From: Sasha Levin Date: Sun, 12 Oct 2025 13:46:11 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v6.1.156~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=724591339e6d025fe10cb4425b68c38b2ed10add;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-5.10/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..4190fdae60 --- /dev/null +++ b/queue-5.10/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 3d6905fc754d2e50bc82874494d6a300c8d1b037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 8992fdb92902f..d314afec44b56 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3032,7 +3032,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-5.10/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-5.10/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..28b2bd063c --- /dev/null +++ b/queue-5.10/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From db036304cd259ba1a1675fe6dc37bacac8d8b351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 949efdd1b9a18..cf824841ffead 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1406,6 +1406,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-5.10/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-5.10/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..5fe46e47d1 --- /dev/null +++ b/queue-5.10/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From 060bb58a8f8b1041b14d40d9814ca109b22e0ef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index a49a3254f9677..7b387886c0efd 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-5.10/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-5.10/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..d05180f248 --- /dev/null +++ b/queue-5.10/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From 755cf359103851c615419717214f5b64befbe8ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-5.10/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-5.10/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..1e6cea872f --- /dev/null +++ b/queue-5.10/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 3b3568b074355f23360b21f4e770ddad293763f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 03b9cdbd3170f..a258a410dd8df 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-5.10/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-5.10/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..d7d260a124 --- /dev/null +++ b/queue-5.10/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From 137b2a448e6908677b18c7f45a8af99913e99bc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index b4b2781ad22e8..381b525db2b14 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -59,7 +59,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -119,7 +120,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk IN3_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (BYT_RT5640_JDSRC(byt_rt5640_quirk)) { +-- +2.51.0 + diff --git a/queue-5.10/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-5.10/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..bd5f348656 --- /dev/null +++ b/queue-5.10/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From dff7002c52429975873f17841a94abe80ba55e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index a8289f74463e9..f5bcf68841c39 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-5.10/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-5.10/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..72e709bce0 --- /dev/null +++ b/queue-5.10/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From 891c75da3a05359b4874770a8068c2d2ef04f2bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index f0bc3398f3ed2..3a833fb4568c0 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -233,9 +233,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-5.10/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-5.10/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..c2a5e5bbec --- /dev/null +++ b/queue-5.10/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From cb56b776576ea021384672b7857af61359faea92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 18855d4bfda23..b2678e4dfa9e6 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -523,7 +523,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +-- +2.51.0 + diff --git a/queue-5.10/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-5.10/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..78a3771045 --- /dev/null +++ b/queue-5.10/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From b1eb0d1bb7d9516e6c1b6ab2b6c3febf37972622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 51b16c2a279f4..fda0bd990dcb7 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -3801,13 +3801,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + memset(&buf, 0, sizeof(buf)); + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev) { +-- +2.51.0 + diff --git a/queue-5.10/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-5.10/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..a6855d6e07 --- /dev/null +++ b/queue-5.10/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From e41bcd9ab7d8a7f5543812c409b9e25d6944ca74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 076b317c35949..e7d3398c4d23b 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -8149,13 +8149,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-5.10/documentation-trace-historgram-design-separate-sched.patch b/queue-5.10/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..7d8d3c185a --- /dev/null +++ b/queue-5.10/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 0993a368fcfb376a8423b81da5314b63dab0ecfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 088c8cce738ba..6e0d1a48bd505 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-5.10/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-5.10/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..ea1f271d77 --- /dev/null +++ b/queue-5.10/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From 64df021ca81b9b05c523291a551dd517af41899f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 735527922a3d3..f34ae036485e0 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -963,7 +963,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-5.10/drivers-base-node-handle-error-properly-in-register_.patch b/queue-5.10/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..2c6e3a67e4 --- /dev/null +++ b/queue-5.10/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 90588ec43b976c4c52342b8d6df919fb94a9cc1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 5f745c906c330..735527922a3d3 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -961,6 +961,11 @@ int __register_one_node(int nid) + return -ENOMEM; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-5.10/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-5.10/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..87a7e064ec --- /dev/null +++ b/queue-5.10/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From cbe1f138aaa6b9656db75a2c997329776ae5b764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 41800fcad4102..32f93bfb84752 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -621,7 +621,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @adev: amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -631,6 +646,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -638,9 +662,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-5.10/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-5.10/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..d0c5191e3a --- /dev/null +++ b/queue-5.10/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From 28ad31fa92e4bd93e1c9dc36ce57720fb81cd9f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index c738740f8b19e..9a13d0c174236 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1409,7 +1409,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1421,7 +1421,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-5.10/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-5.10/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..8610058c8d --- /dev/null +++ b/queue-5.10/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From 867db948e5f400bf21e6bd3bfb1aa2540d9b39ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index 1646dadd7f37c..3b1c8d93b2654 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-5.10/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-5.10/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..249c58bbbd --- /dev/null +++ b/queue-5.10/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 1c1329cf1fd7fb3b343ae80b7e3ee9f8b44e5b0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 8f1d47ff97996..994cfdf346e15 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_get_sync(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-5.10/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-5.10/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..23d3d0942e --- /dev/null +++ b/queue-5.10/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From d78dcaedf3cb3eba318be2aaa8aba4d28a0cd8f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 4747541517252..dc05775d12e1c 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -327,6 +327,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-5.10/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-5.10/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..5c9740d1ec --- /dev/null +++ b/queue-5.10/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From c3cd483832f26c5a35d2061acbecbf0530eaad1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 265635db29aa5..79d0ac12a9930 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1065,6 +1065,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = mtk_i2c_clock_enable(i2c); +@@ -1078,6 +1079,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1102,12 +1104,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1115,7 +1115,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-5.10/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-5.10/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..e4e60b471f --- /dev/null +++ b/queue-5.10/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 71300071a346043be74483695869aacead14b433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index de88f472eaad2..4f42bab1a9643 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-5.10/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-5.10/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..debfdae510 --- /dev/null +++ b/queue-5.10/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 4239bbabc248a546db2cbba648d2d3370c45e928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 03581a3487751..ae85cf4c05278 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -600,7 +600,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-5.10/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..6cba6c6769 --- /dev/null +++ b/queue-5.10/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From cc64e02c76db1c632738a7f8d1469068e3862cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index cf925906f59b6..67d0d4f1f0db1 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-5.10/libbpf-fix-reuse-of-devmap.patch b/queue-5.10/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..3ee4331827 --- /dev/null +++ b/queue-5.10/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From af012498e4a5984ec1313f30dd51d182d3c57cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index f65e03e7cf944..4c6902c7bdff7 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -4091,6 +4091,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-5.10/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-5.10/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..d97bc66428 --- /dev/null +++ b/queue-5.10/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From 4859807b2ed1f2030fda7bbd0b90573120ea706e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index 4cc51e0018744..b35b3e4286861 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-5.10/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-5.10/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..6a71b16088 --- /dev/null +++ b/queue-5.10/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From 9fc09c1814ee2e2ed603ab18257b926fe2085c7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 0db4000dedf20..cbf674a093680 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-5.10/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-5.10/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..a879cfe98a --- /dev/null +++ b/queue-5.10/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From 1bf20304d98aff6770972ae220de6ad740e9e831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index af1e96e0209fc..0af58c4dcebc1 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-5.10/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-5.10/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..4299f10c72 --- /dev/null +++ b/queue-5.10/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From c00855ef0696f1b63a79730546d8239fd873ef1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 3b2cd28f962de..7f4e11fea180f 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -681,7 +681,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-5.10/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-5.10/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..32ad8a35ed --- /dev/null +++ b/queue-5.10/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From 4b98fcd151964391fe7fd9756ebcc3f34728c18b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index acef52b0729bf..c0f5e8ab1e34e 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-5.10/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-5.10/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..44ad4e2c80 --- /dev/null +++ b/queue-5.10/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 4c5776a3fd2bcd633b2f98f4cd51866e7b7e7d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 636118b0f2ef4..bac75e3afa96b 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -87,7 +87,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-5.10/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-5.10/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..9fcec9f2e9 --- /dev/null +++ b/queue-5.10/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From ddc87ea17342fca8d5f9a2d45d62ab17a0a9f47e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 311873ff57e33..3ffaa487be947 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1012,7 +1012,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-5.10/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-5.10/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..2f1398ef63 --- /dev/null +++ b/queue-5.10/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From a84f113ff217751f4d695b1b8b69a0208d02ef57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index c094413c17541..87774f3b4c354 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8971,7 +8971,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.10/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-5.10/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..31be7d2b4e --- /dev/null +++ b/queue-5.10/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 82e61424dd4fabd8f9ea906485d5af9dff701ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 7397064c3f359..c7a0625954c60 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-5.10/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-5.10/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..52a90ef380 --- /dev/null +++ b/queue-5.10/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 0cf03240e6aa3cfbdc11c1c5a426d201fbd973e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index b4eb75f25906e..e712841ccaa3e 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1365,7 +1365,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-5.10/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-5.10/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..c66822f4a1 --- /dev/null +++ b/queue-5.10/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 7a97cb568f383768d1be48209a4b78231f3fbfee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 6fbfcab4918cf..3280c4b488d44 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -93,7 +93,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-5.10/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-5.10/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..dfdf726943 --- /dev/null +++ b/queue-5.10/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From 07c8dc05a6c800c28b2abaa0cda004a8ff7d981f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 32552d795bb2c..cd2685b65b7f4 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-5.10/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-5.10/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..7d5ff70b13 --- /dev/null +++ b/queue-5.10/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From 78a28309e5abb92474810783f8513c1d7a1e5d4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 212a4a9c3a8fc..59dc5a965fb82 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -745,7 +745,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-5.10/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-5.10/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..6b8ec1915f --- /dev/null +++ b/queue-5.10/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From b93654ccbab74b12d64c3481e9473de82e5c2b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 5600ceb9212d9..964573e30d691 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -604,8 +604,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-5.10/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-5.10/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..2d14ff6064 --- /dev/null +++ b/queue-5.10/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From b3b6f7e9c7ccd36dd471537e65df40ad859e8ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index ea966fc67d287..dbeb67ffebf33 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-5.10/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-5.10/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..86ff7102af --- /dev/null +++ b/queue-5.10/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From 16db0e33954f999f4b8e839ad2154619750cec63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 0846917ff2d2a..d799537f320c8 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.10/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-5.10/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..89754af43b --- /dev/null +++ b/queue-5.10/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From c822efd794ea03c82cf8f1cd9052eea199e75dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 26c66685a43dd..a9c5852f52165 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1063,8 +1063,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-5.10/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-5.10/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..2cf3dc708e --- /dev/null +++ b/queue-5.10/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From 2f6220a12b52019e84186ec627cb57dfcf2a721b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 65e3e7df8a4b0..779e9af479fdd 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.10/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-5.10/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..e0a36f2822 --- /dev/null +++ b/queue-5.10/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 4699d0cae2a7ba687f0cd914574331d8cf5df880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 1d4e0dc550e42..edfbad96665ca 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -757,7 +757,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -943,9 +943,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -970,15 +978,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-5.10/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-5.10/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..4b608caca7 --- /dev/null +++ b/queue-5.10/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From 892961eb58f4e96c51c5db4cc0528811248253c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index fb463d19a70a0..02c21fce457c1 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -853,7 +853,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + + /* Bulk read/write */ +-- +2.51.0 + diff --git a/queue-5.10/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-5.10/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..eba4f13d83 --- /dev/null +++ b/queue-5.10/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From 401b2a304fd7089650dc133f2b70a4555759c412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index fd6fd36268d93..f2080738ca05e 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -115,9 +115,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-5.10/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-5.10/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..abdbd37bb5 --- /dev/null +++ b/queue-5.10/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From 1385aff6b7dec7fcf04dd5bd7b6888d6f3d3e993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index a23e3d810f3e4..80af7a5ac6046 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -63,23 +63,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index cef60bc2589cc..c3ff1fc577a7c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -42,7 +42,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2875,11 +2874,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2889,18 +2886,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-5.10/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-5.10/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..74c5bdac42 --- /dev/null +++ b/queue-5.10/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From 0fbb0808b724212bded86a723760bce4a7171421 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index 326265fd7f91a..caf887364567b 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -811,11 +811,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-5.10/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-5.10/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..b0d40ca0f0 --- /dev/null +++ b/queue-5.10/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From 8167cedc979c1e65226ee26e8f0cc534e04581f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 857a73e856a14..8e2867a6f6471 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-5.10/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-5.10/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..c0001fcda9 --- /dev/null +++ b/queue-5.10/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From b0a096a08708c09e2594f8ac4c33a01972bc28c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 3244f30dffec2..765c5be6c84ca 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-5.10/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-5.10/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..bcca69e62e --- /dev/null +++ b/queue-5.10/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From b25147c0a9ca2af20bcb570baf99be985a54af7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-5.10/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-5.10/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..18be3133bb --- /dev/null +++ b/queue-5.10/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 7961df64e375f009a3b3fecdb0a3b61cb5a90e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index 09773695d219f..4056706d63f7e 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -240,6 +240,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-5.10/serial-max310x-add-error-checking-in-probe.patch b/queue-5.10/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..0bdb2d0769 --- /dev/null +++ b/queue-5.10/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From b2bfa5498d01d49b29669f1abda593810196e973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 363b68555fe62..4ef2762347f62 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); + } +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 5e2bd24663..82bfa530c4 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -17,3 +17,71 @@ driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch drm-amd-display-fix-potential-null-dereference.patch crypto-rng-ensure-set_ent-is-always-present.patch +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +libbpf-fix-reuse-of-devmap.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +serial-max310x-add-error-checking-in-probe.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-18358 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24062 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-10095 +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch diff --git a/queue-5.10/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-5.10/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..f7f694dc69 --- /dev/null +++ b/queue-5.10/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From 23965cd645dff57608534ba510f458fc6cab40bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 26e6dd860b5d9..dbad1c4435cf4 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -432,13 +432,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req, err); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0); +-- +2.51.0 + diff --git a/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..fce66788dc --- /dev/null +++ b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 982347ee199b84ec1fd570871f1583a78c30c289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index a6f4ee3918977..021b94a383d13 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-10095 b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-10095 new file mode 100644 index 0000000000..e00ddf981d --- /dev/null +++ b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-10095 @@ -0,0 +1,112 @@ +From 3cd598a7e30d902ebdd165d0b129455e95cd21cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-18358 b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-18358 new file mode 100644 index 0000000000..0439d9a0b5 --- /dev/null +++ b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-18358 @@ -0,0 +1,67 @@ +From e15b0a3527362897cdee9914fc1779eadba299b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24062 b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24062 new file mode 100644 index 0000000000..9a6de6f191 --- /dev/null +++ b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24062 @@ -0,0 +1,111 @@ +From 7c36bad8d63489f0b59b0c29ba1ec44ac58cf524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index 8e4d22a6ba0b2..846a8c4ea394f 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -80,8 +80,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..6f72caec8c --- /dev/null +++ b/queue-5.10/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From be37f2a5f05df5e4d5e604fb130a6875349fb139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-5.10/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-5.10/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..d7c1f17f01 --- /dev/null +++ b/queue-5.10/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From 0f1deb4c9a6b3a60d06b8c82bd6834adc061eefe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index afc31f1def760..6ffda70e7e58e 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2536,8 +2536,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2556,11 +2556,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-5.10/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-5.10/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..be32e0fd40 --- /dev/null +++ b/queue-5.10/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From f551f33dbb438ff0d2b4c23d265216151bfd89a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index d810b96a7ba43..4256b1d09380f 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1358,6 +1358,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-5.10/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-5.10/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..898dbde27e --- /dev/null +++ b/queue-5.10/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From 2de4b8ace7f1106510ef8cd671ecb0a506dfce6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index db1b73486e90b..7ab8c518dfc2b 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-5.10/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-5.10/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..2ec6ea7ae0 --- /dev/null +++ b/queue-5.10/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From 4de2451af41a0c7be5292501273bcc57be102ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index ab3c38a7d8ac0..a73604af8960e 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-5.10/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-5.10/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..bde8ff18db --- /dev/null +++ b/queue-5.10/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From cdba6eb9a344f8aafc21768e6ebd5c5295700664 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index affcb928771d8..2d2506c598818 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-5.10/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-5.10/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..32327f145f --- /dev/null +++ b/queue-5.10/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 8af18ef42136ec3de0ee9fed383257b45634c033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 3fc457bc16db3..18349ec0c1010 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.10/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-5.10/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..62ee00e984 --- /dev/null +++ b/queue-5.10/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From f29e620571cce6080bedc726e9ed931b3b2611b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index c9a74f3e2e601..858db97ecfed9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-5.10/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-5.10/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..d8f992392d --- /dev/null +++ b/queue-5.10/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From deb94749e730cd8551178b39fac9773dbeb4e262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ba927033bbe8c..1206769cdc7fd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.10/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-5.10/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..42dc0d8053 --- /dev/null +++ b/queue-5.10/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From 90cbe67b352f4ab03d0675a864437a76aacf7f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 7eace21a08040..b1c9c7a9e5dbc 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-5.10/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-5.10/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..4b74172d34 --- /dev/null +++ b/queue-5.10/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 06ed324db2d83e6f067cd7cfe086e02b1081999b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 72044026eb3c2..8686f5cfbc6b7 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-5.15/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-5.15/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..ed1567c3bc --- /dev/null +++ b/queue-5.15/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 8276d10bde557b2858671a2af6f4d02c2aebb24f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 2a6fdce3c2e6b..e420f773d6744 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3021,7 +3021,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-5.15/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-5.15/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..fbe91b46ef --- /dev/null +++ b/queue-5.15/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From bfb8509653b8955339decf8f9e4c54b322bb87a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 74459ac13f4bc..6b71082d474f9 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1403,6 +1403,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-5.15/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-5.15/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..a0fb6df24d --- /dev/null +++ b/queue-5.15/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From 90e1f2c8471104e38abadac9afc5f045dd041149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index b5b0d43bb8dcd..c3f2717aebf25 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-5.15/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-5.15/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..f66253ba49 --- /dev/null +++ b/queue-5.15/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 16760900e90ee3e2e51cd4768dc9979ebeefb370 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 2f0a370a13096..60f9d6f5f8229 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -868,7 +868,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCK1..4 settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -912,7 +912,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-5.15/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..c226cfe901 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From 021d3e78925658bf83df573cefd8e59248700b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-5.15/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-5.15/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..8bbb373117 --- /dev/null +++ b/queue-5.15/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 1e1a69e3bae4fabe4e8d605ff256a56b213417f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index b5c97d35864a6..923e69c7695c2 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-5.15/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-5.15/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..1662366159 --- /dev/null +++ b/queue-5.15/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From cbaf9a3c3ebe42bee78dc2f1fb2b3095002e3f9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 4954e8c494c6d..0c7da72a7b846 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -65,7 +65,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -134,7 +135,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-5.15/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-5.15/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..0810282d77 --- /dev/null +++ b/queue-5.15/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From e14b56a67e6662a0712ee179efbb82bd09e52436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 93cec4d916273..b0b41a03c083e 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-5.15/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-5.15/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..4d702eae8e --- /dev/null +++ b/queue-5.15/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From 81c756214a89790a02c7498f449a14e4bcff1c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 7074ce8d2d03f..09f4faca338a2 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -178,9 +178,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-5.15/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-5.15/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..68e41cc76b --- /dev/null +++ b/queue-5.15/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From 07e8626abc923225c1ffab89820b7ea9f726fc5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index d501084bab4a4..85346a6f1c773 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -514,7 +514,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +-- +2.51.0 + diff --git a/queue-5.15/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-5.15/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..7347ebc6e1 --- /dev/null +++ b/queue-5.15/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From cbfe09e2b338ad338231b9dd366b10c67ccfee4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index a54eb754e9a70..1d04fb42f13f2 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -3824,13 +3824,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + memset(&buf, 0, sizeof(buf)); + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev) { +-- +2.51.0 + diff --git a/queue-5.15/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-5.15/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..3c66fa21ec --- /dev/null +++ b/queue-5.15/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 444c4d4e6a1137593f18b6dc84ba616ba1bc2f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index f346f19cf468c..b95af925b9c27 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -8595,13 +8595,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-5.15/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-5.15/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..d1fd0c3cda --- /dev/null +++ b/queue-5.15/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 54ec247421fe0db150e05b82a0c985d169c1cf13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index fac63d092c7be..732a4bed3f207 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -18,7 +18,8 @@ + #include + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-5.15/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-5.15/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..04514094d8 --- /dev/null +++ b/queue-5.15/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From b77ee4ff9a9d04c93ad2f3ce262d71a41ddc8042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 732a4bed3f207..dfdb5d4263259 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -503,12 +503,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -518,7 +518,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-5.15/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-5.15/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..d4758a3052 --- /dev/null +++ b/queue-5.15/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From 7b244689684ffe537cd9d5ac3e3ce2837dc4bcc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 1f12109526fa6..35287ab0148a2 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -319,6 +320,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-5.15/documentation-trace-historgram-design-separate-sched.patch b/queue-5.15/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..105ad3423f --- /dev/null +++ b/queue-5.15/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 74ea01d7d1c4b18d4e9e738a65e40905acb12b26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 088c8cce738ba..6e0d1a48bd505 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-5.15/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-5.15/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..687c1740b9 --- /dev/null +++ b/queue-5.15/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From d64be4b63eb7450cbb1e9a0e8c3528d5374b2da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 0e3bae3b877df..dd8c8fdfd158a 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -985,7 +985,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-5.15/drivers-base-node-handle-error-properly-in-register_.patch b/queue-5.15/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..3219bdb107 --- /dev/null +++ b/queue-5.15/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 101858991350ec1dd9e296bfcb4ffc96250a7340 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 5366d1b5359c8..0e3bae3b877df 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -983,6 +983,11 @@ int __register_one_node(int nid) + return -ENOMEM; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-5.15/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-5.15/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..d0da935e21 --- /dev/null +++ b/queue-5.15/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From 3ed4e606d472696482c806705420c5890f3c4ed6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 0fef925b66024..e458e0d5801b0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @handle: handle used to pass amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-5.15/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-5.15/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..a52678dbc2 --- /dev/null +++ b/queue-5.15/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From b22983b8bb3d12bf32efc9f8cac342ed8ce429ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 7f55decc5f37b..d21bebfa884ed 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3228,7 +3228,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-5.15/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-5.15/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..20e4a9774b --- /dev/null +++ b/queue-5.15/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From 787727cefeab6132cdbe6757d506499dd3b1fe55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index 7fe2c49854987..d5e5f08deeec5 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1410,7 +1410,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1422,7 +1422,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-5.15/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-5.15/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..3d3c108429 --- /dev/null +++ b/queue-5.15/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From b0f9575246685695c6ee6c2f00ccf9845b7d69f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index 1646dadd7f37c..3b1c8d93b2654 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-5.15/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-5.15/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..e591bae6bf --- /dev/null +++ b/queue-5.15/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From edee17b2e60bf305c3b4fbdb924da06f402660c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-5.15/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-5.15/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..1300e2b9b3 --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,85 @@ +From a420e2e2ad98d0a35b0eb582b1cf47e5c91bbc4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 6940ee5432ba3..52ce16218b299 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -935,12 +936,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else + return -EINVAL; + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1101,7 +1106,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-5.15/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-5.15/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..3edaded30a --- /dev/null +++ b/queue-5.15/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 30a5f1513ff05849fa1b12b00c9e3c4b00215c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 2f2f21f1b659e..d7b42888f25c2 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-5.15/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-5.15/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..7dc360bcbf --- /dev/null +++ b/queue-5.15/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From a108e36ec5e030862e2131c6cbdcee3e2c0da739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 718bebe4fb877..09fcd155c6410 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -322,6 +322,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-5.15/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-5.15/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..7397648025 --- /dev/null +++ b/queue-5.15/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From bc60cb0de6ca8b293836d25dd7632718acb000b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 72acda59eb399..03e5d488f874f 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1067,6 +1067,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = mtk_i2c_clock_enable(i2c); +@@ -1080,6 +1081,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1104,12 +1106,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1117,7 +1117,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-5.15/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-5.15/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..823b1e596b --- /dev/null +++ b/queue-5.15/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From 0571fff7de8d170631f9fcefca62c511d7dc44a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 62a4d06bcfb5d..27f55b5e388d9 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -308,6 +308,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.15/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-5.15/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..6c5a42be73 --- /dev/null +++ b/queue-5.15/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 37f954ab7a321e9d1c2f40d362ad89cb944cf100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 1557c71dd152f..2b13cf6e827c6 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -982,6 +982,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -989,7 +991,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1007,9 +1008,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-5.15/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..dbcc6a4dc0 --- /dev/null +++ b/queue-5.15/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 8c3dbc584cf09609cb5875884a58f0fb4863803c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 5eabb54c1fc72..8815747e67be7 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -619,7 +619,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-5.15/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..f53fe1b683 --- /dev/null +++ b/queue-5.15/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From 542fc1776f0a856104838a4585bfef45bb49e253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index ef1f45e43b630..61d3797fb7995 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-5.15/libbpf-fix-reuse-of-devmap.patch b/queue-5.15/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..469f7d8e74 --- /dev/null +++ b/queue-5.15/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From 0c3fc26093f0c83762882d0002a8fee4fe57bd71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 13dea519e59f2..d9589c92e05d2 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -4485,6 +4485,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-5.15/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-5.15/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..84985eb48c --- /dev/null +++ b/queue-5.15/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From dcdf46fb24909e2be5427475223f50457a887a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index 2e4018c269124..f1953c819666b 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-5.15/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-5.15/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..807088b164 --- /dev/null +++ b/queue-5.15/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From d4a39e1256ad7638e4f0ada610100d8d7992ea2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-5.15/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-5.15/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..ad6cc1cc6d --- /dev/null +++ b/queue-5.15/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From c3792c6533316a27cef974ba7f4ef267be93b618 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 81395852b4d43..ca8bfd1b8278e 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-5.15/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-5.15/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..c984dc8bee --- /dev/null +++ b/queue-5.15/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 99c02a542ed4a0d6b774b8d824d7d967d99c8e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 413082f10dc1c..31f05356a7c06 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -688,7 +688,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-5.15/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-5.15/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..46bfb45ff7 --- /dev/null +++ b/queue-5.15/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From da05012fb38e60405bad2249e8aad5570ccab333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index d5aa92660217c..324bec0c22fb4 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-5.15/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-5.15/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..0e63e4f3f5 --- /dev/null +++ b/queue-5.15/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 0058e3ca261d86f77b505bc45ec925972cd26466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 0bd6bf46f05f3..1f9ca5040982d 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -62,7 +62,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-5.15/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-5.15/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..3883d1e5ac --- /dev/null +++ b/queue-5.15/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From 77b2d7fb3fcf0ee77e7980c90991935ad0953921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index d295942968f33..160f853e93adc 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1001,7 +1001,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-5.15/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-5.15/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..1367e6a660 --- /dev/null +++ b/queue-5.15/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From a46575f7f9b299f39c442f77309d81f69a6fab03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 3d854e2537bc2..a98b10c85b700 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9117,7 +9117,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.15/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-5.15/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..016f21b2fe --- /dev/null +++ b/queue-5.15/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From bbc6a5080993d165029441920e8cb23d50213edd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 812d085d49c99..4c4b528b89ebe 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-5.15/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-5.15/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..a40e40cc05 --- /dev/null +++ b/queue-5.15/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 5a7a58cfb0c0c20ad9ba626870396d5f14b0e4ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 85a47621e0c07..f9ecabe3c09e5 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1030,6 +1030,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-5.15/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-5.15/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..423877dd1a --- /dev/null +++ b/queue-5.15/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 813237ce043414a84ea358ade7d71461ecb104b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index cb0aa65d6934a..30d63ae20d8b7 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1346,7 +1346,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-5.15/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-5.15/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..c37bc9378c --- /dev/null +++ b/queue-5.15/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 11daca8975b2b3a28d85082d1cc20a332bb7796a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index cd5945e17fdf7..5ba677353d040 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -93,7 +93,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-5.15/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-5.15/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..f8ff29a62d --- /dev/null +++ b/queue-5.15/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From c18605b109f78c031946f9f89889af8de767f6d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 51408996255bd..e2601e45935e6 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-5.15/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-5.15/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..65d94f7495 --- /dev/null +++ b/queue-5.15/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From cedd5b34a52a220e6218a27e8381f11846b8154f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index f3eecb20c0869..37f8d51046b89 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -755,7 +755,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-5.15/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-5.15/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..264ce5284f --- /dev/null +++ b/queue-5.15/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From e137e0cc785b8ca9677129cb2dbb9f9ab4ee02de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index c784de10b494e..9cd0a837af425 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -601,8 +601,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-5.15/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-5.15/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..ed7cedf7e3 --- /dev/null +++ b/queue-5.15/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From e197175d7017d69f85d9c12f920880a0c05bea51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index ea966fc67d287..dbeb67ffebf33 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-5.15/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-5.15/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..a40ed7beed --- /dev/null +++ b/queue-5.15/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From 6e24f33c135668502d22a91e899d0f3dcf8583fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 5b723a48c5f1d..3fef7d7987736 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.15/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-5.15/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..03009528a0 --- /dev/null +++ b/queue-5.15/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From a7bfe002d9c669e2de3088b3545ee9b6c9712f53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 96e00e86ebbf6..5dc864cec9f83 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1039,8 +1039,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-5.15/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-5.15/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..5b496abf96 --- /dev/null +++ b/queue-5.15/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From c0ca331265d6de4f908ea568aa9181442b1bec33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 65e3e7df8a4b0..779e9af479fdd 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.15/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-5.15/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..ccf87ee37a --- /dev/null +++ b/queue-5.15/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From b9e22beae3617c5a0a3dc8c8a6225fdca6a66bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 124242e387a59..c83701d04c955 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -759,7 +759,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -945,9 +945,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -972,15 +980,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-5.15/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-5.15/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..391aa26826 --- /dev/null +++ b/queue-5.15/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From 049fa7de38bfeec025c89fc9c73ca4c99d1e61a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index ebddc69bc969c..35cfbec6bf9ac 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -888,7 +888,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + + /* Bulk read/write */ +-- +2.51.0 + diff --git a/queue-5.15/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-5.15/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..26910879d4 --- /dev/null +++ b/queue-5.15/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 7e9fde61d1c7fe99b517f2523a517dc4ab921f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 41ae7ac27ff6a..7c0d29c7856bb 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-5.15/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-5.15/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..8615b88d59 --- /dev/null +++ b/queue-5.15/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From a9e72cffdb218fa63135569b1041434968ed6a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 7e9244c748da6..515c6d68e47ce 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -116,9 +116,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-5.15/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-5.15/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..3d77afd8bb --- /dev/null +++ b/queue-5.15/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From a6874f84f8744e0d14929ad5fa019cbab6677221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index a23e3d810f3e4..80af7a5ac6046 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -63,23 +63,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index bb7e3c80ad74e..321441e6ad328 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -42,7 +42,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2243,11 +2242,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2257,18 +2254,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-5.15/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-5.15/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..33b42b0183 --- /dev/null +++ b/queue-5.15/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From 9410cf6cf69231e58b28cb775669c0eee73899ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index ddb7c88d53650..0ff63e9d815aa 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1183,19 +1183,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) +-- +2.51.0 + diff --git a/queue-5.15/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-5.15/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..7eb84fcab6 --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From d8e8fd96619ecf5f4cbbcce6a25f8dc12cbeb3e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index e8a4750f6ec47..7d6e4fe31ceed 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-5.15/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-5.15/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..e133967108 --- /dev/null +++ b/queue-5.15/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From a2dc7b8b8c27f6280cc046aa7fa32272019e4310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 3f05f13fb107a..ec834b5951e72 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-5.15/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-5.15/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..6f01596d4c --- /dev/null +++ b/queue-5.15/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From b6e8c1e3cc242ecfb8519ec1aeb3d3e818b5914c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 0c79f2a9eba76..c4f5a2a17bd6a 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-5.15/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-5.15/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..85826a2ca9 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From 8c19164721993c1d412a59f42c3ca621006c3850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index ac702f74dd984..dfc7bff420cda 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1539,7 +1539,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3525,7 +3525,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-5.15/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-5.15/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..a474fc34e0 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From 7dc6f2565abdf802f2403f3c8387ec7edef9ffde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 2053c560b580c..5f3593680c953 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2061,11 +2061,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-5.15/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-5.15/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..5443c536a1 --- /dev/null +++ b/queue-5.15/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From 72da5c863ce7bf65aeddab9d8fdd154a55f4d8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-5.15/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-5.15/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..0a70740fd4 --- /dev/null +++ b/queue-5.15/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 5159ddda3bea44f2f81679aae49d1f69b0343175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index 09773695d219f..4056706d63f7e 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -240,6 +240,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 5f6bc94927..1a3fb0c9b4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -21,3 +21,87 @@ platform-x86-int3472-check-for-adev-null.patch crypto-rng-ensure-set_ent-is-always-present.patch minmax-add-in_range-macro.patch net-9p-fix-double-req-put-in-p9_fd_cancelled.patch +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +libbpf-fix-reuse-of-devmap.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +arm-at91-pm-fix-mckx-restore-routine.