-bounce circuit */ ++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)) ++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL, ++ NAU8821_JACK_DET_DB_BYPASS, 0); + + regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK, + NAU8821_IRQ_EJECT_EN, 0); +@@ -1854,7 +1856,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), + DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), + }, +- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH), ++ }, ++ { ++ /* Valve Steam Deck LCD */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), ++ }, ++ { ++ /* Valve Steam Deck OLED */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), ++ }, ++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS), + }, + {} + }; +@@ -1896,9 +1914,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821_check_quirks(); + +- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH) + nau8821->jkdet_polarity = 0; + ++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS) ++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n"); ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.51.0 + diff --git a/queue-6.6/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch b/queue-6.6/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch new file mode 100644 index 0000000000..412b314a96 --- /dev/null +++ b/queue-6.6/asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch @@ -0,0 +1,61 @@ +From 3889e1389fb3916a5a134f7b059afef0912dbefe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:23 +0300 +Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection + +From: Cristian Ciocaltea + +[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ] + +The microphone detection work scheduled by a prior jack insertion +interrupt may still be in a pending state or under execution when a jack +ejection interrupt has been fired. + +This might lead to a racing condition or nau8821_jdet_work() completing +after nau8821_eject_jack(), which will override the currently +disconnected state of the jack and incorrectly report the headphone or +the headset as being connected. + +Cancel any pending jdet_work or wait for its execution to finish before +attempting to handle the ejection interrupt. + +Proceed similarly before launching the eject handler as a consequence of +detecting an invalid insert interrupt. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index f307374834b55..ee65707a7827e 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1191,6 +1191,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + + if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) == + NAU8821_JACK_EJECT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_DIS); + nau8821_eject_jack(nau8821); +@@ -1205,11 +1206,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) + clear_irq = NAU8821_KEY_RELEASE_IRQ; + } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) == + NAU8821_JACK_INSERT_DETECTED) { ++ cancel_work_sync(&nau8821->jdet_work); + regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1, + NAU8821_MICDET_MASK, NAU8821_MICDET_EN); + if (nau8821_is_jack_inserted(regmap)) { + /* detect microphone and jack type */ +- cancel_work_sync(&nau8821->jdet_work); + schedule_work(&nau8821->jdet_work); + /* Turn off insertion interruption at manual mode */ + regmap_update_bits(regmap, +-- +2.51.0 + diff --git a/queue-6.6/asoc-nau8821-generalize-helper-to-clear-irq-status.patch b/queue-6.6/asoc-nau8821-generalize-helper-to-clear-irq-status.patch new file mode 100644 index 0000000000..3a2979bf36 --- /dev/null +++ b/queue-6.6/asoc-nau8821-generalize-helper-to-clear-irq-status.patch @@ -0,0 +1,78 @@ +From 46f16c52eae74515efe8fc8aa617995f95258aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Oct 2025 21:03:24 +0300 +Subject: ASoC: nau8821: Generalize helper to clear IRQ status + +From: Cristian Ciocaltea + +[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ] + +Instead of adding yet another utility function for dealing with the +interrupt clearing register, generalize nau8821_int_status_clear_all() +by renaming it to nau8821_irq_status_clear(), whilst introducing a +second parameter to allow restricting the operation scope to a single +interrupt instead of the whole range of active IRQs. + +While at it, also fix a spelling typo in the comment block. + +Note this is mainly a prerequisite for subsequent patches aiming to +address some deficiencies in the implementation of the interrupt +handler. Thus the presence of the Fixes tag below is intentional, to +facilitate backporting. + +Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index ee65707a7827e..432b47340dbc7 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1030,12 +1030,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap) + return active_high == is_high; + } + +-static void nau8821_int_status_clear_all(struct regmap *regmap) ++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq) + { +- int active_irq, clear_irq, i; ++ int clear_irq, i; + +- /* Reset the intrruption status from rightmost bit if the corres- +- * ponding irq event occurs. ++ if (active_irq) { ++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq); ++ return; ++ } ++ ++ /* Reset the interruption status from rightmost bit if the ++ * corresponding irq event occurs. + */ + regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq); + for (i = 0; i < NAU8821_REG_DATA_LEN; i++) { +@@ -1062,7 +1067,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821) + snd_soc_dapm_sync(dapm); + + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable the insertion interruption, disable the ejection inter- + * ruption, and then bypass de-bounce circuit. +@@ -1528,7 +1533,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821) + nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0); + if (nau8821->irq) { + /* Clear all interruption status */ +- nau8821_int_status_clear_all(regmap); ++ nau8821_irq_status_clear(regmap, 0); + + /* Enable both insertion and ejection interruptions, and then + * bypass de-bounce circuit. +-- +2.51.0 + diff --git a/queue-6.6/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch b/queue-6.6/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch new file mode 100644 index 0000000000..8cef7151aa --- /dev/null +++ b/queue-6.6/can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch @@ -0,0 +1,46 @@ +From 22232807739339d4373ec1c9fd97e4d3e84f7c2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 17:46:32 +0200 +Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() + +From: Marc Kleine-Budde + +[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ] + +Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to +m_can_platform") moved the PM runtime enable from the m_can core +driver into the m_can_platform. + +That patch forgot to move the pm_runtime_disable() to +m_can_plat_remove(), so that unloading the m_can_platform driver +causes an "Unbalanced pm_runtime_enable!" error message. + +Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the +problem. + +Cc: Patrik Flykt +Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") +Reviewed-by: Markus Schneider-Pargmann +Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index cdb28d6a092c6..e5477775992e6 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -183,7 +183,7 @@ static void m_can_plat_remove(struct platform_device *pdev) + struct m_can_classdev *mcan_class = &priv->cdev; + + m_can_class_unregister(mcan_class); +- ++ pm_runtime_disable(mcan_class->dev); + m_can_class_free_dev(mcan_class->net); + } + +-- +2.51.0 + diff --git a/queue-6.6/dax-skip-read-lock-assertion-for-read-only-filesyste.patch b/queue-6.6/dax-skip-read-lock-assertion-for-read-only-filesyste.patch new file mode 100644 index 0000000000..b205f8cb72 --- /dev/null +++ b/queue-6.6/dax-skip-read-lock-assertion-for-read-only-filesyste.patch @@ -0,0 +1,46 @@ +From 6ee84cf411dcd99ff719481f1ca35d1c87844595 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 13:42:57 +0800 +Subject: dax: skip read lock assertion for read-only filesystems + +From: Yuezhang Mo + +[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ] + +The commit 168316db3583("dax: assert that i_rwsem is held +exclusive for writes") added lock assertions to ensure proper +locking in DAX operations. However, these assertions trigger +false-positive lockdep warnings since read lock is unnecessary +on read-only filesystems(e.g., erofs). + +This patch skips the read lock assertion for read-only filesystems, +eliminating the spurious warnings while maintaining the integrity +checks for writable filesystems. + +Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") +Signed-off-by: Yuezhang Mo +Reviewed-by: Friendy Su +Reviewed-by: Daniel Palmer +Reviewed-by: Gao Xiang +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dax.