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-28011 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24238 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-30768 +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch diff --git a/queue-5.15/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-5.15/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..2a6e646234 --- /dev/null +++ b/queue-5.15/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From 3dc875a08b141b5d1af0c9abeb2218ad26cac0f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index b60525b34ab05..387df30ca5609 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -976,16 +976,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-5.15/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-5.15/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..aeb5cf46da --- /dev/null +++ b/queue-5.15/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From db9468c6608ad9326bcfb17ebd48f056a622863c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 4c9400cf6686b..5dc60ee0b07a1 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -415,13 +415,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req, err); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0); +-- +2.51.0 + diff --git a/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..2b12c2dcb2 --- /dev/null +++ b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From d9a6b096be044238107aaee9088f04c454f80b43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index a6f4ee3918977..021b94a383d13 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24238 b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24238 new file mode 100644 index 0000000000..bc1a96d586 --- /dev/null +++ b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24238 @@ -0,0 +1,111 @@ +From 93d046213047220c8441753a24318c56d9b583a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index 8e4d22a6ba0b2..846a8c4ea394f 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -80,8 +80,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-28011 b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-28011 new file mode 100644 index 0000000000..8e99de3bdc --- /dev/null +++ b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-28011 @@ -0,0 +1,67 @@ +From 9a8103335e6ca2c3653ac0adc37fe11529f79e9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-30768 b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-30768 new file mode 100644 index 0000000000..9a1dea0065 --- /dev/null +++ b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-30768 @@ -0,0 +1,112 @@ +From 99b8546ad736625879dbea856c0a19d7a5c30b7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..4f383f259a --- /dev/null +++ b/queue-5.15/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From b914269e6c241a0332d012f7a570db484cf1560d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-5.15/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-5.15/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..590a8bf43b --- /dev/null +++ b/queue-5.15/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From 0918c63cda458d4fdf362636ee452de11f80e3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 9508e2c90b840..b3d373372e841 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2747,8 +2747,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2767,11 +2767,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-5.15/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-5.15/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..0ba68d00fa --- /dev/null +++ b/queue-5.15/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From 2852c0a61128a5a63f355c600e7ffbb5194a260f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index 9006e01e18c20..62c20d5c2a66a 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.15/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-5.15/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..650cfdbabc --- /dev/null +++ b/queue-5.15/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From 3979440264cc75dd6fab78abd087f193dd145e9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index bfd889422dd32..22cd3d5384910 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-5.15/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-5.15/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..87fa426c5f --- /dev/null +++ b/queue-5.15/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From 2c6b22c6ae86c9381a1f8d58321498d574ed7b78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index a0ea830e1ba17..f9eccd40c221f 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -46,6 +46,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-5.15/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-5.15/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..ed8befda43 --- /dev/null +++ b/queue-5.15/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From f6b74a0edb061956c40c65ce177de9a2b4f82e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 6423930b0e72e..9a3de907de696 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1364,6 +1364,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-5.15/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-5.15/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..7479cbd818 --- /dev/null +++ b/queue-5.15/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From 04c0a6160ed319f169c3ba936a1d1e29f3049c90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 37a5914f79871..b2641009519b5 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-5.15/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-5.15/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..060a09d784 --- /dev/null +++ b/queue-5.15/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From db4dc0bdaf47682be2477e3d2c15e393dfb4d8d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index ab3c38a7d8ac0..a73604af8960e 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-5.15/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-5.15/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..86b05511cb --- /dev/null +++ b/queue-5.15/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From d3b450edb964b6ace2ca61f22de0808b92ea21d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 6b98f5ab6dfed..e3c8483d7ba40 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-5.15/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-5.15/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..d020c7dbeb --- /dev/null +++ b/queue-5.15/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 8f84afcfb078561c57abc14e1e58ac8f991a735f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 1c569be72ea29..15644ae2387fd 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.15/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-5.15/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..70c1faaa6d --- /dev/null +++ b/queue-5.15/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From 60645098e7576d86c7e5c3c89170081d7696bc7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 572aabc0541c5..5817501b0c3fe 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-5.15/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-5.15/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..2d899a7912 --- /dev/null +++ b/queue-5.15/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From 631542853380d08c7ed3f8c9b87095312e462531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ba927033bbe8c..1206769cdc7fd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.15/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-5.15/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..894d78d396 --- /dev/null +++ b/queue-5.15/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From 25a5e4f5aef3fa3628889fa5a0fe3eb081ff3c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index d76a8523ef1d3..8978f18d98de4 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-5.15/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-5.15/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..3a048dbea7 --- /dev/null +++ b/queue-5.15/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 72edd4f3668715f3dae7acc45cc8489e4bd7ecad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 8dd8e8ec9fa55..879be4ffa06c7 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-5.4/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-5.4/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..6c273fb7f0 --- /dev/null +++ b/queue-5.4/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From 77772ff2bab359bff86b9a5c8339629e093c75eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index e6bba26caf3c8..86655d65f3215 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1506,6 +1506,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-5.4/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-5.4/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..ebdfec8285 --- /dev/null +++ b/queue-5.4/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From f9e93e02c994de133698aba34326353a0800ddc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index 00975e86473c5..6cf7572779d41 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-5.4/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-5.4/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..1a779fd361 --- /dev/null +++ b/queue-5.4/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 12da59cae3866d979651bec448b6d4a81cc2d9a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 57d6d0b48068c..006e489e7e890 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-5.4/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-5.4/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..81700021fb --- /dev/null +++ b/queue-5.4/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From b707c8890729da1a45b6e6b50c7966583282907d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 5a8e86ba29004..88e84415d5a4b 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -60,7 +60,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -118,7 +119,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk IN3_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (BYT_RT5640_JDSRC(byt_rt5640_quirk)) { +-- +2.51.0 + diff --git a/queue-5.4/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-5.4/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..fb2b93c6d5 --- /dev/null +++ b/queue-5.4/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From 256bbb191132c4a18cd978f42388bd0ad454a79a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 0c1c8628b9917..6a5098efdaf2b 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -99,14 +100,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-5.4/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-5.4/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..543e4a90ca --- /dev/null +++ b/queue-5.4/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From 95e01209971c9d5478e166131836badfb01ceea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 7abd66d1228ad..532afcb672412 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -241,9 +241,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-5.4/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-5.4/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..b4813efc37 --- /dev/null +++ b/queue-5.4/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From 347e823456d7bafeb36d71151da93057f8790884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 13be635300a85..d4870441a38ac 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -505,7 +505,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +-- +2.51.0 + diff --git a/queue-5.4/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-5.4/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..708c10841e --- /dev/null +++ b/queue-5.4/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 16592f20721482d971c16fa0ed9e57ec31fdda09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index fd18497977bdf..2c56c910a0c13 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -7132,13 +7132,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-5.4/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-5.4/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..0180666fb9 --- /dev/null +++ b/queue-5.4/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From 87cada16d5c4373098e72bb9f3c6e422cf07813b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index cb1bbe3068ab6..83b13a295bbe6 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -940,7 +940,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-5.4/drivers-base-node-handle-error-properly-in-register_.patch b/queue-5.4/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..06128d300a --- /dev/null +++ b/queue-5.4/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 917a3f24c1bf2f5d1c5cca91062c71bb727e995a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 666eb55c0774e..cb1bbe3068ab6 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -938,6 +938,11 @@ int __register_one_node(int nid) + return -ENOMEM; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-5.4/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-5.4/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..2877311e3b --- /dev/null +++ b/queue-5.4/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From f1ccce3f0d096d04748e2fbec50baa3383e4ddda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index a85470213b27f..637a4f2a30af9 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1411,7 +1411,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1423,7 +1423,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-5.4/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-5.4/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..4947f71e0e --- /dev/null +++ b/queue-5.4/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From 56afa3827564107bdac62fda7bea5403f53a115a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 75313c80f132f..fd5ffe13c7033 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -414,6 +414,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-5.4/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-5.4/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..1ad62ea36b --- /dev/null +++ b/queue-5.4/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From 98081b948a53886c4dfc3b5065630a8ed9cab4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 5587e7c549c4f..2b56ad08efed1 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -782,6 +782,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = mtk_i2c_clock_enable(i2c); +@@ -795,6 +796,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -818,12 +820,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -831,7 +831,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-5.4/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-5.4/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..4eee76a068 --- /dev/null +++ b/queue-5.4/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 2f49e405f2205a4e86ad3ad90890f6aadfd14a07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 11ab6390eda4d..b05df8694a4a5 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-5.4/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-5.4/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..a272cd1f63 --- /dev/null +++ b/queue-5.4/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From c3dd5aef51da1ee18e7ae9be816f44b9324ecc31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 6374d50915557..6bdd175df021d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -627,7 +627,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.4/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-5.4/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..e261dc011d --- /dev/null +++ b/queue-5.4/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From c12395915af8d578d11c07acb17109f3d40c4da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index cf925906f59b6..67d0d4f1f0db1 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-5.4/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-5.4/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..a9ca22dab3 --- /dev/null +++ b/queue-5.4/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From fd83666815449932ce946053dade1b4037abf810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index 4cc51e0018744..b35b3e4286861 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-5.4/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-5.4/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..be938e4ebd --- /dev/null +++ b/queue-5.4/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From 1b0e0d44f1358e70aaa4b35cb9bca65b8e36d402 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 026c6ca245408..e53bdd5f04eaa 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -918,7 +918,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-5.4/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-5.4/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..be61851b4b --- /dev/null +++ b/queue-5.4/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 67cb300cef071b1ad27ff940a8e15767863dac24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index ae631b8770fc1..5f037e9db023a 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -633,7 +633,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_get(struct ena_adapter *adapter, u32 *indir) +-- +2.51.0 + diff --git a/queue-5.4/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-5.4/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..5c98a64346 --- /dev/null +++ b/queue-5.4/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From ff944132526611c7af0f833d87e7eed307cc1618 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index 3829b7eb3fc90..1df289e7c1304 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -684,7 +684,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -698,7 +697,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-5.4/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-5.4/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..3a149c6a86 --- /dev/null +++ b/queue-5.4/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From f042f4fba1d0cea593533039cb25fed5fb462f27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 297631f9717bc..0dcba0a87283d 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -87,7 +87,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-5.4/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-5.4/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..a6927395c2 --- /dev/null +++ b/queue-5.4/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From 0002118c3ed8320156c7f1e3c466d63ebe10f55f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index ff88103571819..6e1707ef391dd 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -914,7 +914,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-5.4/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-5.4/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..d44846416b --- /dev/null +++ b/queue-5.4/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From c31549f92f0317f92665d33b7d9d9a136feb8b57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index f511087d5e1c2..44770bb9017d5 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8686,7 +8686,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.4/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-5.4/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..411792cf77 --- /dev/null +++ b/queue-5.4/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From c863b1e36e8fd0204588bef3aed7f399c0702124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 7397064c3f359..c7a0625954c60 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-5.4/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-5.4/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..d36ad6c76d --- /dev/null +++ b/queue-5.4/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 49e2495f2a47f52b7ffffb7ceda8a2e7f949b79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 74c0ddd433815..9e3588d568ce4 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1394,7 +1394,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-5.4/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-5.4/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..b66414e479 --- /dev/null +++ b/queue-5.4/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 78c5bc3b267fc8fbf09d311e1563650542dab068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 079701e8de186..91a6631af5567 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -75,7 +75,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-5.4/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-5.4/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..5ba03f8497 --- /dev/null +++ b/queue-5.4/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From 59660c08cecc3b057463549624ca00c00537aca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index e8d1f3050487f..2da0f2ab4038e 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -400,6 +403,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -631,6 +636,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -751,6 +760,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-5.4/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-5.4/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..f0ca998979 --- /dev/null +++ b/queue-5.4/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From 0ca6f30ccf245105e2965174501d24be1af11710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index ea966fc67d287..dbeb67ffebf33 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-5.4/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-5.4/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..bccd067da1 --- /dev/null +++ b/queue-5.4/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From 2c32d84fa0305e6c09d29e3161bbcf5b6120450b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 7b4c770ce9d67..7414daef81a35 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-5.4/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-5.4/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..68f52492b1 --- /dev/null +++ b/queue-5.4/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From 424bd47994dfc46aaa5d5a8060df3f67d9ca8123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index c9e63c692b6e8..48de2285922f8 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -459,14 +459,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.4/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-5.4/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..2e61ea6a65 --- /dev/null +++ b/queue-5.4/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 82c6a4671cc2694b22b7b25a8fa8380c80006bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 236f9efaa75ce..b5a845985ba4c 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -779,7 +779,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !qp->kernel_verbs) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -965,9 +965,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -992,15 +1000,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-5.4/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-5.4/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..708d4dedd3 --- /dev/null +++ b/queue-5.4/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From cab40a63e3cfd358987230c809d2cb4477d76c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index c453c24afeb8a..5824cfd288125 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -824,7 +824,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + + /* Bulk read/write */ +-- +2.51.0 + diff --git a/queue-5.4/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-5.4/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..6bf01a1dad --- /dev/null +++ b/queue-5.4/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From e6275c0675bba91527fe7bbf7797274e3d3515fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index eaeb6aee6da5c..9c9beeb3bcd74 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -113,9 +113,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-5.4/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-5.4/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..500fefe7c5 --- /dev/null +++ b/queue-5.4/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From 0ef095a83033526a53b4d02674f79b6dd0d79070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 7b852b87a609f..34f55b81a0deb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -64,23 +64,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 41bd16cc9d0f6..b3ba996004f1d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -42,7 +42,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2895,11 +2894,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2909,18 +2906,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-5.4/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-5.4/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..9169a8ad2d --- /dev/null +++ b/queue-5.4/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From d0ec63b6b6914a6988ecc92cca427e62aaa0e7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index ebe78ec42da8b..a355471cf079b 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -812,11 +812,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-5.4/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-5.4/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..1fa273eb13 --- /dev/null +++ b/queue-5.4/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From 73f1ec2c4045ac52e34b1c5116cd1cf6bd635784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index bf0546fc555f2..04740f623a12e 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-5.4/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-5.4/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..8f2f15e3b5 --- /dev/null +++ b/queue-5.4/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From b5193c8eb5e536d21d6facc1f5a25be761e0db20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 1215fc36862da..45b1af5a8d748 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -893,7 +894,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + PM8001_DISC_DBG(pm8001_ha, +-- +2.51.0 + diff --git a/queue-5.4/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-5.4/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..3d86deae24 --- /dev/null +++ b/queue-5.4/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 09538176ecbbef882eb74b9c3b407eaff93c713b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index 09773695d219f..4056706d63f7e 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -240,6 +240,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-5.4/serial-max310x-add-error-checking-in-probe.patch b/queue-5.4/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..ae1bffa430 --- /dev/null +++ b/queue-5.4/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From f79028e050f275c02e11e124cdd19aeb439d69a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 363b68555fe62..4ef2762347f62 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); + } +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index abe151c840..b101b7ed43 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -15,3 +15,58 @@ perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch staging-axis-fifo-fix-maximum-tx-packet-length-check.patch staging-axis-fifo-flush-rx-fifo-on-read-errors.patch driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +serial-max310x-add-error-checking-in-probe.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-14259 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-17902 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21687 +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch diff --git a/queue-5.4/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-5.4/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..936dddc67a --- /dev/null +++ b/queue-5.4/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From 26647faf120b74676d6c7f4e391d8ca6c9387a33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 8924fcd9f5f59..a89d78afc8970 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -265,13 +265,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req, err); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0); +-- +2.51.0 + diff --git a/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..debc3afd5c --- /dev/null +++ b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 9c14959c4c0ca60dbbe3a2bebd3eb5a9fa33cbe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index a6f4ee3918977..021b94a383d13 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-14259 b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-14259 new file mode 100644 index 0000000000..0cd30fccdd --- /dev/null +++ b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-14259 @@ -0,0 +1,67 @@ +From 27a0a19aca6e01d4eb9c8c1394e732966b0e1011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-17902 b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-17902 new file mode 100644 index 0000000000..cb043e11f1 --- /dev/null +++ b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-17902 @@ -0,0 +1,111 @@ +From ce47bcb92bfb4c56692a9ad7106d87437f42e949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index 8e4d22a6ba0b2..846a8c4ea394f 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -80,8 +80,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21687 b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21687 new file mode 100644 index 0000000000..eb714e1d1d --- /dev/null +++ b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21687 @@ -0,0 +1,112 @@ +From df37e3a1444594f434f243e34bbda382273fbd76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..2b9b648ba5 --- /dev/null +++ b/queue-5.4/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From 1e97348620b8446d5537f780beebfeaa66bea6f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-5.4/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-5.4/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..16d29db4ea --- /dev/null +++ b/queue-5.4/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From f6ec95a63639576f4de0433a61d8ccfa04822c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index cc0efcb4a553c..a0a5590573b03 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2359,8 +2359,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2379,11 +2379,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-5.4/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-5.4/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..e3648bf101 --- /dev/null +++ b/queue-5.4/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From c7bdfd51b8d054eebf0256ab179b1be3e4f1075e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 476a22728e8d1..d2be874af7d3c 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1327,6 +1327,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-5.4/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-5.4/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..c4abb375a9 --- /dev/null +++ b/queue-5.4/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From 9660391fe7b34cf62da16eebf223ac37dff0f4fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 5a21777197e95..cfdbe90f867e0 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-5.4/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-5.4/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..ac9ec2d3e9 --- /dev/null +++ b/queue-5.4/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From fc125761c4b9a73137465304e3c716bcd136dce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index 9337c30f0743b..607c3f18356a4 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-5.4/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-5.4/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..d6ef1d8c8c --- /dev/null +++ b/queue-5.4/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From 85dffec5ddfd40c1f3abe9190289b20fbc8b50b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index ee8fa558e3edd..d31b7e5895ce8 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-5.4/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-5.4/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..ee778d1c95 --- /dev/null +++ b/queue-5.4/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 6cc7b4755b587facfc5053a09cba1b0ffca08f9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 3fc457bc16db3..18349ec0c1010 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-5.4/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-5.4/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..362a3cf724 --- /dev/null +++ b/queue-5.4/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From f9ce0c7c8d85cf2b246c5fcf496b1d6a23cce4c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index ed6316c41cb78..0123d93323114 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1720,33 +1720,32 @@ void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-5.4/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-5.4/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..9010f421e3 --- /dev/null +++ b/queue-5.4/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From 34325cbb33d4e623efe23ba9edfa580b98873db9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index 68efb300c0d88..8c3603f113894 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.4/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-5.4/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..5fdbc891fa --- /dev/null +++ b/queue-5.4/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From ca9cc5e413a6e21312a9f8ffe711152d1412a798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 40e10f6e3dbf8..9f9826b94ad40 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -667,10 +667,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-5.4/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-5.4/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..d7c1909220 --- /dev/null +++ b/queue-5.4/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 80637d690de558bf673495125a2411745dd78233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 6669164abadcb..531a0cb93b47b 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -253,7 +253,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -263,10 +263,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-6.1/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.1/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..9f81926543 --- /dev/null +++ b/queue-6.1/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 7b6d20a1292a72c209c77b5b81e4f2f2ac2f8e8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 129c503b0951e..78c9f56b4ba34 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-6.1/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.1/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..c9083f98fb --- /dev/null +++ b/queue-6.1/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From 3fb48a75cf41b3b56f3df0a645e0060d2e395f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 3386d01c1f157..afa3b4ac367a3 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1411,6 +1411,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-6.1/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.1/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..33340afa63 --- /dev/null +++ b/queue-6.1/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From afdda3578461ef7d0cb34785f23c7ca810561e9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index b5b0d43bb8dcd..c3f2717aebf25 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-6.1/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.1/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..98877d769c --- /dev/null +++ b/queue-6.1/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 3050001ac7e979b0f8e9121f86d37ab97d2516f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e4904faf17532..0af2598899fc5 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -868,7 +868,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCK1..4 settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -912,7 +912,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-6.1/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.1/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..89ff8e3111 --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From aaeb0eaabed0c24dc744561dc171c9e145add2fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-6.1/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.1/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch new file mode 100644 index 0000000000..6f0cea5d2d --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch @@ -0,0 +1,43 @@ +From b8d3b5bab77d226506aa92e5c273a40b8c39b09f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 13:19:53 +0100 +Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 + +From: Biju Das + +[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ] + +On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we +are deleting a wrong and nonexistent node. Fixing the wrong node would +invoke a dtb warning message, as channel0 is a required property. +Disable CAN-FD channel0 instead of deleting the node. + +Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 6be25a8a28db7..866f1358d57a4 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -50,7 +50,10 @@ aliases { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +-- +2.51.0 + diff --git a/queue-6.1/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.1/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..372252cd4d --- /dev/null +++ b/queue-6.1/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 815704336c8054875b0989dd4fdc9509b8e13761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 4dd37848b30e3..fa2c3981dacac 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.1/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..e341377782 --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From c3d2e49fc127b8a7b46eabf102c703fdf828bd5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index b00a9fdd7a9cc..6af53a766c27d 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.1/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..5b11d48ed8 --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From 25a85c0b72d6bedb7e600d0a043becd96b2d1869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index d74d184e1c7f3..b9990cb1181ff 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-6.1/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.1/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..77e52c0620 --- /dev/null +++ b/queue-6.1/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From 7a097d855fd3aacd220273058c8cd103d59ff128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 4515288fbe351..f5870efec33e9 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -176,9 +176,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-6.1/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.1/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..44d64c5f35 --- /dev/null +++ b/queue-6.1/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From aa9dd3ed68a8ca6a8efedd1b07f004f46c9b2a1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 305b47a38429e..741c4085b9e45 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -547,7 +547,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.1/bluetooth-hci_sync-fix-using-random-address-for-big-.patch new file mode 100644 index 0000000000..1a7c9bf168 --- /dev/null +++ b/queue-6.1/bluetooth-hci_sync-fix-using-random-address-for-big-.patch @@ -0,0 +1,57 @@ +From fdcd3c1e74cd57fa1e81d8dfaa6127038ac7a7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 12:30:05 -0400 +Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA + advertisements + +From: Luiz Augusto von Dentz + +[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ] + +When creating an advertisement for BIG the address shall not be +non-resolvable since in case of acting as BASS/Broadcast Assistant the +address must be the same as the connection in order to use the PAST +method and even when PAST/BASS are not in the picture a Periodic +Advertisement can still be synchronized thus the same argument as to +connectable advertisements still stand. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Luiz Augusto von Dentz +Reviewed-by: Paul Menzel +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 4c1b2468989a8..851a43a5aee0c 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1304,7 +1304,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1342,10 +1342,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.1/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch new file mode 100644 index 0000000000..7ab6fbc542 --- /dev/null +++ b/queue-6.1/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch @@ -0,0 +1,38 @@ +From 96075aa64ca67f7ce10051d0518115d8f93a0d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:22 +0300 +Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX + +From: Pauli Virtanen + +[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ] + +For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the +skb is leaked. + +Free skb after copying its data. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 5f6e4c79e190b..c542497f040cc 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -1729,7 +1729,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.1/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch new file mode 100644 index 0000000000..da7a2eff8f --- /dev/null +++ b/queue-6.1/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch @@ -0,0 +1,40 @@ +From 0830c53d3508c7717623833638a1dd9a22e4ed7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:27:51 -0400 +Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free + +From: Luiz Augusto von Dentz + +[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] + +This attempt to fix similar issue to sco_conn_free where if the +conn->sk is not set to NULL may lead to UAF on iso_conn_free. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 437cbeaa96193..5f6e4c79e190b 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -581,6 +581,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +-- +2.51.0 + diff --git a/queue-6.1/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.1/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..6440896504 --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From c46218037e2719e9eee9b35da47b34d227da9c60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 27876512c63a4..a11d25c389f8f 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4483,13 +4483,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +-- +2.51.0 + diff --git a/queue-6.1/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.1/bpf-enforce-expected_attach_type-for-tailcall-compat.patch new file mode 100644 index 0000000000..bbcf7eae2c --- /dev/null +++ b/queue-6.1/bpf-enforce-expected_attach_type-for-tailcall-compat.patch @@ -0,0 +1,93 @@ +From e5266d1fe6b7d0f1231ab0fb75f85ea820d909c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 19:12:00 +0200 +Subject: bpf: Enforce expected_attach_type for tailcall compatibility + +From: Daniel Borkmann + +[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ] + +Yinhao et al. recently reported: + + Our fuzzer tool discovered an uninitialized pointer issue in the + bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. + This leads to a NULL pointer dereference when a BPF program attempts to + deference the txq member of struct xdp_buff object. + +The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the +entry point for bpf_prog_test_run_xdp() and its expected_attach_type can +neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot +of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP +to pass xdp_is_valid_access() validation. The program returns struct xdp_md's +egress_ifindex, and the latter is only allowed to be accessed under mentioned +expected_attach_type. progB is then inserted into the tailcall which progA +calls. + +The underlying issue goes beyond XDP though. Another example are programs +of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well +as sock_addr_func_proto() have different logic depending on the programs' +expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME +should not be allowed doing a tailcall into a program which calls bpf_bind() +out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. + +In short, specifying expected_attach_type allows to open up additional +functionality or restrictions beyond what the basic bpf_prog_type enables. +The use of tailcalls must not violate these constraints. Fix it by enforcing +expected_attach_type in __bpf_prog_map_compatible(). + +Note that we only enforce this for tailcall maps, but not for BPF devmaps or +cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and +cpu_map_bpf_prog_run*() which set up a new environment / context and therefore +these situations are not prone to this issue. + +Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") +Reported-by: Yinhao Hu +Reported-by: Kaiyan Mei +Reviewed-by: Dongliang Mu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 + + kernel/bpf/core.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 5f01845627d49..142a21f019ff8 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -228,6 +228,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 3136af6559a82..6924f86a8a3ff 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2137,6 +2137,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2148,6 +2149,10 @@ bool bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +-- +2.51.0 + diff --git a/queue-6.1/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.1/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..0cb2abf1b9 --- /dev/null +++ b/queue-6.1/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 0e6f98201db6cf02733a6aadd64410030b958777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index cd0c28e94979a..183ede9345e61 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9100,13 +9100,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-6.1/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.1/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch new file mode 100644 index 0000000000..e83b2d3591 --- /dev/null +++ b/queue-6.1/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch @@ -0,0 +1,57 @@ +From 78d90695335cecc1c18c0bf0256cb98cd20cc908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:14:29 +0800 +Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run + +From: Tao Chen + +[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ] + +Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run +called all the way from graph tracer, which disables preemption in +function_graph_enter_regs, as Jiri and Yonghong suggested, there is no +need to use migrate_disable. As a result, some overhead may will be reduced. +And add cant_sleep check for __this_cpu_inc_return. + +Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 243122ca56793..e6fde598f7629 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2636,18 +2636,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct bpf_run_ctx *old_run_ctx; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + err = 0; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.51.0 + diff --git a/queue-6.1/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.1/bpf-selftests-fix-test_tcpnotify_user.patch new file mode 100644 index 0000000000..296887bb95 --- /dev/null +++ b/queue-6.1/bpf-selftests-fix-test_tcpnotify_user.patch @@ -0,0 +1,139 @@ +From 8a065e53573aee9c8787e1a15f9156c1daa79c09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:12:14 +0000 +Subject: bpf/selftests: Fix test_tcpnotify_user + +From: Matt Bobrowski + +[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ] + +Based on a bisect, it appears that commit 7ee988770326 ("timers: +Implement the hierarchical pull model") has somehow inadvertently +broken BPF selftest test_tcpnotify_user. The error that is being +generated by this test is as follows: + + FAILED: Wrong stats Expected 10 calls, got 8 + +It looks like the change allows timer functions to be run on CPUs +different from the one they are armed on. The test had pinned itself +to CPU 0, and in the past the retransmit attempts also occurred on CPU +0. The test had set the max_entries attribute for +BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling +bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was +likely to be in range. With the change to allow timers to run on other +CPUs, the current CPU tasked with performing the retransmit might be +bumped and in turn fall out of range, as the event will be filtered +out via __bpf_perf_event_output() using: + + if (unlikely(index >= array->map.max_entries)) + return -E2BIG; + +A possible change would be to explicitly set the max_entries attribute +for perf_event_map in test_tcpnotify_kern.c to a value that's at least +as large as the number of CPUs. As it turns out however, if the field +is left unset, then the libbpf will determine the number of CPUs available +on the underlying system and update the max_entries attribute accordingly +in map_set_def_max_entries(). + +A further problem with the test is that it has a thread that continues +running up until the program exits. The main thread cleans up some +LIBBPF data structures, while the other thread continues to use them, +which inevitably will trigger a SIGSEGV. This can be dealt with by +telling the thread to run for as long as necessary and doing a +pthread_join on it before exiting the program. + +Finally, I don't think binding the process to CPU 0 is meaningful for +this test any more, so get rid of that. + +Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") +Signed-off-by: Matt Bobrowski +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 - + .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++---------- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85..ef00d38b0a8d2 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f..35b4893ccdf8a 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +-- +2.51.0 + diff --git a/queue-6.1/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.1/coresight-etm4x-conditionally-access-register-trcext.patch new file mode 100644 index 0000000000..cf227c0763 --- /dev/null +++ b/queue-6.1/coresight-etm4x-conditionally-access-register-trcext.patch @@ -0,0 +1,91 @@ +From 961dfd2aeb51c6598a6ecf118b2ae82237719694 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 01:24:45 -0700 +Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR + +From: Yuanfang Zhang + +[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ] + +The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. +To avoid invalid accesses, introduce a check on numextinsel +(derived from TRCIDR5[11:9]) before reading or writing to this register. + +Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") +Signed-off-by: Yuanfang Zhang +Reviewed-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++ + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 1ad689db74da1..d89153d0517ec 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -451,7 +451,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1239,6 +1240,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1671,7 +1673,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1803,7 +1807,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 31754173091b9..b183d1d12f129 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -995,6 +996,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +-- +2.51.0 + diff --git a/queue-6.1/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.1/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..3134c562dc --- /dev/null +++ b/queue-6.1/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 79c69e915b7f5ce2c2d18b34175c3ba8b3af7224 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 925f6c9cecff4..bc6e247443e80 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -21,7 +21,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-6.1/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.1/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..ec0f556882 --- /dev/null +++ b/queue-6.1/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From 9dabf61e2f5ae94674221813caa69be0bedb6928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index bc6e247443e80..a584e5e83fb57 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -743,12 +743,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -758,7 +758,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-6.1/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.1/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..913f18ccde --- /dev/null +++ b/queue-6.1/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From e11d242646e1422298bec710781a17ce50e4c521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 6ff77003a96ea..68325ebd56fe3 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-6.1/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.1/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch new file mode 100644 index 0000000000..d0fb39cbb4 --- /dev/null +++ b/queue-6.1/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch @@ -0,0 +1,58 @@ +From e1c7626e7172b121f85563598901a0bab9c1daa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 17:22:12 +0200 +Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe + +From: Johan Hovold + +[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ] + +Make sure to drop the reference to the saw device taken by +of_find_device_by_node() after retrieving its driver data during +probe(). + +Also drop the reference to the CPU node sooner to avoid leaking it in +case there is no saw node or device. + +Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index beedf22cbe78b..716474a793817 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -97,20 +97,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.1/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.1/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch new file mode 100644 index 0000000000..4decc61172 --- /dev/null +++ b/queue-6.1/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch @@ -0,0 +1,38 @@ +From 38b8fc8ae8d646fae5db6abb6160dcd7b0da88ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:57:54 +0800 +Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs + +From: Chenghai Huang + +[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ] + +When the initialization of qm->debug.acc_diff_reg fails, +the probe process does not exit. However, after qm->debug.qm_diff_regs is +freed, it is not set to NULL. This can lead to a double free when the +remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs +should be set to NULL after it is freed. + +Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index a1d41ee39816b..cb27a44671ca1 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -815,6 +815,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.1/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.1/crypto-hisilicon-re-enable-address-prefetch-after-de.patch new file mode 100644 index 0000000000..b7fe2914de --- /dev/null +++ b/queue-6.1/crypto-hisilicon-re-enable-address-prefetch-after-de.patch @@ -0,0 +1,200 @@ +From 0e0c453fd81f03327ece95c8c909b1673bcfc522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:05 +0800 +Subject: crypto: hisilicon - re-enable address prefetch after device resuming + +From: Chenghai Huang + +[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ] + +When the device resumes from a suspended state, it will revert to its +initial state and requires re-enabling. Currently, the address prefetch +function is not re-enabled after device resuming. Move the address prefetch +enable to the initialization process. In this way, the address prefetch +can be enabled when the device resumes by calling the initialization +process. + +Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +- + drivers/crypto/hisilicon/qm.c | 3 - + drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------ + drivers/crypto/hisilicon/zip/zip_main.c | 5 +- + 4 files changed, 43 insertions(+), 48 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index b0596564d27d8..c72980dcce52b 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1367,8 +1368,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index a9bf65da30a68..42f1e7d0023e1 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4268,9 +4268,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 8dd4c0b10a74a..99f3e82e9ebfb 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -438,6 +438,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -471,45 +510,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1092,7 +1093,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 4e10090067f18..044e7303cb632 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -578,6 +578,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; +@@ -589,6 +590,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return 0; +@@ -1173,9 +1175,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- hisi_zip_set_high_perf(qm); +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +-- +2.51.0 + diff --git a/queue-6.1/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.1/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch new file mode 100644 index 0000000000..09d2023cc5 --- /dev/null +++ b/queue-6.1/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch @@ -0,0 +1,67 @@ +From d223a1801378dc39666acbe6c2ad615ea6682f6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:04 +0800 +Subject: crypto: hisilicon/zip - remove unnecessary validation for + high-performance mode configurations + +From: Chenghai Huang + +[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ] + +When configuring the high-performance mode register, there is no +need to verify whether the register has been successfully +enabled, as there is no possibility of a write failure for this +register. + +Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 86e5178120936..4e10090067f18 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -470,10 +470,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -483,13 +482,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -1181,9 +1173,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; ++ hisi_zip_set_high_perf(qm); + + hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); +-- +2.51.0 + diff --git a/queue-6.1/documentation-trace-historgram-design-separate-sched.patch b/queue-6.1/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..f2ff7037ac --- /dev/null +++ b/queue-6.1/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 5e014f71c420ca45a32b33336f76d85f8beb83a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 088c8cce738ba..6e0d1a48bd505 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-6.1/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.1/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..849cdffbd3 --- /dev/null +++ b/queue-6.1/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From 3d6920a2e8835d68f435a443dd883bc1dce92156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index cbaa4e2eddcef..6153dbd5be903 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -871,7 +871,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-6.1/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.1/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..c9aca59af9 --- /dev/null +++ b/queue-6.1/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From f687b48dc1b782f8c9c9b5296fc6730b7dcf9a45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index a4141b57b1478..cbaa4e2eddcef 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -869,6 +869,11 @@ int __register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.1/drm-amd-display-remove-redundant-semicolons.patch new file mode 100644 index 0000000000..c120282927 --- /dev/null +++ b/queue-6.1/drm-amd-display-remove-redundant-semicolons.patch @@ -0,0 +1,34 @@ +From d9366ae3b29f8c548151718415177153d7479dbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:50:14 +0800 +Subject: drm/amd/display: Remove redundant semicolons + +From: Liao Yuanhong + +[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ] + +Remove unnecessary semicolons. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Liao Yuanhong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4..6c75aa82327ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.1/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch new file mode 100644 index 0000000000..77414af6e3 --- /dev/null +++ b/queue-6.1/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch @@ -0,0 +1,57 @@ +From e48ca52f863b1bbfda2001a37fb86979e26a9ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:07 +0200 +Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ] + +Based on some comments in dm_pp_display_configuration +above the crtc_index and line_time fields, these values +are programmed to the SMC to work around an SMC hang +when it switches MCLK. + +According to Alex, the Windows driver programs them to: +mclk_change_block_cp_min = 200 / line_time +mclk_change_block_cp_max = 100 / line_time +Let's use the same for the sake of consistency. + +Previously we used the watermark values, but it seemed buggy +as the code was mixing up low/high and A/B watermarks, and +was not saving a low watermark value on DCE 6, so +mclk_change_block_cp_max would be always zero previously. + +Split this change off from the previous si_upload_smc_data +to make it easier to bisect, in case it causes any issues. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 85ab0d87eb337..267aa96edc890 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + crtc_index = amdgpu_crtc->crtc_id; + + if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; + } + } + +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.1/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch new file mode 100644 index 0000000000..9a0715fd01 --- /dev/null +++ b/queue-6.1/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch @@ -0,0 +1,48 @@ +From 55da5ee2e3b74b46e35ff54a262c8c36aed2a9fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:09 +0200 +Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ] + +According to pp_pm_compute_clocks the non-DC display code +has "issues with mclk switching with refresh rates over 120 hz". +The workaround is to disable MCLK switching in this case. + +Do the same for legacy DPM. + +Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c..2d2d2d5e67634 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.1/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch new file mode 100644 index 0000000000..93499c8a4a --- /dev/null +++ b/queue-6.1/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch @@ -0,0 +1,99 @@ +From cbc4e659a2cb5fdd9262ea12e4f2bd8175218b41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:10 +0200 +Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks + (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ] + +Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk +switching on Oland when two 4K 60Hz monitors are connected") + +This is an ad-hoc DPM fix, necessary because we don't have +proper bandwidth calculation for DCE 6. + +We define "high pixelclock" for SI as higher than necessary +for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into +this category. + +When two high pixel clock displays are connected to Oland, +additionally disable shader clock switching, which results in +a higher voltage, thereby addressing some visible flickering. + +v2: +Add more comments. +v3: +Split into two commits for easier review. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index b3c011542daf7..7a85c042a6db9 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.1/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch new file mode 100644 index 0000000000..c8c0a776b0 --- /dev/null +++ b/queue-6.1/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch @@ -0,0 +1,53 @@ +From f79300a82782579577cf9c524d0b243ca3d30322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:04 +0200 +Subject: drm/amd/pm: Disable ULV even if unsupported (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ] + +Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode +is unsupported, to make sure it is properly turned off. + +v3: +Simplify si_disable_ulv further. +Always check the return value of amdgpu_si_send_msg_to_smc. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 52e4397d4a2a9..c17d567cf8bc5 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; ++ PPSMC_Result r; + +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; +- +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.1/drm-amd-pm-fix-si_upload_smc_data-v3.patch new file mode 100644 index 0000000000..2fd2584a7e --- /dev/null +++ b/queue-6.1/drm-amd-pm-fix-si_upload_smc_data-v3.patch @@ -0,0 +1,106 @@ +From 4b34ab5e1a5d8606e736d61944a640f0373784c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:06 +0200 +Subject: drm/amd/pm: Fix si_upload_smc_data (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ] + +The si_upload_smc_data function uses si_write_smc_soft_register +to set some register values in the SMC, and expects the result +to be PPSMC_Result_OK which is 1. + +The PPSMC_Result_OK / PPSMC_Result_Failed values are used for +checking the result of a command sent to the SMC. +However, the si_write_smc_soft_register actually doesn't send +any commands to the SMC and returns zero on success, +so this check was incorrect. + +Fix that by not checking the return value, just like other +calls to si_write_smc_soft_register. + +v3: +Additionally, when no display is plugged in, there is no need +to restrict MCLK switching, so program the registers to zero. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++---------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index c17d567cf8bc5..85ab0d87eb337 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5793,9 +5793,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5804,26 +5804,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.1/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch new file mode 100644 index 0000000000..2dc5a44efa --- /dev/null +++ b/queue-6.1/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch @@ -0,0 +1,53 @@ +From c814ba10787d3008d4601f5a682c052135b54bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:08 +0200 +Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ] + +Some parts of the code base expect that MCLK switching is turned +off when the vblank time is set to zero. + +According to pp_pm_compute_clocks the non-DC code has issues +with MCLK switching with refresh rates over 120 Hz. + +v3: +Add code comment to explain this better. +Add an if statement instead of changing the switch_limit. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 267aa96edc890..b3c011542daf7 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.1/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..afb6d8e4eb --- /dev/null +++ b/queue-6.1/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From 3212a2e6d479e62308a089b70941347763d53fb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 0fef925b66024..e458e0d5801b0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @handle: handle used to pass amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-6.1/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.1/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..82715dbb03 --- /dev/null +++ b/queue-6.1/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From 3cf61ca42c65c67490a352d25ee4117d2ba7dd19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 09ce90cf6b532..2ee3a74ae0d8f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4002,7 +4002,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.1/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.1/drm-msm-dpu-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..6e9d0baae7 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-fix-incorrect-type-for-ret.patch @@ -0,0 +1,40 @@ +From 91a27b1508e696f3373b749f6143836c2537a6bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:20:45 +0800 +Subject: drm/msm/dpu: fix incorrect type for ret + +From: Qianfeng Rong + +[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ] + +Change 'ret' from unsigned long to int, as storing negative error codes +in an unsigned long makes it never equal to -ETIMEDOUT, causing logical +errors. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Qianfeng Rong +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/671100/ +Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 05a09d86e1838..fd5f9d04f81e6 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -452,7 +452,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +-- +2.51.0 + diff --git a/queue-6.1/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.1/drm-panel-novatek-nt35560-fix-invalid-return-value.patch new file mode 100644 index 0000000000..9299853e01 --- /dev/null +++ b/queue-6.1/drm-panel-novatek-nt35560-fix-invalid-return-value.patch @@ -0,0 +1,42 @@ +From 9993f52c5e84dff742a2c5120421274c9ec97cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 21:23:41 -0600 +Subject: drm/panel: novatek-nt35560: Fix invalid return value + +From: Brigham Campbell + +[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ] + +Fix bug in nt35560_set_brightness() which causes the function to +erroneously report an error. mipi_dsi_dcs_write() returns either a +negative value when an error occurred or a positive number of bytes +written when no error occurred. The buggy code reports an error under +either condition. + +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Reviewed-by: Douglas Anderson +Reviewed-by: Neil Armstrong +Signed-off-by: Brigham Campbell +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index cc7f96d708263..52df7e776fae0 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -162,7 +162,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.1/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.1/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..3692047893 --- /dev/null +++ b/queue-6.1/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From 9e4b37f9e778f95ae6656c5b36873c0205d401a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index 780352f794e91..b63d935391dcd 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-6.1/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.1/f2fs-fix-zero-sized-extent-for-precache-extents.patch new file mode 100644 index 0000000000..7c3dc68a80 --- /dev/null +++ b/queue-6.1/f2fs-fix-zero-sized-extent-for-precache-extents.patch @@ -0,0 +1,97 @@ +From a2d66d08c1a7822ca4f36d0e2edb7d2b3e64e689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:36:21 +0800 +Subject: f2fs: fix zero-sized extent for precache extents + +From: wangzijie + +[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ] + +Script to reproduce: +f2fs_io write 1 0 1881 rand dsync testfile +f2fs_io fallocate 0 7708672 4096 testfile +f2fs_io write 1 1881 1 rand buffered testfile +fsync testfile +umount +mount +f2fs_io precache_extents testfile + +When the data layout is something like this: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +During precache_extents, we map the last block(valid blkaddr) in dnode1: +map->m_flags |= F2FS_MAP_MAPPED; +map->m_pblk = blkaddr(valid blkaddr); +map->m_len = 1; +then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: +map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: + +map->m_len = 1 +ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 +ei.fofs = start_pgofs = 1882 +ei.len = map->m_len - ofs = 1 - 1 = 0 + +Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: +A,B,C is valid blkaddr +case1: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case2: +dnode1: dnode2: +[0] A [0] C (C!=B+1) +[1] A+1 [1] C+1 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case3: +dnode1: dnode2: +[0] A [0] C (C!=B+2) +[1] A+1 [1] C+1 +... .... +[1015] A+1015 +[1016] B (B!=A+1016) +[1017] B+1 [1017] 0x0 + +[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: wangzijie +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 2b018d365b914..ac7d0ed3fb894 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1737,9 +1737,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) + *map->m_next_extent = pgofs + 1; +-- +2.51.0 + diff --git a/queue-6.1/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.1/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..58e7659b82 --- /dev/null +++ b/queue-6.1/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From c4c9516ae6200800d63a197e90223ec3f4b1aa62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index 1646dadd7f37c..3b1c8d93b2654 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-6.1/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.1/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..aae6dd08e1 --- /dev/null +++ b/queue-6.1/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From eceb6b11cfb27aa032118f19f68e955ef2d53759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-6.1/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.1/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..0295ef11f2 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,85 @@ +From 1b866d14057b41e7a080cfb5a507ea7dc6143b96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 12d8682f33b53..340a4cbe8b5ca 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else + return -EINVAL; + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1148,7 +1153,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-6.1/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.1/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch new file mode 100644 index 0000000000..37be390b8e --- /dev/null +++ b/queue-6.1/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch @@ -0,0 +1,102 @@ +From 7c2562aa02b5dd391640a979de1fbaf0a3811c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:48:58 +0200 +Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from + different subsystems + +From: Vadim Pasternak + +[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ] + +Distinct between fan speed setting request coming for hwmon and +thermal subsystems. + +There are fields 'last_hwmon_state' and 'last_thermal_state' in the +structure 'mlxreg_fan_pwm', which respectively store the cooling state +set by the 'hwmon' and 'thermal' subsystem. +The purpose is to make arbitration of fan speed setting. For example, if +fan speed required to be not lower than some limit, such setting is to +be performed through 'hwmon' subsystem, thus 'thermal' subsystem will +not set fan below this limit. + +Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing +cooling state to never be set to a lower value. + +Eliminate update of 'last_thermal_state', when request is coming from +'hwmon' subsystem. + +Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index 7514d57661048..fbb18bd3f09b9 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -347,9 +348,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -359,7 +359,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -371,6 +372,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +-- +2.51.0 + diff --git a/queue-6.1/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.1/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..89c8ae9536 --- /dev/null +++ b/queue-6.1/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 53d6ed526ebbeba588441ac6be5f8f21d876de20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 2f2f21f1b659e..d7b42888f25c2 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.1/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.1/hwrng-nomadik-add-arm_amba-dependency.patch new file mode 100644 index 0000000000..2cca940375 --- /dev/null +++ b/queue-6.1/hwrng-nomadik-add-arm_amba-dependency.patch @@ -0,0 +1,44 @@ +From 6fc2a5e8c97cf8bb4ab5dcd131aedc81ae9257b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 17:28:00 +0200 +Subject: hwrng: nomadik - add ARM_AMBA dependency + +From: Arnd Bergmann + +[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ] + +Compile-testing this driver is only possible when the AMBA bus driver is +available in the kernel: + +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': +nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': +nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' +x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' + +The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be +specified for the COMPILE_TEST case. + +Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index 3da8e85f8aae0..84e13fd67ea6c 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.51.0 + diff --git a/queue-6.1/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.1/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..079c1ff03c --- /dev/null +++ b/queue-6.1/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From 3a978dc8dc33925e7c45976979a0141fa0cb741c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 74182db03a88b..a29f4ef793cf3 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -380,6 +380,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-6.1/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.1/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..fee5f660f2 --- /dev/null +++ b/queue-6.1/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From a32c81794da559028b530fadaafca4af07580e09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index fc7bfd98156ba..38d3dff7a2614 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1218,6 +1218,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1231,6 +1232,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1255,12 +1257,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1268,7 +1268,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-6.1/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.1/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..c53a186b17 --- /dev/null +++ b/queue-6.1/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From 7cd66a71171a9147e86799250408e1ee0c2eaabd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index a18d5876678c1..fda472d84549b 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -361,6 +361,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.1/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.1/i3c-master-svc-use-manual-response-for-ibi-events.patch new file mode 100644 index 0000000000..c8029960f4 --- /dev/null +++ b/queue-6.1/i3c-master-svc-use-manual-response-for-ibi-events.patch @@ -0,0 +1,96 @@ +From eacc22b04c870c6999bdeb4369f5ce2b4fe926b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:08 +0800 +Subject: i3c: master: svc: Use manual response for IBI events + +From: Stanley Chu + +[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ] + +Driver wants to nack the IBI request when the target is not in the +known address list. In below code, svc_i3c_master_nack_ibi() will +cause undefined behavior when using AUTOIBI with auto response rule, +because hw always auto ack the IBI request. + + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); + if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) + svc_i3c_master_nack_ibi(master); + ... + break; + +AutoIBI has another issue that the controller doesn't quit AutoIBI state +after IBIWON polling timeout when there is a SDA glitch(high->low->high). +1. SDA high->low: raising an interrupt to execute IBI ISR +2. SDA low->high +3. Driver writes an AutoIBI request +4. AutoIBI process does not start because SDA is not low +5. IBIWON polling times out +6. Controller reamins in AutoIBI state and doesn't accept EmitStop request + +Emitting broadcast address with IBIRESP_MANUAL avoids both issues. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 9b287f92d078d..a18d5876678c1 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -422,9 +422,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -444,10 +459,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +-- +2.51.0 + diff --git a/queue-6.1/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.1/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..37396d708a --- /dev/null +++ b/queue-6.1/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 65cbb5710d80daae5b1f82e51c40b3eec868df50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 8c69bdb5bb754..f56eee73ee4a1 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1021,6 +1021,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1028,7 +1030,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1046,9 +1047,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.1/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..ca541f5193 --- /dev/null +++ b/queue-6.1/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 2d86bb08764777fdcb2cbb180f603ddff32410dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 5c210f48bd9ce..c7795feb904ed 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -669,7 +669,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.1/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch new file mode 100644 index 0000000000..325162986d --- /dev/null +++ b/queue-6.1/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch @@ -0,0 +1,39 @@ +From 8d8c9db356c535c1918f7637f894787758cf6ea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:11:05 +0200 +Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD + +From: Geert Uytterhoeven + +[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ] + +INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and +init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to +prevent asking the user about this feature when configuring a kernel +without initramfs support. + +Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Martin Wilck +Reviewed-by: David Disseldorp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 8b6a2848da4a5..b70e0e05a1856 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1405,6 +1405,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +-- +2.51.0 + diff --git a/queue-6.1/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.1/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..604e34df8b --- /dev/null +++ b/queue-6.1/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From 7f8b31987f69d7e3ab107aed5cc0c62ad307c8d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index ef1f45e43b630..61d3797fb7995 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-6.1/libbpf-fix-reuse-of-devmap.patch b/queue-6.1/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..a04876e2f5 --- /dev/null +++ b/queue-6.1/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From 5fc06f89f8487e421331582a185c6ddf8777abb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 2fb66ca0f50a5..7bd6aff6e260e 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -4882,6 +4882,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-6.1/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.1/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..60b064d711 --- /dev/null +++ b/queue-6.1/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From 4eb823365201d271922a8473eb8e9474c3b22c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index 1c3502f34cd37..86f4971222ba7 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-6.1/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.1/media-st-delta-avoid-excessive-stack-usage.patch new file mode 100644 index 0000000000..d0a8daa3b7 --- /dev/null +++ b/queue-6.1/media-st-delta-avoid-excessive-stack-usage.patch @@ -0,0 +1,92 @@ +From 7d2093502b48f74002d8d8c97d66453ee5bc5ddc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 11:31:56 +0200 +Subject: media: st-delta: avoid excessive stack usage + +From: Arnd Bergmann + +[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ] + +Building with a reduced stack warning limit shows that delta_mjpeg_decode() +copies a giant structure to the stack each time but only uses three of +its members: + +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] + +Open-code the passing of the structure members that are actually used here. + +Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d24..a078f1107300e 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +-- +2.51.0 + diff --git a/queue-6.1/media-zoran-remove-zoran_fh-structure.patch b/queue-6.1/media-zoran-remove-zoran_fh-structure.patch new file mode 100644 index 0000000000..34dbf5c3b9 --- /dev/null +++ b/queue-6.1/media-zoran-remove-zoran_fh-structure.patch @@ -0,0 +1,63 @@ +From 3a5b287fa79b05863f5c02895f1e9f9537a62a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 04:30:15 +0300 +Subject: media: zoran: Remove zoran_fh structure + +From: Jacopo Mondi + +[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ] + +The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been +mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), +but the structure stayed by mistake. It is now used in a single +location, assigned from a void pointer and then recast to a void +pointer, without being every accessed. Drop it. + +Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") +Signed-off-by: Jacopo Mondi +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/zoran/zoran.h | 6 ------ + drivers/media/pci/zoran/zoran_driver.c | 3 +-- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 56340553b2823..63592c4f9ed8c 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index fa672cc8bc678..feb39854a989e 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +-- +2.51.0 + diff --git a/queue-6.1/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.1/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..a91b108513 --- /dev/null +++ b/queue-6.1/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From 8f5c90f8aae611e8ee0566180b5d51430f7673fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-6.1/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.1/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch new file mode 100644 index 0000000000..f7d7b592bf --- /dev/null +++ b/queue-6.1/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch @@ -0,0 +1,50 @@ +From 27915d61f6e0a5daa9d00ccc80811b1b52d710da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 14:07:27 +0300 +Subject: mtd: rawnand: atmel: Fix error handling path in + atmel_nand_controller_add_nands + +From: Erick Karanja + +[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ] + +In case of a jump to the err label due to atmel_nand_create() or +atmel_nand_controller_add_nand() failure, the reference to nand_np +need to be released + +Use for_each_child_of_node_scoped() to fix the issue. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") + +Signed-off-by: Erick Karanja +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 78f317ac04afa..56fd897721ad5 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1859,7 +1859,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1886,7 +1886,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +-- +2.51.0 + diff --git a/queue-6.1/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.1/nbd-restrict-sockets-to-tcp-and-udp.patch new file mode 100644 index 0000000000..a77b15df17 --- /dev/null +++ b/queue-6.1/nbd-restrict-sockets-to-tcp-and-udp.patch @@ -0,0 +1,54 @@ +From d034885df7631c210491d6f38bca52d4b34d5dd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:22:43 +0000 +Subject: nbd: restrict sockets to TCP and UDP + +From: Eric Dumazet + +[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] + +Recently, syzbot started to abuse NBD with all kinds of sockets. + +Commit cf1b2326b734 ("nbd: verify socket is supported during setup") +made sure the socket supported a shutdown() method. + +Explicitely accept TCP and UNIX stream sockets. + +Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") +Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 +Signed-off-by: Eric Dumazet +Cc: Mike Christie +Cc: Richard W.M. Jones +Cc: Jens Axboe +Cc: Yu Kuai +Cc: linux-block@vger.kernel.org +Cc: nbd@other.debian.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 120b75ee703d1..2a959c08bd3cb 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1107,6 +1107,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.1/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..4efab63f07 --- /dev/null +++ b/queue-6.1/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From e1719f5e816efd2feae13e0e4bff56d7a562d444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 2acb63b547c35..bf58181589bf2 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -956,15 +956,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-6.1/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.1/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..c8928116ab --- /dev/null +++ b/queue-6.1/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 412ba5d0507efb9476b74f23818bef87ccbe858f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 444ccef76da29..b93abcc4d64b0 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -695,7 +695,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-6.1/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.1/net-mlx5-fw-reset-add-reset-timeout-work.patch new file mode 100644 index 0000000000..d501a2c48d --- /dev/null +++ b/queue-6.1/net-mlx5-fw-reset-add-reset-timeout-work.patch @@ -0,0 +1,97 @@ +From 4f99ee5693b98062238eaaed9f7212141129cf7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:09 +0300 +Subject: net/mlx5: fw reset, add reset timeout work + +From: Moshe Shemesh + +[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ] + +Add sync reset timeout to stop poll_sync_reset in case there was no +reset done or abort event within timeout. Otherwise poll sync reset will +just continue and in case of fw fatal error no health reporting will be +done. + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 1a818759a9aac..de130c75de64e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -22,6 +22,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + struct timer_list timer; + struct completion done; +@@ -180,6 +181,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -250,6 +253,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -445,6 +453,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -513,6 +534,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + int mlx5_fw_reset_init(struct mlx5_core_dev *dev) +@@ -535,6 +557,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +-- +2.51.0 + diff --git a/queue-6.1/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.1/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch new file mode 100644 index 0000000000..3cbd38f003 --- /dev/null +++ b/queue-6.1/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch @@ -0,0 +1,57 @@ +From 0f2e7be3981ac8f3e768db130bd1d9be9794eaf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:08 +0300 +Subject: net/mlx5: pagealloc: Fix reclaim race during command interface + teardown + +From: Shay Drory + +[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ] + +The reclaim_pages_cmd() function sends a command to the firmware to +reclaim pages if the command interface is active. + +A race condition can occur if the command interface goes down (e.g., due +to a PCI error) while the mlx5_cmd_do() call is in flight. In this +case, mlx5_cmd_do() will return an error. The original code would +propagate this error immediately, bypassing the software-based page +reclamation logic that is supposed to run when the command interface is +down. + +Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark +that command interface is down. If this is the case, fall through to +the software reclamation path. If the command failed for any another +reason, or finished successfully, return as before. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 99909c74a2144..cab25eb30ca66 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -483,9 +483,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +-- +2.51.0 + diff --git a/queue-6.1/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.1/net-mlx5-stop-polling-for-command-response-if-interf.patch new file mode 100644 index 0000000000..f081f32c4d --- /dev/null +++ b/queue-6.1/net-mlx5-stop-polling-for-command-response-if-interf.patch @@ -0,0 +1,53 @@ +From ae7cf660b697e1c1fb4a5ea0ab1f74988b34cd62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:07 +0300 +Subject: net/mlx5: Stop polling for command response if interface goes down + +From: Moshe Shemesh + +[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ] + +Stop polling on firmware response to command in polling mode if the +command interface got down. This situation can occur, for example, if a +firmware fatal error is detected during polling. + +This change halts the polling process when the command interface goes +down, preventing unnecessary waits. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index c83523395d5ee..4c614a256ee05 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1056,7 +1060,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +-- +2.51.0 + diff --git a/queue-6.1/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.1/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..7da233f3b0 --- /dev/null +++ b/queue-6.1/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From 95b4ee21e82fdf097871e87333f40961ab841e13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98e..92add3daadbb1 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.1/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.1/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..8accf3eeec --- /dev/null +++ b/queue-6.1/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 2d70ef5e498ac704acf517a931a40e8bf0e086f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 0bd6bf46f05f3..1f9ca5040982d 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -62,7 +62,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-6.1/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.1/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..27b4493f0c --- /dev/null +++ b/queue-6.1/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From cda08cc98c2248bf5587a300d50bd2f40a09e80c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index af376b9000677..7ee919201985f 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1409,7 +1409,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-6.1/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.1/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..c172220868 --- /dev/null +++ b/queue-6.1/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From 836200516047ba760e20a4af5a48d1e818b17c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index f8a91d15982dc..cbcff4603232b 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9231,7 +9231,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.1/null_blk-fix-the-description-of-the-cache_size-modul.patch new file mode 100644 index 0000000000..5177e4c492 --- /dev/null +++ b/queue-6.1/null_blk-fix-the-description-of-the-cache_size-modul.patch @@ -0,0 +1,56 @@ +From 83109d93efa7b7ecdb84e347c7c09383b59adde1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:07:32 +0800 +Subject: null_blk: Fix the description of the cache_size module argument + +From: Genjian Zhang + +[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ] + +When executing modinfo null_blk, there is an error in the description +of module parameter mbps, and the output information of cache_size is +incomplete.The output of modinfo before and after applying this patch +is as follows: + +Before: +[...] +parm: cache_size:ulong +[...] +parm: mbps:Cache size in MiB for memory-backed device. + Default: 0 (none) (uint) +[...] + +After: +[...] +parm: cache_size:Cache size in MiB for memory-backed device. + Default: 0 (none) (ulong) +[...] +parm: mbps:Limit maximum bandwidth (in MiB/s). + Default: 0 (no limit) (uint) +[...] + +Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") +Signed-off-by: Genjian Zhang +Reviewed-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index e66cace433cbf..683e2c61822b0 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static unsigned int g_mbps; + module_param_named(mbps, g_mbps, uint, 0444); +-- +2.51.0 + diff --git a/queue-6.1/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.1/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..112a0db96a --- /dev/null +++ b/queue-6.1/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From e2e28aa2c8d22911842af2a5afd0f6d4e1ba2f7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 570c58d2b5a58..a15e764bae35b 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-6.1/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.1/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..ee323072f2 --- /dev/null +++ b/queue-6.1/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From ef0560125f46e91752e3b5d4af9dcd28d131824d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 64e6ddcfe329a..e28905e58bd6a 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1024,6 +1024,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-6.1/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.1/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..f6b4a3776c --- /dev/null +++ b/queue-6.1/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 968149d393f5f59022010a41cc55ae335a7c5734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 8e323e93be915..c165f69454590 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1346,7 +1346,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.1/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.1/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch new file mode 100644 index 0000000000..db2c4e9172 --- /dev/null +++ b/queue-6.1/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch @@ -0,0 +1,53 @@ +From 4952cc4223dc0a0f3f39eb27233ba425d08f2d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 11:30:22 +0200 +Subject: PCI: tegra194: Fix duplicate PLL disable in + pex_ep_event_pex_rst_assert() + +From: Nagarjuna Kristam + +[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ] + +During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently +called twice. + +pex_ep_event_pex_rst_assert() should do the opposite of +pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate +tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate +tegra_pcie_bpmp_set_pll_state() call should instead be a call to +tegra_pcie_bpmp_set_ctrl_state(). + +With this, the uninitialization sequence also matches that of +tegra_pcie_unconfig_controller(). + +Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") +Signed-off-by: Nagarjuna Kristam +[cassel: improve commit log] +Signed-off-by: Niklas Cassel +Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 0839454fe4994..5100d2a53b8ab 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1720,9 +1720,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +-- +2.51.0 + diff --git a/queue-6.1/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.1/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..5909ae514b --- /dev/null +++ b/queue-6.1/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 38fb763f366c295643e68998bb180bac757825a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 00e3a637f7b63..815bf2e2dffa4 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -95,7 +95,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-6.1/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.1/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..8b4471a3a6 --- /dev/null +++ b/queue-6.1/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From c233f155ddf7cfdf624ea873ab73efdd601c6038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 51408996255bd..e2601e45935e6 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-6.1/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.1/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..166721c23d --- /dev/null +++ b/queue-6.1/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From 6618eff297258376b36d2245bb030bd86850a572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index b438d24c13b5c..ea2fbabe1c64b 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -747,7 +747,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-6.1/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.1/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch new file mode 100644 index 0000000000..4165471eb2 --- /dev/null +++ b/queue-6.1/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch @@ -0,0 +1,40 @@ +From 877597ab4e87f0d7827b856609c9d2cfbbf44d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:58:23 +0300 +Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in + probe() + +From: Dan Carpenter + +[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ] + +The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which +would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check +that the pointer is valid. + +Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") +Signed-off-by: Dan Carpenter +Signed-off-by: Chanwoo Choi +Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/mtk-cci-devfreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index e5458ada5197a..a68f51cc5ef96 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +-- +2.51.0 + diff --git a/queue-6.1/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.1/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..822599ca89 --- /dev/null +++ b/queue-6.1/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From 044696d8058ad608b1ae77ba6ef69230dd620b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index baa31194cf20d..ef5157fc8dcc5 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-6.1/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.1/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch new file mode 100644 index 0000000000..9a3f4b67e5 --- /dev/null +++ b/queue-6.1/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch @@ -0,0 +1,37 @@ +From a12cf6a75fc5b9b5f5a70ba1a7ed777244ff3be5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 20:32:59 +0800 +Subject: power: supply: cw2015: Fix a alignment coding style issue + +From: Andy Yan + +[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ] + +Fix the checkpatch warning: +CHECK: Alignment should match open parenthesis + +Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") +Signed-off-by: Andy Yan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index 9d957cf8edf07..ae6f46b452101 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +-- +2.51.0 + diff --git a/queue-6.1/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.1/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..db9a0ec199 --- /dev/null +++ b/queue-6.1/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From e1e696da6c3189280096a67dfc9fbe58f7edac5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index ea966fc67d287..dbeb67ffebf33 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-6.1/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.1/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..0bbd5de5b9 --- /dev/null +++ b/queue-6.1/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From cc90a2934eb22c31619f52fff58a067023c93eb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 48ca0ff690ae2..6b3248be2bf10 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.1/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.1/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..24663fd2c2 --- /dev/null +++ b/queue-6.1/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From 80aac5386f82834b5248a449635d8fb1d9abe16b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 0a113d0d6b08f..5c336ab12ee1d 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-6.1/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.1/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..9d008e1e14 --- /dev/null +++ b/queue-6.1/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From 64bc5b8580cb275099ba2b84b5cfe74770ae2969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index f253295795f0a..cdb3b99e057cf 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.1/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.1/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..7ec74cdcb6 --- /dev/null +++ b/queue-6.1/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 76119946f64d10fcffe35e12869b9a410185becc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 193f7d58d3845..dce86f5aee1f7 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-6.1/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.1/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..755b04481a --- /dev/null +++ b/queue-6.1/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From 4aa0ac9603018a2cf3f32086c52fe0bab19d05cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 168532931c86d..bdbde64e4b21d 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -880,7 +880,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +-- +2.51.0 + diff --git a/queue-6.1/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.1/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..edc2826f5f --- /dev/null +++ b/queue-6.1/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 90aedaa87baa1e099cc9eb9b430ae11e63edecee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index b9918f4fd2418..7252fa32cf054 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-6.1/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.1/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..7ca3e305f0 --- /dev/null +++ b/queue-6.1/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From dcd3652ff310fbd3428fbe978509015719a59b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 497acfb33f8f8..6cce6dd9fd232 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -162,9 +162,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-6.1/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.1/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..88b3a08bb7 --- /dev/null +++ b/queue-6.1/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From 5868098779b2e9e8c4b8db0fb39b246b850b1176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index a23e3d810f3e4..80af7a5ac6046 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -63,23 +63,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 7612070b66160..887d446354006 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -42,7 +42,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2641,11 +2640,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2655,18 +2652,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.1/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.1/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..719ee087f9 --- /dev/null +++ b/queue-6.1/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From 11584a92787576d3c3681a4a1390f7965a5b9be4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index c8e1ead0c09e6..cb0bf8b6e0172 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1175,19 +1175,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +-- +2.51.0 + diff --git a/queue-6.1/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.1/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..cdbfeb5f15 --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From e914494199d26803d391162633b32f589e7ca672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index e8a4750f6ec47..7d6e4fe31ceed 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-6.1/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.1/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..038ccde430 --- /dev/null +++ b/queue-6.1/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From f199b4f8a6b82203873cb127b85ec3dcc514e847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 95e7c00cb7e54..2626e13e52a2d 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-6.1/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.1/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..1663ce7c98 --- /dev/null +++ b/queue-6.1/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From 0b35b7b3f046be4e3a8071738ba30c9a2ad60bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index a87c3d7e3e5ca..00d70b458b48c 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -704,6 +704,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -720,7 +721,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-6.1/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.1/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..17191af709 --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From ed41feb4e20ff98c6d28db67c891b5de5e0147b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 969008071decd..482c04ac06ba4 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1755,7 +1755,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3621,7 +3621,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.1/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.1/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..2baa70929d --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From e9e8cbd9b337a195114ae0e0b544fb74d0eaa3a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 682e74196f4b0..d2243f809616d 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2060,11 +2060,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-6.1/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.1/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch new file mode 100644 index 0000000000..2217be55ff --- /dev/null +++ b/queue-6.1/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch @@ -0,0 +1,78 @@ +From 53878a9117e3dab21caf7257df2bbbf348d004a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 18:31:18 +0200 +Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too + fast + +From: Johannes Nixdorf + +[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ] + +Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an +event to the tracer, and starts to wait interruptibly. With +SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the +message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting +and is subsequently interrupted, the tracee begins to wait again +uninterruptibly (but killable). + +This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee +is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a +condition to begin waiting again. In this case the tracee is interrupted +even though the tracer already acted on its behalf. This breaks the +assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, +namely that the tracer can be sure the syscall is not interrupted or +restarted on the tracee after it is received on the tracer. Fix this +by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to +switch to uninterruptible waiting. + +With the condition changed the loop in seccomp_do_user_notification() +would exit immediately after deciding that noninterruptible waiting +is required if the operation already reached SECCOMP_NOTIFY_REPLIED, +skipping the code that processes pending addfd commands first. Prevent +this by executing the remaining loop body one last time in this case. + +Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") +Reported-by: Ali Polatel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 +Signed-off-by: Johannes Nixdorf +Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + kernel/seccomp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index e9852d1b4a5ec..8dcb585ae78c1 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1090,7 +1090,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1134,13 +1134,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +-- +2.51.0 + diff --git a/queue-6.1/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.1/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..557f808f78 --- /dev/null +++ b/queue-6.1/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From f5c831ff6153083165460d91fa0f4d38c656f3c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-6.1/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.1/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..6a393fdfdd --- /dev/null +++ b/queue-6.1/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From a0e55976bc7eb8caa1dd595cfadebd7d730fab54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index 09773695d219f..4056706d63f7e 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -240,6 +240,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-6.1/serial-max310x-add-error-checking-in-probe.patch b/queue-6.1/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..fcf7f919e2 --- /dev/null +++ b/queue-6.1/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From 8cce6956a283a1253c68278e206195b09e957f2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 4eb8d372f619f..44b78e979cdc4 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1656,6 +1656,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); + } +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index ac2cab27f6..e3f29017de 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -43,3 +43,131 @@ staging-axis-fifo-flush-rx-fifo-on-read-errors.patch driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch crypto-rng-ensure-set_ent-is-always-present.patch net-9p-fix-double-req-put-in-p9_fd_cancelled.patch +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +init-initramfs_preserve_mtime-should-depend-on-blk_d.patch +seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +smb-server-fix-ird-ord-negotiation-with-the-client.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +bpf-selftests-fix-test_tcpnotify_user.patch +bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch +libbpf-fix-reuse-of-devmap.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +arm-at91-pm-fix-mckx-restore-routine.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch +power-supply-cw2015-fix-a-alignment-coding-style-iss.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +null_blk-fix-the-description-of-the-cache_size-modul.patch +nbd-restrict-sockets-to-tcp-and-udp.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +i3c-master-svc-use-manual-response-for-ibi-events.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +bpf-enforce-expected_attach_type-for-tailcall-compat.patch +drm-panel-novatek-nt35560-fix-invalid-return-value.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +media-zoran-remove-zoran_fh-structure.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +serial-max310x-add-error-checking-in-probe.patch +drm-amd-display-remove-redundant-semicolons.patch +hwrng-nomadik-add-arm_amba-dependency.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +media-st-delta-avoid-excessive-stack-usage.patch +crypto-hisilicon-zip-remove-unnecessary-validation-f.patch +crypto-hisilicon-re-enable-address-prefetch-after-de.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch +drm-amd-pm-fix-si_upload_smc_data-v3.patch +drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch +drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch +drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch +drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +drm-msm-dpu-fix-incorrect-type-for-ret.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +f2fs-fix-zero-sized-extent-for-precache-extents.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-9322 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27178 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-15359 +crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch +wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch +pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +coresight-etm4x-conditionally-access-register-trcext.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +vhost-vringh-fix-copy_to_iter-return-value-check.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch +bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch +bluetooth-hci_sync-fix-using-random-address-for-big-.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +net-mlx5-stop-polling-for-command-response-if-interf.patch +net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch +net-mlx5-fw-reset-add-reset-timeout-work.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch +vhost-vringh-modify-the-return-value-check.patch diff --git a/queue-6.1/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.1/smb-server-fix-ird-ord-negotiation-with-the-client.patch new file mode 100644 index 0000000000..1ee3674a1b --- /dev/null +++ b/queue-6.1/smb-server-fix-ird-ord-negotiation-with-the-client.patch @@ -0,0 +1,192 @@ +From 7458c72c9de5a09bebb5d58d15d551cfd829f7b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 15:34:58 +0200 +Subject: smb: server: fix IRD/ORD negotiation with the client + +From: Stefan Metzmacher + +[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ] + +Already do real negotiation in smb_direct_handle_connect_request() +where we see the requested initiator_depth and responder_resources +from the client. + +We should detect legacy iwarp clients using MPA v1 +with the custom IRD/ORD negotiation. + +We need to send the custom IRD/ORD in big endian, +but we need to try to let clients with broken requests +using little endian (older cifs.ko) to work. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +Acked-by: Namjae Jeon +Cc: Steve French +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++----- + 1 file changed, 85 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 84b5b2f5df998..af1c41f922bb3 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -152,6 +152,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -345,6 +349,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1618,21 +1625,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2018,10 +2025,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2035,6 +2045,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2059,7 +2130,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.1/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.1/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..7fd4d6ac4f --- /dev/null +++ b/queue-6.1/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From 78bc556bc8362a1001eedf0d3d3a600657c2962b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index 0acd433afa7bc..42e1067fae7ad 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -1005,16 +1005,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-6.1/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.1/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..2d8e70a484 --- /dev/null +++ b/queue-6.1/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From d494ed1eb8fac1f4180e48b5369c74a8b0e3a855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index ff2b9eb9f669f..5797d95705417 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -415,13 +415,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req, err); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0); +-- +2.51.0 + diff --git a/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..e366783a38 --- /dev/null +++ b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 90bc58775df8322460f1d6957234dd0cd906cc06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index a6f4ee3918977..021b94a383d13 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-15359 b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-15359 new file mode 100644 index 0000000000..673673b7b8 --- /dev/null +++ b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-15359 @@ -0,0 +1,112 @@ +From 97de11a25009abcfba354665b586aa0120650167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27178 b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27178 new file mode 100644 index 0000000000..79b864e867 --- /dev/null +++ b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27178 @@ -0,0 +1,111 @@ +From ab90feeeaeb32ec0425adf207086e7ef8621e1ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894..bbd3ea0a64822 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-9322 b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-9322 new file mode 100644 index 0000000000..4a0e77ed63 --- /dev/null +++ b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-9322 @@ -0,0 +1,67 @@ +From b582e995683bc068e62ce89452cb864be120ceba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..e519c5c3ae --- /dev/null +++ b/queue-6.1/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From c87af974907c76b2d136ff55ee6bd9905bd3a590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-6.1/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.1/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..0176a89ba0 --- /dev/null +++ b/queue-6.1/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From baeca32fbd63537ca0256cadc0fbe46551799686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index d94daa296d59d..c195f85149519 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2905,8 +2905,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2925,11 +2925,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-6.1/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.1/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..90c6ee3b37 --- /dev/null +++ b/queue-6.1/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From 4397306b65166cac28a21be0d90f3c4d33c58ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index 1434ab8f6988c..c7deb7c19d7a9 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.1/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..9d1cb612bf --- /dev/null +++ b/queue-6.1/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From 60562038bd095dd31b37cb666e2faa65b225eb8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebb..a6bb01082ec69 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-6.1/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.1/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..d503082d5a --- /dev/null +++ b/queue-6.1/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From d1ef1307d8f2feb914ea6e700411ed50081db6db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index a0ea830e1ba17..f9eccd40c221f 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -46,6 +46,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-6.1/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.1/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..c13b98fde9 --- /dev/null +++ b/queue-6.1/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From 3ef7f5a274c539130a6739576e5a52942b625404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index cdbf12639dfa7..f55dcc3a40184 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1356,6 +1356,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-6.1/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.1/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..73034b471b --- /dev/null +++ b/queue-6.1/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From 6b5dc97a10990e3ac718e608d9a39fb88dafd096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 8aaafba058aa9..f170741206e1d 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-6.1/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.1/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..d4cbc4c766 --- /dev/null +++ b/queue-6.1/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From f1d6125fe8f961d5537aebd599a587f430cc3dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index ab3c38a7d8ac0..a73604af8960e 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-6.1/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.1/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..e0918b9977 --- /dev/null +++ b/queue-6.1/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From 54b53143f57fd741030c7971858d977c9a5a79a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 6b98f5ab6dfed..e3c8483d7ba40 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-6.1/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.1/vhost-vringh-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..1522019f4a --- /dev/null +++ b/queue-6.1/vhost-vringh-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,53 @@ +From 99cced339fea5b937f5ae4f2505c48ec0acd85ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:04:08 -0400 +Subject: vhost: vringh: Fix copy_to_iter return value check + +From: Michael S. Tsirkin + +[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ] + +The return value of copy_to_iter can't be negative, check whether the +copied length is equal to the requested length instead of checking for +negative values. + +Cc: zhang jiao +Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Simon Horman +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 10bfc5f1c50d5..c570d214d5b68 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1195,6 +1195,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1206,9 +1207,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + + iov_iter_bvec(&iter, ITER_DEST, iov, ret, translated); + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.1/vhost-vringh-modify-the-return-value-check.patch b/queue-6.1/vhost-vringh-modify-the-return-value-check.patch new file mode 100644 index 0000000000..d6fb50a652 --- /dev/null +++ b/queue-6.1/vhost-vringh-modify-the-return-value-check.patch @@ -0,0 +1,50 @@ +From bfb1f14407685d1d8e159fa0de3e4abada0bd571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:17:38 +0800 +Subject: vhost: vringh: Modify the return value check + +From: zhang jiao + +[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ] + +The return value of copy_from_iter and copy_to_iter can't be negative, +check whether the copied lengths are equal. + +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Cc: "Stefano Garzarella" +Signed-off-by: zhang jiao +Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index c570d214d5b68..d89c2bce94cbf 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1162,6 +1162,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1173,9 +1174,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + + iov_iter_bvec(&iter, ITER_SOURCE, iov, ret, translated); + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.1/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.1/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..f3fd373831 --- /dev/null +++ b/queue-6.1/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 1a2e69f274e1874e385182e02a16a6a1ec2772a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 1c569be72ea29..15644ae2387fd 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.1/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..7734abdddd --- /dev/null +++ b/queue-6.1/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From 65ad424b25495d98290bbcfb2fbe7a477a5178cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index b126ffba480f1..2fda5ca3e6ee9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-6.1/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.1/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch new file mode 100644 index 0000000000..abdc24b93a --- /dev/null +++ b/queue-6.1/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch @@ -0,0 +1,87 @@ +From 0f891bf8fe4eff07cd0a28a4756318298c38ab66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 12:42:03 +0530 +Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not + available + +From: Aditya Kumar Singh + +[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ] + +In ieee80211_rx_handle_packet(), if the caller does not provide pubsta +information, an attempt is made to find the station using the address 2 +(source address) field in the header. Since pubsta is missing, link +information such as link_valid and link_id is also unavailable. Now if such +a situation comes, and if a matching ML station entry is found based on +the source address, currently the packet is dropped due to missing link ID +in the status field which is not correct. + +Hence, to fix this issue, if link_valid is not set and the station is an +ML station, make an attempt to find a link station entry using the source +address. If a valid link station is found, derive the link ID and proceed +with packet processing. Otherwise, drop the packet as per the existing +flow. + +Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") +Suggested-by: Vasanthakumar Thiagarajan +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 8c9267acb227b..776f9fcf05abe 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5106,12 +5106,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5119,10 +5127,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +-- +2.51.0 + diff --git a/queue-6.1/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.1/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..8fae25f068 --- /dev/null +++ b/queue-6.1/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From b39ff11fbcce205631fc26547d0c5712514bf314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ba927033bbe8c..1206769cdc7fd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.1/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.1/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..4ed2d58449 --- /dev/null +++ b/queue-6.1/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From ceb5e4a5e4f387ab704e42f73fd1aaf37cf013e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 5e25060647b2d..3b9b75eb4cdb8 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-6.1/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.1/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch new file mode 100644 index 0000000000..66b09ce3f1 --- /dev/null +++ b/queue-6.1/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch @@ -0,0 +1,149 @@ +From 5bbcf36b03e1da1b8b1b51d2773efec5f180b049 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:50 +0300 +Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run() + +From: Fedor Pchelkin + +[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ] + +Lockdep gives a splat [1] when ser_hdl_work item is executed. It is +scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a +wiphy lock inside. However, this workqueue can be flushed when e.g. +closing the interface and wiphy lock is already taken in that case. + +Choosing wiphy_work_queue() for SER is likely not suitable. Back on to +the global workqueue. + +[1]: + + WARNING: possible circular locking dependency detected + 6.17.0-rc2 #17 Not tainted + ------------------------------------------------------ + kworker/u32:1/61 is trying to acquire lock: + ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] + + but task is already holding lock: + ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: + process_one_work+0x7c6/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + -> #1 ((wq_completion)phy0){+.