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 8c09578fa0357..e1451efaab140 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1578,7 +1578,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + if (iov_iter_rw(iter) == WRITE) { + lockdep_assert_held_write(&iomi.inode->i_rwsem); + iomi.flags |= IOMAP_WRITE; +- } else { ++ } else if (!sb_rdonly(iomi.inode->i_sb)) { + lockdep_assert_held(&iomi.inode->i_rwsem); + } + +-- +2.51.0 + diff --git a/queue-6.6/doc-fix-seg6_flowlabel-path.patch b/queue-6.6/doc-fix-seg6_flowlabel-path.patch new file mode 100644 index 0000000000..5e8c420412 --- /dev/null +++ b/queue-6.6/doc-fix-seg6_flowlabel-path.patch @@ -0,0 +1,38 @@ +From 0aa0147256be2354566a0f22a5e7d2b4fcdc2c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 16:18:59 +0200 +Subject: doc: fix seg6_flowlabel path + +From: Nicolas Dichtel + +[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ] + +This sysctl is not per interface; it's global per netns. + +Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") +Reported-by: Philippe Guibert +Signed-off-by: Nicolas Dichtel +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/seg6-sysctl.rst | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst +index 07c20e470bafe..1b6af4779be11 100644 +--- a/Documentation/networking/seg6-sysctl.rst ++++ b/Documentation/networking/seg6-sysctl.rst +@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER + + Default is 0. + ++/proc/sys/net/ipv6/seg6_* variables: ++==================================== ++ + seg6_flowlabel - INTEGER + Controls the behaviour of computing the flowlabel of outer + IPv6 header in case of SR T.encaps +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-powerplay-fix-cik-shutdown-temperature.patch b/queue-6.6/drm-amd-powerplay-fix-cik-shutdown-temperature.patch new file mode 100644 index 0000000000..2a09a16cc8 --- /dev/null +++ b/queue-6.6/drm-amd-powerplay-fix-cik-shutdown-temperature.patch @@ -0,0 +1,46 @@ +From 18e28e973a803cb1746daf5108f5955297ebb7e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 08:06:42 +0200 +Subject: drm/amd/powerplay: Fix CIK shutdown temperature +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ] + +Remove extra multiplication. + +CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case +the shutdown temperature is hardcoded in smu7_init_dpm_defaults +and is already multiplied by 1000. The value was mistakenly +multiplied another time by smu7_get_thermal_temperature_range. + +Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 53849fd3615f6..965ffcac17f86 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -5437,8 +5437,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr, + thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp * + PP_TEMPERATURE_UNITS_PER_CENTIGRADES; + else if (hwmgr->pp_table_version == PP_TABLE_V0) +- thermal_data->max = data->thermal_temp_setting.temperature_shutdown * +- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; ++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown; + + thermal_data->sw_ctf_threshold = thermal_data->max; + +-- +2.51.0 + diff --git a/queue-6.6/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch b/queue-6.6/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch new file mode 100644 index 0000000000..e755b69b83 --- /dev/null +++ b/queue-6.6/drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch @@ -0,0 +1,45 @@ +From 286da28eca56d5d9c0feadbec2132591939fb8aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 12:59:53 +0200 +Subject: drm/bridge: lt9211: Drop check for last nibble of version register + +From: Marek Vasut + +[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ] + +There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . +The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the +driver checks for right now. Since there is a possibility there will be +yet another revision of the LT9211 in the future, drop the last version +nibble check to allow all future revisions of the chip to work with this +driver. + +This fix makes LT9211 rev. U5 work with this driver. + +Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c +index 4d404f5ef87eb..ea192c90b543e 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9211.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c +@@ -120,8 +120,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx) + } + + /* Test for known Chip ID. */ +- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE || +- chipid[2] != REG_CHIPID2_VALUE) { ++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) { + dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n", + chipid[0], chipid[1], chipid[2]); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/drm-i915-guc-skip-communication-warning-on-reset-in-.patch b/queue-6.6/drm-i915-guc-skip-communication-warning-on-reset-in-.patch new file mode 100644 index 0000000000..aa619d443f --- /dev/null +++ b/queue-6.6/drm-i915-guc-skip-communication-warning-on-reset-in-.patch @@ -0,0 +1,52 @@ +From 7d8bb8abdc6c5e9a9b1beeb7f4b2bebdf2389955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:29:04 -0400 +Subject: drm/i915/guc: Skip communication warning on reset in progress + +From: Zhanjun Dong + +[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ] + +GuC IRQ and tasklet handler receive just single G2H message, and let other +messages to be received from next tasklet. During this chained tasklet +process, if reset process started, communication will be disabled. +Skip warning for this condition. + +Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018 +Signed-off-by: Zhanjun Dong +Reviewed-by: Vinay Belgaumkar +Signed-off-by: Daniele Ceraolo Spurio +Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com +(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +index 97eadd08181d6..38fad14ffd435 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c +@@ -1281,9 +1281,16 @@ static int ct_receive(struct intel_guc_ct *ct) + + static void ct_try_receive_message(struct intel_guc_ct *ct) + { ++ struct intel_guc *guc = ct_to_guc(ct); + int ret; + +- if (GEM_WARN_ON(!ct->enabled)) ++ if (!ct->enabled) { ++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress); ++ return; ++ } ++ ++ /* When interrupt disabled, message handling is not expected */ ++ if (!guc->interrupts.enabled) + return; + + ret = ct_receive(ct); +-- +2.51.0 + diff --git a/queue-6.6/drm-rockchip-vop2-use-correct-destination-rectangle-.patch b/queue-6.6/drm-rockchip-vop2-use-correct-destination-rectangle-.patch new file mode 100644 index 0000000000..ea1ec6de45 --- /dev/null +++ b/queue-6.6/drm-rockchip-vop2-use-correct-destination-rectangle-.patch @@ -0,0 +1,40 @@ +From fcd0f4105bf1417f1dcff85f92e91e0afecff39c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 07:20:01 -0700 +Subject: drm/rockchip: vop2: use correct destination rectangle height check + +From: Alok Tiwari + +[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ] + +The vop2_plane_atomic_check() function incorrectly checks +drm_rect_width(dest) twice instead of verifying both width and height. +Fix the second condition to use drm_rect_height(dest) so that invalid +destination rectangles with height < 4 are correctly rejected. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Alok Tiwari +Reviewed-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 0193d10867dd2..97486eba01b7b 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -984,7 +984,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane, + return format; + + if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 || +- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) { ++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) { + drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n", + drm_rect_width(src) >> 16, drm_rect_height(src) >> 16, + drm_rect_width(dest), drm_rect_height(dest)); +-- +2.51.0 + diff --git a/queue-6.6/hid-hid-input-only-ignore-0-battery-events-for-digit.patch b/queue-6.6/hid-hid-input-only-ignore-0-battery-events-for-digit.patch new file mode 100644 index 0000000000..55f7149a47 --- /dev/null +++ b/queue-6.6/hid-hid-input-only-ignore-0-battery-events-for-digit.patch @@ -0,0 +1,53 @@ +From 208de4e7281d4ec04244e431b73212d72656427e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 21:28:44 -0700 +Subject: HID: hid-input: only ignore 0 battery events for digitizers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ] + +Commit 581c4484769e ("HID: input: map digitizer battery usage") added +handling of battery events for digitizers (typically for batteries +presented in stylii). Digitizers typically report correct battery levels +only when stylus is actively touching the surface, and in other cases +they may report battery level of 0. To avoid confusing consumers of the +battery information the code was added to filer out reports with 0 +battery levels. + +However there exist other kinds of devices that may legitimately report +0 battery levels. Fix this by filtering out 0-level reports only for +digitizer usages, and continue reporting them for other kinds of devices +(Smart Batteries, etc). + +Reported-by: 卢国宏 +Fixes: 581c4484769e ("HID: input: map digitizer battery usage") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f5c217ac4bfaa..f073d5621050a 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage, + return; + } + +- if (value == 0 || value < dev->battery_min || value > dev->battery_max) ++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0) ++ return; ++ ++ if (value < dev->battery_min || value > dev->battery_max) + return; + + capacity = hidinput_scale_battery_capacity(dev, value); +-- +2.51.0 + diff --git a/queue-6.6/hid-multitouch-fix-name-of-stylus-input-devices.patch b/queue-6.6/hid-multitouch-fix-name-of-stylus-input-devices.patch new file mode 100644 index 0000000000..adebf0c7e4 --- /dev/null +++ b/queue-6.6/hid-multitouch-fix-name-of-stylus-input-devices.patch @@ -0,0 +1,51 @@ +From d48f4cd119da911aec61a346c61e6772efa8844c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 09:40:33 -0300 +Subject: HID: multitouch: fix name of Stylus input devices + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ] + +HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by +commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). +However, on multitouch devices, these suffixes may be overridden. Before +that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after +that, multitouch would override them to have an "UNKNOWN" suffix. Just add +HID_DG_PEN to the list of non-overriden suffixes in multitouch. + +Before this fix: + +[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 +ELAN9008:00 04F3:2E14 UNKNOWN + +After this fix: + +[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 + +ELAN9008:00 04F3:2E14 Stylus + +Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Mika Westerberg +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6f1e54ee8f05d..b9e67b408a4b9 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1658,6 +1658,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + case HID_CP_CONSUMER_CONTROL: + case HID_GD_WIRELESS_RADIO_CTLS: + case HID_GD_SYSTEM_MULTIAXIS: ++ case HID_DG_PEN: + /* already handled by hid core */ + break; + case HID_DG_TOUCHSCREEN: +-- +2.51.0 + diff --git a/queue-6.6/net-dlink-handle-dma_map_single-failure-properly.patch b/queue-6.6/net-dlink-handle-dma_map_single-failure-properly.patch new file mode 100644 index 0000000000..b7fdf4f401 --- /dev/null +++ b/queue-6.6/net-dlink-handle-dma_map_single-failure-properly.patch @@ -0,0 +1,74 @@ +From e9d82c33be38fef2de799e060bbbe21fda20e95f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Oct 2025 00:57:16 +0900 +Subject: net: dlink: handle dma_map_single() failure properly + +From: Yeounsu Moon + +[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ] + +There is no error handling for `dma_map_single()` failures. + +Add error handling by checking `dma_mapping_error()` and freeing +the `skb` using `dev_kfree_skb()` (process context) when it fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yeounsu Moon +Tested-on: D-Link DGE-550T Rev-A3 +Suggested-by: Simon Horman +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 1c3a5cf379cd0..72c97dcd0fee0 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev) + for (i = 0; i < RX_RING_SIZE; i++) { + /* Allocated fixed size of skbuff */ + struct sk_buff *skb; ++ dma_addr_t addr; + + skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz); + np->rx_skbuff[i] = skb; +- if (!skb) { +- free_list(dev); +- return -ENOMEM; +- } ++ if (!skb) ++ goto err_free_list; ++ ++ addr = dma_map_single(&np->pdev->dev, skb->data, ++ np->rx_buf_sz, DMA_FROM_DEVICE); ++ if (dma_mapping_error(&np->pdev->dev, addr)) ++ goto err_kfree_skb; + + np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma + + ((i + 1) % RX_RING_SIZE) * + sizeof(struct netdev_desc)); + /* Rubicon now supports 40 bits of addressing space. */ +- np->rx_ring[i].fraginfo = +- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data, +- np->rx_buf_sz, DMA_FROM_DEVICE)); ++ np->rx_ring[i].fraginfo = cpu_to_le64(addr); + np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48); + } + + return 0; ++ ++err_kfree_skb: ++ dev_kfree_skb(np->rx_skbuff[i]); ++ np->rx_skbuff[i] = NULL; ++err_free_list: ++ free_list(dev); ++ return -ENOMEM; + } + + static void rio_hw_init(struct net_device *dev) +-- +2.51.0 + diff --git a/queue-6.6/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch b/queue-6.6/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch new file mode 100644 index 0000000000..2da8eb98b6 --- /dev/null +++ b/queue-6.6/net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch @@ -0,0 +1,100 @@ +From 177b9596da1c144402d39aff2c007c98df14a86c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 16:02:19 +0100 +Subject: net/ip6_tunnel: Prevent perpetual tunnel growth + +From: Dmitry Safonov + +[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ] + +Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. +While ipv4 tunnel headroom adjustment growth was limited in +commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), +ipv6 tunnel yet increases the headroom without any ceiling. + +Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. + +Credits to Francesco Ruggeri, who was originally debugging this issue +and wrote local Arista-specific patch and a reproducer. + +Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") +Cc: Florian Westphal +Cc: Francesco Ruggeri +Signed-off-by: Dmitry Safonov +Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 15 +++++++++++++++ + net/ipv4/ip_tunnel.c | 14 -------------- + net/ipv6/ip6_tunnel.c | 3 +-- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 006a61ddd36fa..3d36794cb1899 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -489,6 +489,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md, + int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst, + int headroom, bool reply); + ++static inline void ip_tunnel_adj_headroom(struct net_device *dev, ++ unsigned int headroom) ++{ ++ /* we must cap headroom to some upperlimit, else pskb_expand_head ++ * will overflow header offsets in skb_headers_offset_update(). ++ */ ++ const unsigned int max_allowed = 512; ++ ++ if (headroom > max_allowed) ++ headroom = max_allowed; ++ ++ if (headroom > READ_ONCE(dev->needed_headroom)) ++ WRITE_ONCE(dev->needed_headroom, headroom); ++} ++ + int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask); + + static inline int iptunnel_pull_offloads(struct sk_buff *skb) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index b5d64cd3ab0a2..090403c8cc6c3 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + return 0; + } + +-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +-{ +- /* we must cap headroom to some upperlimit, else pskb_expand_head +- * will overflow header offsets in skb_headers_offset_update(). +- */ +- static const unsigned int max_allowed = 512; +- +- if (headroom > max_allowed) +- headroom = max_allowed; +- +- if (headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, headroom); +-} +- + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + u8 proto, int tunnel_hlen) + { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index d645d022ce774..e635ddd41aba6 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1255,8 +1255,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + */ + max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + + dst->header_len + t->hlen; +- if (max_headroom > READ_ONCE(dev->needed_headroom)) +- WRITE_ONCE(dev->needed_headroom, max_headroom); ++ ip_tunnel_adj_headroom(dev, max_headroom); + + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) +-- +2.51.0 + diff --git a/queue-6.6/net-tls-wait-for-async-completion-on-last-message.patch b/queue-6.6/net-tls-wait-for-async-completion-on-last-message.patch new file mode 100644 index 0000000000..3759ec4c55 --- /dev/null +++ b/queue-6.6/net-tls-wait-for-async-completion-on-last-message.patch @@ -0,0 +1,52 @@ +From 85bbbe5387408bf3b75a443b2f8ae3ead2aa5f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2024 14:17:41 +0200 +Subject: net: tls: wait for async completion on last message + +From: Sascha Hauer + +[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ] + +When asynchronous encryption is used KTLS sends out the final data at +proto->close time. This becomes problematic when the task calling +close() receives a signal. In this case it can happen that +tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the +final data is not sent. + +The described situation happens when KTLS is used in conjunction with +io_uring, as io_uring uses task_work_add() to add work to the current +userspace task. A discussion of the problem along with a reproducer can +be found in [1] and [2] + +Fix this by waiting for the asynchronous encryption to be completed on +the final message. With this there is no data left to be sent at close +time. + +[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/ +[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/ + +Signed-off-by: Sascha Hauer +Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 21276ac1f81dc..1f22c7adf3e56 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1228,7 +1228,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + + if (!num_async) { + goto send_end; +- } else if (num_zc) { ++ } else if (num_zc || eor) { + int err; + + /* Wait for pending encryptions to get completed */ +-- +2.51.0 + diff --git a/queue-6.6/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch b/queue-6.6/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch new file mode 100644 index 0000000000..a620c15916 --- /dev/null +++ b/queue-6.6/net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch @@ -0,0 +1,96 @@ +From 7820a5ec4727ced7ad70957aab1a9d31e48416de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:07:42 +0100 +Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address + +From: Oleksij Rempel + +[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ] + +Convert `lan78xx_init_mac_address` to return error codes and handle +failures in register read and write operations. Update `lan78xx_reset` +to check for errors during MAC address initialization and propagate them +appropriately. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index ec5689cd240aa..712530d6738fa 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1940,13 +1940,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = { + .get_regs = lan78xx_get_regs, + }; + +-static void lan78xx_init_mac_address(struct lan78xx_net *dev) ++static int lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; + u8 addr[6]; ++ int ret; ++ ++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ if (ret < 0) ++ return ret; + +- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ if (ret < 0) ++ return ret; + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1979,14 +1985,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ if (ret < 0) ++ return ret; + } + +- lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ if (ret < 0) ++ return ret; ++ ++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ if (ret < 0) ++ return ret; + + eth_hw_addr_set(dev->net, addr); ++ ++ return 0; + } + + /* MDIO read and write wrappers for phylib */ +@@ -2910,7 +2928,9 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- lan78xx_init_mac_address(dev); ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; + + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); +-- +2.51.0 + diff --git a/queue-6.6/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch b/queue-6.6/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch new file mode 100644 index 0000000000..1388b92dfe --- /dev/null +++ b/queue-6.6/net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch @@ -0,0 +1,63 @@ +From 9f8d03a4d5f6ab2aa77b434f5ac64ee26d16d152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 23:46:48 +0530 +Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in + lan78xx_reset + +From: I Viswanath + +[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ] + +dev->chipid is used in lan78xx_init_mac_address before it's initialized: + +lan78xx_reset() { + lan78xx_init_mac_address() + lan78xx_read_eeprom() + lan78xx_read_raw_eeprom() <- dev->chipid is used here + + dev->chipid = ... <- dev->chipid is initialized correctly here +} + +Reorder initialization so that dev->chipid is set before calling +lan78xx_init_mac_address(). + +Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") +Signed-off-by: I Viswanath +Reviewed-by: Vadim Fedorenko +Reviewed-by: Khalid Aziz +Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 712530d6738fa..121f1c15c6793 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2928,10 +2928,6 @@ static int lan78xx_reset(struct lan78xx_net *dev) + } + } while (buf & HW_CFG_LRST_); + +- ret = lan78xx_init_mac_address(dev); +- if (ret < 0) +- return ret; +- + /* save DEVID for later usage */ + ret = lan78xx_read_reg(dev, ID_REV, &buf); + if (ret < 0) +@@ -2940,6 +2936,10 @@ static int lan78xx_reset(struct lan78xx_net *dev) + dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16; + dev->chiprev = buf & ID_REV_CHIP_REV_MASK_; + ++ ret = lan78xx_init_mac_address(dev); ++ if (ret < 0) ++ return ret; ++ + /* Respond to the IN token with a NAK */ + ret = lan78xx_read_reg(dev, USB_CFG0, &buf); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.6/nvme-multipath-skip-nr_active-increments-in-retry-di.patch b/queue-6.6/nvme-multipath-skip-nr_active-increments-in-retry-di.patch new file mode 100644 index 0000000000..30d71669c4 --- /dev/null +++ b/queue-6.6/nvme-multipath-skip-nr_active-increments-in-retry-di.patch @@ -0,0 +1,60 @@ +From 5f4285f9090d5141c4da7cbcbebd9c54ec0b027c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 12:08:22 -0700 +Subject: nvme-multipath: Skip nr_active increments in RETRY disposition + +From: Amit Chaudhary + +[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ] + +For queue-depth I/O policy, this patch fixes unbalanced I/Os across +nvme multipaths. + +Issue Description: + +The RETRY disposition incorrectly increments ns->ctrl->nr_active +counter and reinitializes iostat start-time. In such cases nr_active +counter never goes back to zero until that path disconnects and +reconnects. + +Such a path is not chosen for new I/Os if multiple RETRY cases on a given +a path cause its queue-depth counter to be artificially higher compared +to other paths. This leads to unbalanced I/Os across paths. + +The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already +set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set. + +base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a +Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device") +Signed-off-by: Amit Chaudhary +Reviewed-by: Randy Jennings +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 119afdfe4b91e..57416bbf9344f 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -131,12 +131,14 @@ void nvme_mpath_start_request(struct request *rq) + struct nvme_ns *ns = rq->q->queuedata; + struct gendisk *disk = ns->head->disk; + +- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) { ++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) && ++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) { + atomic_inc(&ns->ctrl->nr_active); + nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE; + } + +- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq)) ++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) || ++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS)) + return; + + nvme_req(rq)->flags |= NVME_MPATH_IO_STATS; +-- +2.51.0 + diff --git a/queue-6.6/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch b/queue-6.6/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch new file mode 100644 index 0000000000..cb74afd66f --- /dev/null +++ b/queue-6.6/r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch @@ -0,0 +1,51 @@ +From 1f3d83fb4531f0384313e08a07572c62f9a53fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Oct 2025 20:25:49 +0800 +Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H + +From: Linmao Li + +[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ] + +After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming +packets. Packet captures show messages like "IP truncated-ip - 146 bytes +missing!". + +The issue is caused by RxConfig not being properly re-initialized after +resume. Re-initializing the RxConfig register before the chip +re-initialization sequence avoids the truncation and restores correct +packet reception. + +This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data +corruption issue on RTL8402"). + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: Linmao Li +Reviewed-by: Jacob Keller +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 5af932a5e70c4..3b90f257e94f8 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4919,8 +4919,9 @@ static int rtl8169_resume(struct device *device) + if (!device_may_wakeup(tp_to_dev(tp))) + clk_prepare_enable(tp->clk); + +- /* Reportedly at least Asus X453MA truncates packets otherwise */ +- if (tp->mac_version == RTL_GIGA_MAC_VER_37) ++ /* Some chip versions may truncate packets without this initialization */ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 || ++ tp->mac_version == RTL_GIGA_MAC_VER_46) + rtl_init_rxcfg(tp); + + return rtl8169_runtime_resume(device); +-- +2.51.0 + diff --git a/queue-6.6/riscv-kprobes-fix-probe-address-validation.patch b/queue-6.6/riscv-kprobes-fix-probe-address-validation.patch new file mode 100644 index 0000000000..6eade74b2f --- /dev/null +++ b/queue-6.6/riscv-kprobes-fix-probe-address-validation.patch @@ -0,0 +1,64 @@ +From cf0f97a958da546e74181ea2174a15ede71f7788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:25:13 +0200 +Subject: riscv: kprobes: Fix probe address validation + +From: Fabian Vogt + +[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ] + +When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", +arch_check_kprobe would start iterating all instructions starting from +_text until the probed address. Not only is this very inefficient, but +literal values in there (e.g. left by function patching) are +misinterpreted in a way that causes a desync. + +Fix this by doing it like x86: start the iteration at the closest +preceding symbol instead of the given starting point. + +Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") +Signed-off-by: Fabian Vogt +Signed-off-by: Marvin Friedrich +Acked-by: Guo Ren +Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index 297427ffc4e04..8a6ea7d270188 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + +-static bool __kprobes arch_check_kprobe(struct kprobe *p) ++static bool __kprobes arch_check_kprobe(unsigned long addr) + { +- unsigned long tmp = (unsigned long)p->addr - p->offset; +- unsigned long addr = (unsigned long)p->addr; ++ unsigned long tmp, offset; ++ ++ /* start iterating at the closest preceding symbol */ ++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset)) ++ return false; ++ ++ tmp = addr - offset; + + while (tmp <= addr) { + if (tmp == addr) +@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if ((unsigned long)insn & 0x1) + return -EILSEQ; + +- if (!arch_check_kprobe(p)) ++ if (!arch_check_kprobe((unsigned long)p->addr)) + return -EILSEQ; + + /* copy instruction */ +-- +2.51.0 + diff --git a/queue-6.6/sched-balancing-rename-newidle_balance-sched_balance.patch b/queue-6.6/sched-balancing-rename-newidle_balance-sched_balance.patch new file mode 100644 index 0000000000..003f5cce77 --- /dev/null +++ b/queue-6.6/sched-balancing-rename-newidle_balance-sched_balance.patch @@ -0,0 +1,95 @@ +From 9fe0b1ccb788a857cb642b5c60989bda4b823761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 12:18:16 +0100 +Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle() + +From: Ingo Molnar + +[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ] + +Standardize scheduler load-balancing function names on the +sched_balance_() prefix. + +Signed-off-by: Ingo Molnar +Reviewed-by: Shrikanth Hegde +Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org +Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 1cf43e91ae9de..84d5caf6230f6 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4829,7 +4829,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq) + return cfs_rq->avg.load_avg; + } + +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf); ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf); + + static inline unsigned long task_util(struct task_struct *p) + { +@@ -5158,7 +5158,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + static inline void + detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {} + +-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) ++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf) + { + return 0; + } +@@ -8281,7 +8281,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) + if (rq->nr_running) + return 1; + +- return newidle_balance(rq, rf) != 0; ++ return sched_balance_newidle(rq, rf) != 0; + } + #endif /* CONFIG_SMP */ + +@@ -8531,10 +8531,10 @@ done: __maybe_unused; + if (!rf) + return NULL; + +- new_tasks = newidle_balance(rq, rf); ++ new_tasks = sched_balance_newidle(rq, rf); + + /* +- * Because newidle_balance() releases (and re-acquires) rq->lock, it is ++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is + * possible for any higher priority task to appear. In that case we + * must re-start the pick_next_entity() loop. + */ +@@ -11542,7 +11542,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, + ld_moved = 0; + + /* +- * newidle_balance() disregards balance intervals, so we could ++ * sched_balance_newidle() disregards balance intervals, so we could + * repeatedly reach this code, which would lead to balance_interval + * skyrocketing in a short amount of time. Skip the balance_interval + * increase logic to avoid that. +@@ -12308,7 +12308,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + #endif /* CONFIG_NO_HZ_COMMON */ + + /* +- * newidle_balance is called by schedule() if this_cpu is about to become ++ * sched_balance_newidle is called by schedule() if this_cpu is about to become + * idle. Attempts to pull tasks from other CPUs. + * + * Returns: +@@ -12316,7 +12316,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { } + * 0 - failed, no new tasks + * > 0 - success, new (fair) tasks present + */ +-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) ++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf) + { + unsigned long next_balance = jiffies + HZ; + int this_cpu = this_rq->cpu; +-- +2.51.0 + diff --git a/queue-6.6/sched-fair-fix-pelt-lost-idle-time-detection.patch b/queue-6.6/sched-fair-fix-pelt-lost-idle-time-detection.patch new file mode 100644 index 0000000000..59c706bcbd --- /dev/null +++ b/queue-6.6/sched-fair-fix-pelt-lost-idle-time-detection.patch @@ -0,0 +1,67 @@ +From f72348b7890fd38dcb6ed9c93147918c78e7b08d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:12:14 +0200 +Subject: sched/fair: Fix pelt lost idle time detection + +From: Vincent Guittot + +[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ] + +The check for some lost idle pelt time should be always done when +pick_next_task_fair() fails to pick a task and not only when we call it +from the fair fast-path. + +The case happens when the last running task on rq is a RT or DL task. When +the latter goes to sleep and the /Sum of util_sum of the rq is at the max +value, we don't account the lost of idle time whereas we should. + +Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 84d5caf6230f6..58231999d929e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -8528,21 +8528,21 @@ done: __maybe_unused; + return p; + + idle: +- if (!rf) +- return NULL; +- +- new_tasks = sched_balance_newidle(rq, rf); ++ if (rf) { ++ new_tasks = sched_balance_newidle(rq, rf); + +- /* +- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is +- * possible for any higher priority task to appear. In that case we +- * must re-start the pick_next_entity() loop. +- */ +- if (new_tasks < 0) +- return RETRY_TASK; ++ /* ++ * Because sched_balance_newidle() releases (and re-acquires) ++ * rq->lock, it is possible for any higher priority task to ++ * appear. In that case we must re-start the pick_next_entity() ++ * loop. ++ */ ++ if (new_tasks < 0) ++ return RETRY_TASK; + +- if (new_tasks > 0) +- goto again; ++ if (new_tasks > 0) ++ goto again; ++ } + + /* + * rq is about to be idle, check if we need to update the +-- +2.51.0 + diff --git a/queue-6.6/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch b/queue-6.6/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch new file mode 100644 index 0000000000..611878b768 --- /dev/null +++ b/queue-6.6/selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch @@ -0,0 +1,42 @@ +From bff5eba5560571ebea9699d6eae0b27f994fcd34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Oct 2025 11:53:30 +0800 +Subject: selftests: arg_parsing: Ensure data is flushed to disk before + reading. + +From: Xing Guo + +[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ] + +test_parse_test_list_file writes some data to +/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read +the data back. However, after writing data to that file, we forget to +call fsync() and it's causing testing failure in my laptop. This patch +helps fix it by adding the missing fsync() call. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Xing Guo +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index fbf0d9c2f58b3..e27d66b75fb1f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void) + if (!ASSERT_OK(ferror(fp), "prepare tmp")) + goto out_fclose; + ++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp")) ++ goto out_fclose; ++ + init_test_filter_set(&set); + + if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) +-- +2.51.0 + diff --git a/queue-6.6/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch b/queue-6.6/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch new file mode 100644 index 0000000000..31871b8bac --- /dev/null +++ b/queue-6.6/selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch @@ -0,0 +1,63 @@ +From b2db42f1b2a7b2816cd73390a66ce6ba22529cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 13:20:37 -0700 +Subject: selftests/bpf: make arg_parsing.c more robust to crashes + +From: Andrii Nakryiko + +[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ] + +We started getting a crash in BPF CI, which seems to originate from +test_parse_test_list_file() test and is happening at this line: + + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + +One way we can crash there is if set.cnt zero, which is checked for with +ASSERT_EQ() above, but we proceed after this regardless of the outcome. +Instead of crashing, we should bail out with test failure early. + +Similarly, if parse_test_list_file() fails, we shouldn't be even looking +at set, so bail even earlier if ASSERT_OK() fails. + +Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") +Signed-off-by: Andrii Nakryiko +Tested-by: Ihor Solodrai +Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +index bb143de68875c..fbf0d9c2f58b3 100644 +--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c ++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c +@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void) + + init_test_filter_set(&set); + +- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"); ++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file")) ++ goto out_fclose; ++ ++ if (!ASSERT_EQ(set.cnt, 4, "test count")) ++ goto out_free_set; + +- ASSERT_EQ(set.cnt, 4, "test count"); + ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); + ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count"); + ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name"); +@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void) + ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name"); + ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name"); + ++out_free_set: + free_test_filter_set(&set); +- + out_fclose: + fclose(fp); + out_remove: +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 41f2891ba8..5ac7c3f23d 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -32,3 +32,39 @@ usb-gadget-f_acm-refactor-bind-path-to-use-__free.patch usb-gadget-f_ncm-refactor-bind-path-to-use-__free.patch usb-gadget-f_rndis-refactor-bind-path-to-use-__free.patch hid-multitouch-fix-sticky-fingers.patch +dax-skip-read-lock-assertion-for-read-only-filesyste.patch +can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch +net-dlink-handle-dma_map_single-failure-properly.patch +doc-fix-seg6_flowlabel-path.patch +r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch +net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch +amd-xgbe-avoid-spurious-link-down-messages-during-in.patch +tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch +tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch +tls-trim-encrypted-message-to-match-the-plaintext-on.patch +net-tls-wait-for-async-completion-on-last-message.patch +tls-wait-for-async-encrypt-in-case-of-error-during-l.patch +tls-always-set-record_type-in-tls_process_cmsg.patch +tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch +tls-don-t-rely-on-tx_work-during-send.patch +net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch +net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch +nvme-multipath-skip-nr_active-increments-in-retry-di.patch +riscv-kprobes-fix-probe-address-validation.patch +drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch +asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch +asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch +asoc-nau8821-generalize-helper-to-clear-irq-status.patch +asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch +drm-i915-guc-skip-communication-warning-on-reset-in-.patch +drm-amd-powerplay-fix-cik-shutdown-temperature.patch +drm-rockchip-vop2-use-correct-destination-rectangle-.patch +sched-balancing-rename-newidle_balance-sched_balance.patch +sched-fair-fix-pelt-lost-idle-time-detection.patch +alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch +accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch +selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch +alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch +hid-hid-input-only-ignore-0-battery-events-for-digit.patch +hid-multitouch-fix-name-of-stylus-input-devices.patch +selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch diff --git a/queue-6.6/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch b/queue-6.6/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch new file mode 100644 index 0000000000..9761114138 --- /dev/null +++ b/queue-6.6/tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch @@ -0,0 +1,86 @@ +From 1b0d34d6bc6a5cfb5b2cc36289a9ceaedb0f9fc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Oct 2025 11:57:42 +0000 +Subject: tcp: fix tcp_tso_should_defer() vs large RTT + +From: Eric Dumazet + +[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ] + +Neal reported that using neper tcp_stream with TCP_TX_DELAY +set to 50ms would often lead to flows stuck in a small cwnd mode, +regardless of the congestion control. + +While tcp_stream sets TCP_TX_DELAY too late after the connect(), +it highlighted two kernel bugs. + +The following heuristic in tcp_tso_should_defer() seems wrong +for large RTT: + +delta = tp->tcp_clock_cache - head->tstamp; +/* If next ACK is likely to come too late (half srtt), do not defer */ +if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) + goto send_now; + +If next ACK is expected to come in more than 1 ms, we should +not defer because we prefer a smooth ACK clocking. + +While blamed commit was a step in the good direction, it was not +generic enough. + +Another patch fixing TCP_TX_DELAY for established flows +will be proposed when net-next reopens. + +Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") +Reported-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com +[pabeni@redhat.com: fixed whitespace issue] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 560273e7f7736..88551db62ca29 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2189,7 +2189,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + u32 max_segs) + { + const struct inet_connection_sock *icsk = inet_csk(sk); +- u32 send_win, cong_win, limit, in_flight; ++ u32 send_win, cong_win, limit, in_flight, threshold; ++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack; + struct tcp_sock *tp = tcp_sk(sk); + struct sk_buff *head; + int win_divisor; +@@ -2251,9 +2252,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, + head = tcp_rtx_queue_head(sk); + if (!head) + goto send_now; +- delta = tp->tcp_clock_cache - head->tstamp; +- /* If next ACK is likely to come too late (half srtt), do not defer */ +- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) ++ ++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us; ++ /* When is the ACK expected ? */ ++ expected_ack = head->tstamp + srtt_in_ns; ++ /* How far from now is the ACK expected ? */ ++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache; ++ ++ /* If next ACK is likely to come too late, ++ * ie in more than min(1ms, half srtt), do not defer. ++ */ ++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC); ++ ++ if ((s64)(how_far_is_the_ack - threshold) > 0) + goto send_now; + + /* Ok, it looks like it is advisable to defer. +-- +2.51.0 + diff --git a/queue-6.6/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch b/queue-6.6/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch new file mode 100644 index 0000000000..d9e109cd51 --- /dev/null +++ b/queue-6.6/tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch @@ -0,0 +1,53 @@ +From 15c3eab1c55760985b65f147d5053cdf77e5a4f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 19:47:38 +0300 +Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables + +From: Alexey Simakov + +[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ] + +Some execution paths that jump to the fiber_setup_done label +could leave the remote_adv and local_adv variables uninitialized +and then use it. + +Initialize this variables at the point of definition to avoid this. + +Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") +Co-developed-by: Alexandr Sapozhnikov +Signed-off-by: Alexandr Sapozhnikov +Signed-off-by: Alexey Simakov +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index b3878975bd9c0..ea4973096aa28 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5814,7 +5814,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + u32 current_speed = SPEED_UNKNOWN; + u8 current_duplex = DUPLEX_UNKNOWN; + bool current_link_up = false; +- u32 local_adv, remote_adv, sgsr; ++ u32 local_adv = 0, remote_adv = 0, sgsr; + + if ((tg3_asic_rev(tp) == ASIC_REV_5719 || + tg3_asic_rev(tp) == ASIC_REV_5720) && +@@ -5955,9 +5955,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset) + else + current_duplex = DUPLEX_HALF; + +- local_adv = 0; +- remote_adv = 0; +- + if (bmcr & BMCR_ANENABLE) { + u32 common; + +-- +2.51.0 + diff --git a/queue-6.6/tls-always-set-record_type-in-tls_process_cmsg.patch b/queue-6.6/tls-always-set-record_type-in-tls_process_cmsg.patch new file mode 100644 index 0000000000..9804f05887 --- /dev/null +++ b/queue-6.6/tls-always-set-record_type-in-tls_process_cmsg.patch @@ -0,0 +1,58 @@ +From 07f3687885eb6984d404d5a43232bc647b44d91f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:58 +0200 +Subject: tls: always set record_type in tls_process_cmsg + +From: Sabrina Dubroca + +[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] + +When userspace wants to send a non-DATA record (via the +TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a +previous MSG_MORE send() as a separate DATA record. If that DATA record +is encrypted asynchronously, tls_handle_open_record will return +-EINPROGRESS. This is currently treated as an error by +tls_process_cmsg, and it will skip setting record_type to the correct +value, but the caller (tls_sw_sendmsg_locked) handles that return +value correctly and proceeds with sending the new message with an +incorrect record_type (DATA instead of whatever was requested in the +cmsg). + +Always set record_type before handling the open record. If +tls_handle_open_record returns an error, record_type will be +ignored. If it succeeds, whether with synchronous crypto (returning 0) +or asynchronous (returning -EINPROGRESS), the caller will proceed +correctly. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index d7dea82bcf565..c7ee44bd32064 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -254,12 +254,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, + if (msg->msg_flags & MSG_MORE) + return -EINVAL; + +- rc = tls_handle_open_record(sk, msg->msg_flags); +- if (rc) +- return rc; +- + *record_type = *(unsigned char *)CMSG_DATA(cmsg); +- rc = 0; ++ ++ rc = tls_handle_open_record(sk, msg->msg_flags); + break; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/tls-don-t-rely-on-tx_work-during-send.patch b/queue-6.6/tls-don-t-rely-on-tx_work-during-send.patch new file mode 100644 index 0000000000..c53dc68373 --- /dev/null +++ b/queue-6.6/tls-don-t-rely-on-tx_work-during-send.patch @@ -0,0 +1,62 @@ +From 994d5344e75ccea809a9d882458a1dbde57a5b74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:17:00 +0200 +Subject: tls: don't rely on tx_work during send() + +From: Sabrina Dubroca + +[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ] + +With async crypto, we rely on tx_work to actually transmit records +once encryption completes. But while send() is running, both the +tx_lock and socket lock are held, so tx_work_handler cannot process +the queue of encrypted records, and simply reschedules itself. During +a large send(), this could last a long time, and use a lot of memory. + +Transmit any pending encrypted records before restarting the main +loop of tls_sw_sendmsg_locked. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 6ea557ebab171..410e39e4b79fd 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + } else if (ret != -EAGAIN) + goto send_end; + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } ++ + continue; + rollback_iter: + copied -= try_to_copy; +@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + } + } ++ ++ /* Transmit if any encryptions have completed */ ++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { ++ cancel_delayed_work(&ctx->tx_work.work); ++ tls_tx_records(sk, msg->msg_flags); ++ } + } + + continue; +-- +2.51.0 + diff --git a/queue-6.6/tls-trim-encrypted-message-to-match-the-plaintext-on.patch b/queue-6.6/tls-trim-encrypted-message-to-match-the-plaintext-on.patch new file mode 100644 index 0000000000..ff58a94b64 --- /dev/null +++ b/queue-6.6/tls-trim-encrypted-message-to-match-the-plaintext-on.patch @@ -0,0 +1,49 @@ +From fdc1477b7759d32ec8ae29fcb5b282d6ec9cc903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:56 +0200 +Subject: tls: trim encrypted message to match the plaintext on short splice + +From: Sabrina Dubroca + +[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ] + +During tls_sw_sendmsg_locked, we pre-allocate the encrypted message +for the size we're expecting to send during the current iteration, but +we may end up sending less, for example when splicing: if we're +getting the data from small fragments of memory, we may fill up all +the slots in the skmsg with less data than expected. + +In this case, we need to trim the encrypted message to only the length +we actually need, to avoid pushing uninitialized bytes down the +underlying TCP socket. + +Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 435235a351e2f..21276ac1f81dc 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto send_end; + tls_ctx->pending_open_record_frags = true; + +- if (sk_msg_full(msg_pl)) ++ if (sk_msg_full(msg_pl)) { + full_record = true; ++ sk_msg_trim(sk, msg_en, ++ msg_pl->sg.size + prot->overhead_size); ++ } + + if (full_record || eor) + goto copied; +-- +2.51.0 + diff --git a/queue-6.6/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch b/queue-6.6/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch new file mode 100644 index 0000000000..28e30b10f7 --- /dev/null +++ b/queue-6.6/tls-wait-for-async-encrypt-in-case-of-error-during-l.patch @@ -0,0 +1,67 @@ +From 9dc92d56650ed44f2bc752d221c025b2c82bfa66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:57 +0200 +Subject: tls: wait for async encrypt in case of error during latter iterations + of sendmsg + +From: Sabrina Dubroca + +[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ] + +If we hit an error during the main loop of tls_sw_sendmsg_locked (eg +failed allocation), we jump to send_end and immediately +return. Previous iterations may have queued async encryption requests +that are still pending. We should wait for those before returning, as +we could otherwise be reading from memory that userspace believes +we're not using anymore, which would be a sort of use-after-free. + +This is similar to what tls_sw_recvmsg already does: failures during +the main loop jump to the "wait for async" code, not straight to the +unlock/return. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1f22c7adf3e56..d3bf2dbc297ae 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + if (ret == -EINPROGRESS) + num_async++; + else if (ret != -EAGAIN) +- goto send_end; ++ goto end; + } + } + +@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + goto alloc_encrypted; + } + ++send_end: + if (!num_async) { +- goto send_end; ++ goto end; + } else if (num_zc || eor) { + int err; + +@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, + tls_tx_records(sk, msg->msg_flags); + } + +-send_end: ++end: + ret = sk_stream_error(sk, msg->msg_flags, ret); + return copied > 0 ? copied : ret; + } +-- +2.51.0 + diff --git a/queue-6.6/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch b/queue-6.6/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch new file mode 100644 index 0000000000..f10edf45a6 --- /dev/null +++ b/queue-6.6/tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch @@ -0,0 +1,47 @@ +From b8b877ae72c846ec53a49b5ff7b0852ae2d0a45c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 11:16:59 +0200 +Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails + +From: Sabrina Dubroca + +[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ] + +Async decryption calls tls_strp_msg_hold to create a clone of the +input skb to hold references to the memory it uses. If we fail to +allocate that clone, proceeding with async decryption can lead to +various issues (UAF on the skb, writing into userspace memory after +the recv() call has returned). + +In this case, wait for all pending decryption requests. + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Reported-by: Jann Horn +Signed-off-by: Sabrina Dubroca +Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index d3bf2dbc297ae..6ea557ebab171 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1637,8 +1637,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov, + + if (unlikely(darg->async)) { + err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold); +- if (err) +- __skb_queue_tail(&ctx->async_hold, darg->skb); ++ if (err) { ++ err = tls_decrypt_async_wait(ctx); ++ darg->async = false; ++ } + return err; + } + +-- +2.51.0 +