+.}-{0:0}: + touch_wq_lockdep_map+0x8e/0x180 + __flush_workqueue+0x129/0x10d0 + ieee80211_stop_device+0xa8/0x110 + ieee80211_do_stop+0x14ce/0x2880 + ieee80211_stop+0x13a/0x2c0 + __dev_close_many+0x18f/0x510 + __dev_change_flags+0x25f/0x670 + netif_change_flags+0x7b/0x160 + do_setlink.isra.0+0x1640/0x35d0 + rtnl_newlink+0xd8c/0x1d30 + rtnetlink_rcv_msg+0x700/0xb80 + netlink_rcv_skb+0x11d/0x350 + netlink_unicast+0x49a/0x7a0 + netlink_sendmsg+0x759/0xc20 + ____sys_sendmsg+0x812/0xa00 + ___sys_sendmsg+0xf7/0x180 + __sys_sendmsg+0x11f/0x1b0 + do_syscall_64+0xbb/0x360 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + other info that might help us debug this: + + Chain exists of: + &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&ser->ser_hdl_work)); + lock((wq_completion)phy0); + lock((work_completion)(&ser->ser_hdl_work)); + lock(&rdev->wiphy.mtx); + + *** DEADLOCK *** + + 2 locks held by kworker/u32:1/61: + #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 + #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + stack backtrace: + CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 + Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] + Call Trace: + + dump_stack_lvl+0x5d/0x80 + print_circular_bug.cold+0x178/0x1be + check_noncircular+0x14c/0x170 + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index f5dacdc4d11ab..24a9025e5bea8 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -204,7 +204,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -220,7 +219,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.1/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..b7f668a6bb --- /dev/null +++ b/queue-6.1/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 8361bd2492f4e50fc523469d114a516268ad6a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 2e7890dd58a47..7865f180eb087 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -243,7 +243,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -253,10 +253,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-6.12/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.12/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..a093c290f9 --- /dev/null +++ b/queue-6.12/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 5792df105c5eb0241ed7c2fa98a849c5964c3391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index ae035b93da087..3eb56b77cb6d9 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.12/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..7f93d12dff --- /dev/null +++ b/queue-6.12/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From 39d2449c66161c5f1a726324f720d817c3593802 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 0888e4d618d53..b524cf27213d4 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-6.12/acpica-fix-largest-possible-resource-descriptor-inde.patch b/queue-6.12/acpica-fix-largest-possible-resource-descriptor-inde.patch new file mode 100644 index 0000000000..f3c81b5e0a --- /dev/null +++ b/queue-6.12/acpica-fix-largest-possible-resource-descriptor-inde.patch @@ -0,0 +1,42 @@ +From 2099147103d90c446c2cfc554bdc32b682b4698e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 22:03:16 +0200 +Subject: ACPICA: Fix largest possible resource descriptor index + +From: Dmitry Antipov + +[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ] + +ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually +used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). + +Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be +clamped incorrectly and resulting value may issue an out-of-bounds +access for 'acpi_gbl_resource_types' array. Compile tested only. + +Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") +Link: https://github.com/acpica/acpica/commit/cf00116c +Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 +Signed-off-by: Dmitry Antipov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/aclocal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 6f4fe47c955bd..35460c2072a4a 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -1141,7 +1141,7 @@ struct acpi_port_info { + #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 + #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 + #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 +-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 ++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 + + /***************************************************************************** + * +-- +2.51.0 + diff --git a/queue-6.12/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.12/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..76f43a4089 --- /dev/null +++ b/queue-6.12/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From f243439bce8cee0e28d0aae23f3d6cd5707d49d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index 9d95ecb299aed..a99acd1125e74 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-6.12/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch b/queue-6.12/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch new file mode 100644 index 0000000000..644c4234df --- /dev/null +++ b/queue-6.12/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch @@ -0,0 +1,80 @@ +From c2c8484f8b3d91f39813cdef10a4e02ccb0946f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 17:28:51 +0200 +Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on + PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ] + +snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts +via spin_lock_irq(). This also implicitly disables the handling of +softirqs such as TIMER_SOFTIRQ. +On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not +disable them. That means a timer can be invoked during spin_lock_irq() +on the same CPU. Due to synchronisations reasons local_bh_disable() has +a per-CPU lock named softirq_ctrl.lock which synchronizes individual +softirq against each other. +syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is +acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This +is a possible deadlock. + +The softirq_ctrl.lock can not be made part of spin_lock_irq() as this +would lead to too much synchronisation against individual threads on the +system. To avoid the possible deadlock, softirqs must be manually +disabled before the lock is acquired. + +Disable softirqs before the lock is acquired on PREEMPT_RT. + +Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com +Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_native.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 9b91f68b3fff0..d15de21f6ebf0 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group) + } + + /* define group lock helpers */ +-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \ ++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \ + static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \ + { \ +- if (nonatomic) \ ++ if (nonatomic) { \ + mutex_ ## mutex_action(&group->mutex); \ +- else \ +- spin_ ## action(&group->lock); \ +-} +- +-DEFINE_PCM_GROUP_LOCK(lock, lock); +-DEFINE_PCM_GROUP_LOCK(unlock, unlock); +-DEFINE_PCM_GROUP_LOCK(lock_irq, lock); +-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock); ++ } else { \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \ ++ local_bh_disable(); \ ++ spin_ ## action(&group->lock); \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \ ++ local_bh_enable(); \ ++ } \ ++} ++ ++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock); ++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock); + + /** + * snd_pcm_stream_lock - Lock the PCM stream +-- +2.51.0 + diff --git a/queue-6.12/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.12/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..0c494ac89f --- /dev/null +++ b/queue-6.12/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 82e1fdd4060e19deda8fc29ac223cd0978edddb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e5869cca5e791..94dece1839af3 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -872,7 +872,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCK1..4 settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -916,7 +916,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-6.12/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch b/queue-6.12/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch new file mode 100644 index 0000000000..1a394f8f84 --- /dev/null +++ b/queue-6.12/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch @@ -0,0 +1,43 @@ +From 7429527966d01a62333970dbcc9f82e92f015427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 23:59:57 +0200 +Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer + property + +From: Jihed Chaibi + +[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ] + +The dtbs_check validation for am335x-cm-t335.dtb flags an error +for an unevaluated 'num-serializer' property in the mcasp0 node. + +This property is obsolete; it is not defined in the davinci-mcasp-audio +schema and is not used by the corresponding (or any) driver. + +Remove this unused property to fix the schema validation warning. + +Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +index 06767ea164b59..ece7f7854f6aa 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +@@ -483,8 +483,6 @@ &mcasp1 { + + op-mode = <0>; /* MCASP_IIS_MODE */ + tdm-slots = <2>; +- /* 16 serializers */ +- num-serializer = <16>; + serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ + 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 + >; +-- +2.51.0 + diff --git a/queue-6.12/arm-dts-renesas-porter-fix-can-pin-group.patch b/queue-6.12/arm-dts-renesas-porter-fix-can-pin-group.patch new file mode 100644 index 0000000000..d7f4376664 --- /dev/null +++ b/queue-6.12/arm-dts-renesas-porter-fix-can-pin-group.patch @@ -0,0 +1,36 @@ +From 593d2fec6f71dd6144963a9cd1a4042172d53c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 15:49:48 +0200 +Subject: ARM: dts: renesas: porter: Fix CAN pin group + +From: Geert Uytterhoeven + +[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ] + +According to the schematics, the CAN transceiver is connected to pins +GP7_3 and GP7_4, which correspond to CAN0 data group B. + +Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index 93c86e9216455..b255eb228dd74 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -290,7 +290,7 @@ vin0_pins: vin0 { + }; + + can0_pins: can0 { +- groups = "can0_data"; ++ groups = "can0_data_b"; + function = "can0"; + }; + +-- +2.51.0 + diff --git a/queue-6.12/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch b/queue-6.12/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch new file mode 100644 index 0000000000..2cdb4fbbb5 --- /dev/null +++ b/queue-6.12/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch @@ -0,0 +1,42 @@ +From c3d9fa4cff3a1002201c0c36354762f7113c90f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:25:30 +0200 +Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in + DTS to use correct boolean syntax + +From: Jihed Chaibi + +[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ] + +The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree +schema, was incorrectly assigned a value (<1>) in the DTS file, causing +a validation error: "size (4) error for type flag". The driver uses +of_property_read_bool(), expecting a boolean. Remove the value to fix +the dtbs_check error. + +Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/ +Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +index a4beb718559c4..9ee9e7a1343c4 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +@@ -270,7 +270,7 @@ &tps { + vcc7-supply = <&vbat>; + vccio-supply = <&vbat>; + +- ti,en-ck32k-xtal = <1>; ++ ti,en-ck32k-xtal; + + regulators { + vrtc_reg: regulator@0 { +-- +2.51.0 + diff --git a/queue-6.12/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch b/queue-6.12/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch new file mode 100644 index 0000000000..740ec70e13 --- /dev/null +++ b/queue-6.12/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch @@ -0,0 +1,41 @@ +From 645f2ecd1e1493c92478ec1a89f92bd706cdd4e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:50:52 +0200 +Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on + property to use correct boolean syntax in DTS + +From: Jihed Chaibi + +[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ] + +The ti,keep-vref-on property, defined as a boolean flag in the Device +Tree schema, was incorrectly assigned a value (<1>) in the DTS file, +causing a validation error: "size (4) error for type flag". Remove +the value to match the schema and ensure compatibility with the driver +using device_property_read_bool(). This fixes the dtbs_check error. + +Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +index a7f99ae0c1fe9..78c657429f641 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +@@ -65,7 +65,7 @@ ads7846@0 { + ti,debounce-max = /bits/ 16 <10>; + ti,debounce-tol = /bits/ 16 <5>; + ti,debounce-rep = /bits/ 16 <1>; +- ti,keep-vref-on = <1>; ++ ti,keep-vref-on; + ti,settle-delay-usec = /bits/ 16 <150>; + + wakeup-source; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch b/queue-6.12/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch new file mode 100644 index 0000000000..7ef0b2e7df --- /dev/null +++ b/queue-6.12/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch @@ -0,0 +1,65 @@ +From b115cdc017ccba7727dc764543c6229a86beedb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:44 +0200 +Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map + +From: Janne Grunau + +[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ] + +PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused +and disabled. Linux' PCI subsystem assigns the ethernet nic from +`port02` to bus 02. This results into assigning `pcie0_dart_1` from the +disabled port as iommu. The `pcie0_dart_1` instance is disabled and +probably fused off (it is on the M2 Pro Mac mini which has a disabled +PCIe port as well). +Without iommu the ethernet nic is not expected work. +Adjusts the "bus-range" and the PCIe devices "reg" property to PCI +subsystem's bus number. + +Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 152f95fd49a21..7089ccf3ce556 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -21,6 +21,14 @@ aliases { + }; + }; + ++/* ++ * Adjust pcie0's iommu-map to account for the disabled port01. ++ */ ++&pcie0 { ++ iommu-map = <0x100 &pcie0_dart_0 1 1>, ++ <0x200 &pcie0_dart_2 1 1>; ++}; ++ + &bluetooth0 { + brcm,board-type = "apple,santorini"; + }; +@@ -36,10 +44,10 @@ &wifi0 { + */ + + &port02 { +- bus-range = <3 3>; ++ bus-range = <2 2>; + status = "okay"; + ethernet0: ethernet@0,0 { +- reg = <0x30000 0x0 0x0 0x0 0x0>; ++ reg = <0x20000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch b/queue-6.12/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch new file mode 100644 index 0000000000..019240c2a6 --- /dev/null +++ b/queue-6.12/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch @@ -0,0 +1,50 @@ +From 49c15ffc3b498378b5f3f89e274fbea82d8e7fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:45 +0200 +Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator + +From: Annette Kobou + +[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ] + +The regulator uses the wrong GPIO. Fix this. + +Signed-off-by: Annette Kobou +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 89e97c604bd3e..9a9e5d0daf3ba 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -33,7 +33,9 @@ pwm-beeper { + + reg_vcc_panel: regulator-vcc-panel { + compatible = "regulator-fixed"; +- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_reg_vcc_panel>; ++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <3300000>; +@@ -161,3 +163,11 @@ &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; + }; ++ ++&iomuxc { ++ pinctrl_reg_vcc_panel: regvccpanelgrp { ++ fsl,pins = < ++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */ ++ >; ++ }; ++}; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch b/queue-6.12/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch new file mode 100644 index 0000000000..2d9ba6ed2e --- /dev/null +++ b/queue-6.12/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch @@ -0,0 +1,62 @@ +From 28ba4eef28ec2db0d9bc44182cb6ec3da4a5be98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:46 +0200 +Subject: arm64: dts: imx93-kontron: Fix USB port assignment + +From: Frieder Schrempf + +[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ] + +The assignment of the USB ports is wrong and needs to be swapped. +The OTG (USB-C) port is on the first port and the host port with +the onboard hub is on the second port. + +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 9a9e5d0daf3ba..c3d2ddd887fdf 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -137,6 +137,16 @@ &tpm6 { + }; + + &usbotg1 { ++ adp-disable; ++ hnp-disable; ++ srp-disable; ++ disable-over-current; ++ dr_mode = "otg"; ++ usb-role-switch; ++ status = "okay"; ++}; ++ ++&usbotg2 { + #address-cells = <1>; + #size-cells = <0>; + disable-over-current; +@@ -149,16 +159,6 @@ usb1@1 { + }; + }; + +-&usbotg2 { +- adp-disable; +- hnp-disable; +- srp-disable; +- disable-over-current; +- dr_mode = "otg"; +- usb-role-switch; +- status = "okay"; +-}; +- + &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch b/queue-6.12/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch new file mode 100644 index 0000000000..b82217e11d --- /dev/null +++ b/queue-6.12/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch @@ -0,0 +1,47 @@ +From dbfda702e1bd4302c44ebd9ed331822431b4e61b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 09:25:31 +0800 +Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid + +From: Joy Zou + +[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ] + +According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87, +and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them. + +Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes") +Signed-off-by: Joy Zou +Signed-off-by: Peng Fan +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi +index 7365d6538a733..ddbc94c375e0c 100644 +--- a/arch/arm64/boot/dts/freescale/imx95.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi +@@ -822,7 +822,7 @@ lpuart7: serial@42690000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART7>; + clock-names = "ipg"; +- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>; ++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +@@ -834,7 +834,7 @@ lpuart8: serial@426a0000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART8>; + clock-names = "ipg"; +- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>; ++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch b/queue-6.12/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch new file mode 100644 index 0000000000..94d1b52f58 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch @@ -0,0 +1,68 @@ +From 9038e627203b768ca44beca607f695974e5fb0da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:52 +0200 +Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node + names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ] + +The node names for "pmic", "regulators", "rtc", and "keys" are +dictated by the PMIC MFD binding: change those to adhere to it. + +Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +index d89858c73ab1b..243afbffa21fd 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +@@ -6,12 +6,12 @@ + #include + + &pwrap { +- pmic: mt6331 { ++ pmic: pmic { + compatible = "mediatek,mt6331"; + interrupt-controller; + #interrupt-cells = <2>; + +- mt6331regulator: mt6331regulator { ++ mt6331regulator: regulators { + compatible = "mediatek,mt6331-regulator"; + + mt6331_vdvfs11_reg: buck-vdvfs11 { +@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { + }; + + mt6331_vdig18_reg: ldo-vdig18 { +- regulator-name = "dvdd18_dig"; ++ regulator-name = "vdig18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-ramp-delay = <0>; +@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { + }; + }; + +- mt6331rtc: mt6331rtc { ++ mt6331rtc: rtc { + compatible = "mediatek,mt6331-rtc"; + }; + +- mt6331keys: mt6331keys { ++ mt6331keys: keys { + compatible = "mediatek,mt6331-keys"; + power { + linux,keycodes = ; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch b/queue-6.12/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch new file mode 100644 index 0000000000..9f835ae992 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch @@ -0,0 +1,40 @@ +From 00a8dc79991976b36dc331aa5a3149776aa98745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:56 +0200 +Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value + +From: AngeloGioacchino Del Regno + +[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ] + +Change the latch-ck value from 0x14 to 4: as only bits [0-3] are +actually used, the final value that gets written to the register +field for DAT_LATCH_CK_SEL is just 0x4. + +This also fixes dtbs_check warnings. + +Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +index 91de920c22457..03cc48321a3f4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts ++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +@@ -212,7 +212,7 @@ proximity@48 { + + &mmc0 { + /* eMMC controller */ +- mediatek,latch-ck = <0x14>; /* hs400 */ ++ mediatek,latch-ck = <4>; /* hs400 */ + mediatek,hs200-cmd-int-delay = <1>; + mediatek,hs400-cmd-int-delay = <1>; + mediatek,hs400-ds-dly3 = <0x1a>; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch b/queue-6.12/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch new file mode 100644 index 0000000000..14377c2c29 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch @@ -0,0 +1,70 @@ +From 822478c582d0c72b907aa9f6e19d9d7cfd20a64e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 17:01:34 +0800 +Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model + +From: Chen-Yu Tsai + +[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ] + +The touchscreen controller used with the original Krabby design is the +Elan eKTH6918, which is in the same family as eKTH6915, but supporting +a larger screen size with more sense lines. + +OTOH, the touchscreen controller that actually shipped on the Tentacruel +devices is the Elan eKTH6A12NAY. A compatible string was added for it +specifically because it has different power sequencing timings. + +Fix up the touchscreen nodes for both these. This also includes adding +a previously missing reset line. Also add "no-reset-on-power-off" since +the power is always on, and putting it in reset would consume more +power. + +Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++---- + .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +index 7c971198fa956..72a2a2bff0a93 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +@@ -71,14 +71,14 @@ &i2c1 { + i2c-scl-internal-delay-ns = <10000>; + + touchscreen: touchscreen@10 { +- compatible = "hid-over-i2c"; ++ compatible = "elan,ekth6915"; + reg = <0x10>; + interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&touchscreen_pins>; +- post-power-on-delay-ms = <10>; +- hid-descr-addr = <0x0001>; +- vdd-supply = <&pp3300_s3>; ++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>; ++ vcc33-supply = <&pp3300_s3>; ++ no-reset-on-power-off; + }; + }; + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +index 26d3451a5e47c..24d9ede63eaa2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP) + CROS_STD_MAIN_KEYMAP + >; + }; ++ ++&touchscreen { ++ compatible = "elan,ekth6a12nay"; ++}; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch new file mode 100644 index 0000000000..58aa66c7b7 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch @@ -0,0 +1,50 @@ +From 4f93864114d381c26437105092e060b33b8e32a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 17:59:59 +0800 +Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from + pcie0 + +From: Guoqing Jiang + +[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ] + +When test suspend resume with 6.8 based kernel, system can't resume +and I got below error which can be also reproduced with 6.16 rc6+ +kernel. + +mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) +mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110 +mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110 + +After investigation, looks pcie0 has the same problem as pcie1 as +decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195: +Remove suspend-breaking reset from pcie1"). + +Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") +Signed-off-by: Guoqing Jiang +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Macpaul Lin +Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 2e138b54f5563..451aa278bef50 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 { + + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc0 0>, +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch b/queue-6.12/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch new file mode 100644 index 0000000000..9d1976891a --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch @@ -0,0 +1,105 @@ +From 162714cbad0c05ecd372ec4dbb10514cdbb018a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:13 +0200 +Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator + nodes + +From: AngeloGioacchino Del Regno + +[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ] + +All of the MT6360 regulator nodes were wrong and would not probe +because the regulator names are supposed to be lower case, but +they are upper case in this devicetree. + +Change all nodes to be lower case to get working regulators. + +Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +index e2e75b8ff9188..9ab4fee769e40 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +@@ -351,7 +351,7 @@ regulator { + LDO_VIN2-supply = <&vsys>; + LDO_VIN3-supply = <&vsys>; + +- mt6360_buck1: BUCK1 { ++ mt6360_buck1: buck1 { + regulator-name = "emi_vdd2"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <1800000>; +@@ -361,7 +361,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_buck2: BUCK2 { ++ mt6360_buck2: buck2 { + regulator-name = "emi_vddq"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1300000>; +@@ -371,7 +371,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_ldo1: LDO1 { ++ mt6360_ldo1: ldo1 { + regulator-name = "mt6360_ldo1"; /* Test point */ + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -379,7 +379,7 @@ mt6360_ldo1: LDO1 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo2: LDO2 { ++ mt6360_ldo2: ldo2 { + regulator-name = "panel1_p1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -387,7 +387,7 @@ mt6360_ldo2: LDO2 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo3: LDO3 { ++ mt6360_ldo3: ldo3 { + regulator-name = "vmc_pmu"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -395,7 +395,7 @@ mt6360_ldo3: LDO3 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo5: LDO5 { ++ mt6360_ldo5: ldo5 { + regulator-name = "vmch_pmu"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -403,7 +403,7 @@ mt6360_ldo5: LDO5 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo6: LDO6 { ++ mt6360_ldo6: ldo6 { + regulator-name = "mt6360_ldo6"; /* Test point */ + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <2100000>; +@@ -411,7 +411,7 @@ mt6360_ldo6: LDO6 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo7: LDO7 { ++ mt6360_ldo7: ldo7 { + regulator-name = "emi_vmddr_en"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.12/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..eafefe3674 --- /dev/null +++ b/queue-6.12/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From c3b6de7df508698e4e49b922a8b8b0bf3586c63c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.12/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch new file mode 100644 index 0000000000..b578575a54 --- /dev/null +++ b/queue-6.12/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch @@ -0,0 +1,43 @@ +From 7bfd792066fc92177c505e01f3d1c944f4c03392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 13:19:53 +0100 +Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 + +From: Biju Das + +[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ] + +On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we +are deleting a wrong and nonexistent node. Fixing the wrong node would +invoke a dtb warning message, as channel0 is a required property. +Disable CAN-FD channel0 instead of deleting the node. + +Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 377849cbb462e..5785a934c28bf 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -48,7 +48,10 @@ sound_card { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.12/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..d17a04b3bb --- /dev/null +++ b/queue-6.12/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 5427f21eb2c93740417dcf89b3ac63912c87d79a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index d3327bc237b5f..7975dc0ceb351 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -47,7 +47,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.12/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..eec037cfca --- /dev/null +++ b/queue-6.12/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From 5df25d100ea222954e2031c44fdb057f1cc98026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index b6434b4731261..d6991864c5a49 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.12/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..c4f0d8e406 --- /dev/null +++ b/queue-6.12/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From fdf08725c99cc96189e3dc5e355dea60b861f4bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 8e4b821efe927..6860ac41e6b32 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch b/queue-6.12/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch new file mode 100644 index 0000000000..e2d5a1ce2c --- /dev/null +++ b/queue-6.12/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch @@ -0,0 +1,41 @@ +From 8963c0cdb5a4b3d3358c0cda0f0bba26d682876f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:02:35 +0100 +Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback + +From: Richard Fitzgerald + +[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ] + +In create_sdw_dailink() check that sof_end->codec_info->add_sidecar +is not NULL before calling it. + +The original code assumed that if include_sidecar is true, the codec +on that link has an add_sidecar callback. But there could be other +codecs on the same link that do not have an add_sidecar callback. + +Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices") +Signed-off-by: Richard Fitzgerald +Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 5911a05586516..00d840d5e585c 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -741,7 +741,7 @@ static int create_sdw_dailink(struct snd_soc_card *card, + (*codec_conf)++; + } + +- if (sof_end->include_sidecar) { ++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) { + ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.12/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.12/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..06b47aba93 --- /dev/null +++ b/queue-6.12/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From e5d2de30fc7d3a8962570a250de9f81418166d45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 156e9bb07abf1..2fb234ab467b1 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-6.12/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.12/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..fe21c182d7 --- /dev/null +++ b/queue-6.12/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From dd72522a0d5376f6d141c19947eaa6fb68f4eb01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index f24fffdb6c294..d72a283401c3a 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -552,7 +552,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->features |= (b->features & BLK_FEAT_INHERIT_MASK); + +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.12/bluetooth-hci_sync-fix-using-random-address-for-big-.patch new file mode 100644 index 0000000000..d9e9607643 --- /dev/null +++ b/queue-6.12/bluetooth-hci_sync-fix-using-random-address-for-big-.patch @@ -0,0 +1,57 @@ +From d236699e9317a0b66821f392d919fccb7d9647bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 12:30:05 -0400 +Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA + advertisements + +From: Luiz Augusto von Dentz + +[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ] + +When creating an advertisement for BIG the address shall not be +non-resolvable since in case of acting as BASS/Broadcast Assistant the +address must be the same as the connection in order to use the PAST +method and even when PAST/BASS are not in the picture a Periodic +Advertisement can still be synchronized thus the same argument as to +connectable advertisements still stand. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Luiz Augusto von Dentz +Reviewed-by: Paul Menzel +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 333f32a9fd219..853acfa8e9433 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.12/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch new file mode 100644 index 0000000000..c09c6e7c82 --- /dev/null +++ b/queue-6.12/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch @@ -0,0 +1,38 @@ +From 13ec3f161dee03ad31522b4599d77fd7a2d449cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:22 +0300 +Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX + +From: Pauli Virtanen + +[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ] + +For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the +skb is leaked. + +Free skb after copying its data. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index e38f52638627d..2cd0b963c96bd 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -2304,7 +2304,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.12/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch new file mode 100644 index 0000000000..4d6a947482 --- /dev/null +++ b/queue-6.12/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch @@ -0,0 +1,40 @@ +From ddfe072e7e2cb2ef7545bcac80122900ff13edc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:27:51 -0400 +Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free + +From: Luiz Augusto von Dentz + +[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] + +This attempt to fix similar issue to sco_conn_free where if the +conn->sk is not set to NULL may lead to UAF on iso_conn_free. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index a08a0f3d5003c..df21c79800fb6 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -743,6 +743,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-iso-free-rx_skb-if-not-consumed.patch b/queue-6.12/bluetooth-iso-free-rx_skb-if-not-consumed.patch new file mode 100644 index 0000000000..e1158163b7 --- /dev/null +++ b/queue-6.12/bluetooth-iso-free-rx_skb-if-not-consumed.patch @@ -0,0 +1,35 @@ +From 454fef95bff14970c57d9607aece8ba130634eaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:21 +0300 +Subject: Bluetooth: ISO: free rx_skb if not consumed + +From: Pauli Virtanen + +[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ] + +If iso_conn is freed when RX is incomplete, free any leftover skb piece. + +Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index df21c79800fb6..e38f52638627d 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref) + /* Ensure no more work items will run since hci_conn has been dropped */ + disable_delayed_work_sync(&conn->timeout_work); + ++ kfree_skb(conn->rx_skb); ++ + kfree(conn); + } + +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.12/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..6f0187c35c --- /dev/null +++ b/queue-6.12/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From 6a24b0ad227310bc30fb489258f9b4ff779776ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 8b75647076bae..563cae4f76b0d 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4412,13 +4412,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +-- +2.51.0 + diff --git a/queue-6.12/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch b/queue-6.12/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch new file mode 100644 index 0000000000..704cae4ad1 --- /dev/null +++ b/queue-6.12/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch @@ -0,0 +1,41 @@ +From ed607f5a1f610df58100d10be60b15fd65b3c75d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 23:26:53 +0000 +Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() + +From: Hengqi Chen + +[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ] + +The current implementation seems incorrect and does NOT match the +comment above, use bpf_jit_binary_pack_finalize() instead. + +Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") +Acked-by: Puranjay Mohan +Signed-off-by: Hengqi Chen +Acked-by: Song Liu +Acked-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 5553508c36440..ca6d002a6f137 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -2754,8 +2754,7 @@ void bpf_jit_free(struct bpf_prog *prog) + * before freeing it. + */ + if (jit_data) { +- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size, +- sizeof(jit_data->header->size)); ++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kfree(jit_data); + } + hdr = bpf_jit_binary_pack_hdr(prog); +-- +2.51.0 + diff --git a/queue-6.12/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.12/bpf-enforce-expected_attach_type-for-tailcall-compat.patch new file mode 100644 index 0000000000..c66a9eb8c8 --- /dev/null +++ b/queue-6.12/bpf-enforce-expected_attach_type-for-tailcall-compat.patch @@ -0,0 +1,93 @@ +From 8445a155baa1d7f8f98303c3e9e099b54a890b72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 19:12:00 +0200 +Subject: bpf: Enforce expected_attach_type for tailcall compatibility + +From: Daniel Borkmann + +[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ] + +Yinhao et al. recently reported: + + Our fuzzer tool discovered an uninitialized pointer issue in the + bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. + This leads to a NULL pointer dereference when a BPF program attempts to + deference the txq member of struct xdp_buff object. + +The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the +entry point for bpf_prog_test_run_xdp() and its expected_attach_type can +neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot +of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP +to pass xdp_is_valid_access() validation. The program returns struct xdp_md's +egress_ifindex, and the latter is only allowed to be accessed under mentioned +expected_attach_type. progB is then inserted into the tailcall which progA +calls. + +The underlying issue goes beyond XDP though. Another example are programs +of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well +as sock_addr_func_proto() have different logic depending on the programs' +expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME +should not be allowed doing a tailcall into a program which calls bpf_bind() +out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. + +In short, specifying expected_attach_type allows to open up additional +functionality or restrictions beyond what the basic bpf_prog_type enables. +The use of tailcalls must not violate these constraints. Fix it by enforcing +expected_attach_type in __bpf_prog_map_compatible(). + +Note that we only enforce this for tailcall maps, but not for BPF devmaps or +cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and +cpu_map_bpf_prog_run*() which set up a new environment / context and therefore +these situations are not prone to this issue. + +Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") +Reported-by: Yinhao Hu +Reported-by: Kaiyan Mei +Reviewed-by: Dongliang Mu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 + + kernel/bpf/core.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 6db72c66de91d..e8d9803cc6756 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -281,6 +281,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 1f51c8f20722e..08bdb623f4f91 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2326,6 +2326,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2337,6 +2338,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +-- +2.51.0 + diff --git a/queue-6.12/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.12/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..10c11685c7 --- /dev/null +++ b/queue-6.12/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 2a6b8ababb36d1f0f46d485e4efcc4ba41904832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 02fedc404d7f7..c850e5d6cbd87 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9233,13 +9233,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-6.12/bpf-mark-kfuncs-as-__noclone.patch b/queue-6.12/bpf-mark-kfuncs-as-__noclone.patch new file mode 100644 index 0000000000..3794ea0006 --- /dev/null +++ b/queue-6.12/bpf-mark-kfuncs-as-__noclone.patch @@ -0,0 +1,56 @@ +From 36f78742c56469f5b5d3562e6c94e7d432553723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 10:14:26 +0200 +Subject: bpf: Mark kfuncs as __noclone + +From: Andrea Righi + +[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ] + +Some distributions (e.g., CachyOS) support building the kernel with -O3, +but doing so may break kfuncs, resulting in their symbols not being +properly exported. + +In fact, with gcc -O3, some kfuncs may be optimized away despite being +annotated as noinline. This happens because gcc can still clone the +function during IPA optimizations, e.g., by duplicating or inlining it +into callers, and then dropping the standalone symbol. This breaks BTF +ID resolution since resolve_btfids relies on the presence of a global +symbol for each kfunc. + +Currently, this is not an issue for upstream, because we don't allow +building the kernel with -O3, but it may be safer to address it anyway, +to prevent potential issues in the future if compilers become more +aggressive with optimizations. + +Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never +cloned and remain distinct, globally visible symbols, regardless of +the optimization level. + +Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs") +Acked-by: David Vernet +Acked-by: Yonghong Song +Signed-off-by: Andrea Righi +Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/btf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/btf.h b/include/linux/btf.h +index d99178ce01d21..e473bbfe41286 100644 +--- a/include/linux/btf.h ++++ b/include/linux/btf.h +@@ -82,7 +82,7 @@ + * as to avoid issues such as the compiler inlining or eliding either a static + * kfunc, or a global kfunc in an LTO build. + */ +-#define __bpf_kfunc __used __retain noinline ++#define __bpf_kfunc __used __retain __noclone noinline + + #define __bpf_kfunc_start_defs() \ + __diag_push(); \ +-- +2.51.0 + diff --git a/queue-6.12/bpf-reject-negative-offsets-for-alu-ops.patch b/queue-6.12/bpf-reject-negative-offsets-for-alu-ops.patch new file mode 100644 index 0000000000..dcc3b718d2 --- /dev/null +++ b/queue-6.12/bpf-reject-negative-offsets-for-alu-ops.patch @@ -0,0 +1,61 @@ +From 8de7121feb0ee7d01dc205b3924a5b19dfb6710f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 23:04:33 +0800 +Subject: bpf: Reject negative offsets for ALU ops + +From: Yazhou Tang + +[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] + +When verifying BPF programs, the check_alu_op() function validates +instructions with ALU operations. The 'offset' field in these +instructions is a signed 16-bit integer. + +The existing check 'insn->off > 1' was intended to ensure the offset is +either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is +signed, this check incorrectly accepts all negative values (e.g., -1). + +This commit tightens the validation by changing the condition to +'(insn->off != 0 && insn->off != 1)'. This ensures that any value +other than the explicitly permitted 0 and 1 is rejected, hardening the +verifier against malformed BPF programs. + +Co-developed-by: Shenghao Yuan +Signed-off-by: Shenghao Yuan +Co-developed-by: Tianci Cao +Signed-off-by: Tianci Cao +Signed-off-by: Yazhou Tang +Acked-by: Yonghong Song +Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") +Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 1829f62a74a9e..96640a80fd9c4 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -14545,7 +14545,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } else { /* all other ALU ops: and, sub, xor, add, ... */ + + if (BPF_SRC(insn->code) == BPF_X) { +- if (insn->imm != 0 || insn->off > 1 || ++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +@@ -14555,7 +14555,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + if (err) + return err; + } else { +- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || ++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.12/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch new file mode 100644 index 0000000000..64fe9e7a6e --- /dev/null +++ b/queue-6.12/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch @@ -0,0 +1,58 @@ +From ff369db1b266397593302835d91ebfa8d3c75028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:14:29 +0800 +Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run + +From: Tao Chen + +[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ] + +Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run +called all the way from graph tracer, which disables preemption in +function_graph_enter_regs, as Jiri and Yonghong suggested, there is no +need to use migrate_disable. As a result, some overhead may will be reduced. +And add cant_sleep check for __this_cpu_inc_return. + +Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 3ec7df7dbeec4..4a44451efbcc6 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2759,19 +2759,24 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct bpf_run_ctx *old_run_ctx; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + bpf_prog_inc_misses_counter(link->link.prog); + err = 0; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.51.0 + diff --git a/queue-6.12/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.12/bpf-selftests-fix-test_tcpnotify_user.patch new file mode 100644 index 0000000000..439736d7af --- /dev/null +++ b/queue-6.12/bpf-selftests-fix-test_tcpnotify_user.patch @@ -0,0 +1,139 @@ +From e4482f101f976dee368f553d26cfa863adb9a01b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:12:14 +0000 +Subject: bpf/selftests: Fix test_tcpnotify_user + +From: Matt Bobrowski + +[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ] + +Based on a bisect, it appears that commit 7ee988770326 ("timers: +Implement the hierarchical pull model") has somehow inadvertently +broken BPF selftest test_tcpnotify_user. The error that is being +generated by this test is as follows: + + FAILED: Wrong stats Expected 10 calls, got 8 + +It looks like the change allows timer functions to be run on CPUs +different from the one they are armed on. The test had pinned itself +to CPU 0, and in the past the retransmit attempts also occurred on CPU +0. The test had set the max_entries attribute for +BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling +bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was +likely to be in range. With the change to allow timers to run on other +CPUs, the current CPU tasked with performing the retransmit might be +bumped and in turn fall out of range, as the event will be filtered +out via __bpf_perf_event_output() using: + + if (unlikely(index >= array->map.max_entries)) + return -E2BIG; + +A possible change would be to explicitly set the max_entries attribute +for perf_event_map in test_tcpnotify_kern.c to a value that's at least +as large as the number of CPUs. As it turns out however, if the field +is left unset, then the libbpf will determine the number of CPUs available +on the underlying system and update the max_entries attribute accordingly +in map_set_def_max_entries(). + +A further problem with the test is that it has a thread that continues +running up until the program exits. The main thread cleans up some +LIBBPF data structures, while the other thread continues to use them, +which inevitably will trigger a SIGSEGV. This can be dealt with by +telling the thread to run for as long as necessary and doing a +pthread_join on it before exiting the program. + +Finally, I don't think binding the process to CPU 0 is meaningful for +this test any more, so get rid of that. + +Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") +Signed-off-by: Matt Bobrowski +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 - + .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++---------- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85..ef00d38b0a8d2 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f..35b4893ccdf8a 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +-- +2.51.0 + diff --git a/queue-6.12/btrfs-return-any-hit-error-from-extent_writepage_io.patch b/queue-6.12/btrfs-return-any-hit-error-from-extent_writepage_io.patch new file mode 100644 index 0000000000..ffc1dc9b44 --- /dev/null +++ b/queue-6.12/btrfs-return-any-hit-error-from-extent_writepage_io.patch @@ -0,0 +1,70 @@ +From 226fe4ef03179ea644f08d82e54dccc9cc08b408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 08:40:45 +0930 +Subject: btrfs: return any hit error from extent_writepage_io() + +From: Qu Wenruo + +[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ] + +Since the support of bs < ps support, extent_writepage_io() will submit +multiple blocks inside the folio. + +But if we hit error submitting one sector, but the next sector can still +be submitted successfully, the function extent_writepage_io() will still +return 0. + +This will make btrfs to silently ignore the error without setting error +flag for the filemap. + +Fix it by recording the first error hit, and always return that value. + +Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed") +Reviewed-by: Daniel Vacek +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index afebc91882bef..60fe155b1ce05 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1479,7 +1479,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + struct btrfs_fs_info *fs_info = inode->root->fs_info; + unsigned long range_bitmap = 0; + bool submitted_io = false; +- bool error = false; ++ int found_error = 0; + const u64 folio_start = folio_pos(folio); + u64 cur; + int bit; +@@ -1536,7 +1536,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + */ + btrfs_mark_ordered_io_finished(inode, folio, cur, + fs_info->sectorsize, false); +- error = true; ++ if (!found_error) ++ found_error = ret; + continue; + } + submitted_io = true; +@@ -1553,11 +1554,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + * If we hit any error, the corresponding sector will still be dirty + * thus no need to clear PAGECACHE_TAG_DIRTY. + */ +- if (!submitted_io && !error) { ++ if (!submitted_io && !found_error) { + btrfs_folio_set_writeback(fs_info, folio, start, len); + btrfs_folio_clear_writeback(fs_info, folio, start, len); + } +- return ret; ++ return found_error; + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/coresight-catu-support-atclk.patch b/queue-6.12/coresight-catu-support-atclk.patch new file mode 100644 index 0000000000..7690e703b9 --- /dev/null +++ b/queue-6.12/coresight-catu-support-atclk.patch @@ -0,0 +1,93 @@ +From 2d5c08ad1c62021a02bc34772c4c37081bb8983e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:38 +0100 +Subject: coresight: catu: Support atclk + +From: Leo Yan + +[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ] + +The atclk is an optional clock for the CoreSight CATU, but the driver +misses to initialize it. + +This change enables atclk in probe of the CATU driver, and dynamically +control the clock during suspend and resume. + +The checks for driver data and clocks in suspend and resume are not +needed, remove them. Add error handling in the resume function. + +Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++----- + drivers/hwtracing/coresight/coresight-catu.h | 1 + + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index 25fd02955c38d..abfff42b20c93 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -521,6 +521,10 @@ static int __catu_probe(struct device *dev, struct resource *res) + struct coresight_platform_data *pdata = NULL; + void __iomem *base; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + catu_desc.name = coresight_alloc_device_name(&catu_devs, dev); + if (!catu_desc.name) + return -ENOMEM; +@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int catu_runtime_resume(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h +index 755776cd19c5b..6e6b7aac206dc 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.h ++++ b/drivers/hwtracing/coresight/coresight-catu.h +@@ -62,6 +62,7 @@ + + struct catu_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + int irq; +-- +2.51.0 + diff --git a/queue-6.12/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.12/coresight-etm4x-conditionally-access-register-trcext.patch new file mode 100644 index 0000000000..912c0251b7 --- /dev/null +++ b/queue-6.12/coresight-etm4x-conditionally-access-register-trcext.patch @@ -0,0 +1,91 @@ +From 319890118034616f638fe4bdf08ee9c1b9982864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 01:24:45 -0700 +Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR + +From: Yuanfang Zhang + +[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ] + +The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. +To avoid invalid accesses, introduce a check on numextinsel +(derived from TRCIDR5[11:9]) before reading or writing to this register. + +Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") +Signed-off-by: Yuanfang Zhang +Reviewed-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++ + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index be8b46f26ddc8..cdfd35e03c1dc 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1362,6 +1363,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1789,7 +1791,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1921,7 +1925,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 9e9165f62e81f..899790c8777a9 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -998,6 +999,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +-- +2.51.0 + diff --git a/queue-6.12/coresight-etm4x-support-atclk.patch b/queue-6.12/coresight-etm4x-support-atclk.patch new file mode 100644 index 0000000000..49c784bbe7 --- /dev/null +++ b/queue-6.12/coresight-etm4x-support-atclk.patch @@ -0,0 +1,106 @@ +From 51dc54927ce5834c83085a9561c707a6d1c4e865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:39 +0100 +Subject: coresight: etm4x: Support atclk + +From: Leo Yan + +[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ] + +The atclk is an optional clock for the CoreSight ETMv4, but the driver +misses to initialize it. + +This change enables atclk in probe of the ETMv4 driver, and dynamically +control the clock during suspend and resume. + +No need to check the driver data and clock pointer in the runtime +suspend and resume, so remove checks. And add error handling in the +resume function. + +Add a minor fix to the comment format when adding the atclk field. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++- + 2 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index cdfd35e03c1dc..7b9eaeb115d21 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2157,6 +2157,10 @@ static int etm4_probe(struct device *dev) + if (WARN_ON(!drvdata)) + return -ENOMEM; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) + pm_save_enable = coresight_loses_context_with_cpu(dev) ? + PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; +@@ -2405,8 +2409,8 @@ static int etm4_runtime_suspend(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); + + return 0; + } +@@ -2414,11 +2418,17 @@ static int etm4_runtime_suspend(struct device *dev) + static int etm4_runtime_resume(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); + +- return 0; ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 899790c8777a9..3683966bd0603 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -920,7 +920,8 @@ struct etmv4_save_state { + + /** + * struct etm4_drvdata - specifics associated to an ETM component +- * @pclk APB clock if present, otherwise NULL ++ * @pclk: APB clock if present, otherwise NULL ++ * @atclk: Optional clock for the core parts of the ETMv4. + * @base: Memory mapped base address for this component. + * @csdev: Component vitals needed by the framework. + * @spinlock: Only one at a time pls. +@@ -988,6 +989,7 @@ struct etmv4_save_state { + */ + struct etmv4_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + spinlock_t spinlock; +-- +2.51.0 + diff --git a/queue-6.12/coresight-fix-incorrect-handling-for-return-value-of.patch b/queue-6.12/coresight-fix-incorrect-handling-for-return-value-of.patch new file mode 100644 index 0000000000..85a73e7bb7 --- /dev/null +++ b/queue-6.12/coresight-fix-incorrect-handling-for-return-value-of.patch @@ -0,0 +1,39 @@ +From 5d627dd4dfe54a3a0870063e17548ab160136e75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 20:20:22 +0800 +Subject: coresight: Fix incorrect handling for return value of devm_kzalloc + +From: Lin Yujun + +[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ] + +The return value of devm_kzalloc could be an null pointer, +use "!desc.pdata" to fix incorrect handling return value +of devm_kzalloc. + +Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE") +Signed-off-by: Lin Yujun +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 5755674913723..d771980a278dc 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -1267,7 +1267,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp + * into the device for that purpose. + */ + desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL); +- if (IS_ERR(desc.pdata)) ++ if (!desc.pdata) + goto cpu_clear; + + desc.type = CORESIGHT_DEV_TYPE_SINK; +-- +2.51.0 + diff --git a/queue-6.12/coresight-only-register-perf-symlink-for-sinks-with-.patch b/queue-6.12/coresight-only-register-perf-symlink-for-sinks-with-.patch new file mode 100644 index 0000000000..572d1950b8 --- /dev/null +++ b/queue-6.12/coresight-only-register-perf-symlink-for-sinks-with-.patch @@ -0,0 +1,45 @@ +From dc9c691869d4f8ac55886438fc2c457a7bbce503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jun 2025 18:26:19 +0800 +Subject: coresight: Only register perf symlink for sinks with alloc_buffer + +From: Yuanfang Zhang + +[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ] + +Ensure that etm_perf_add_symlink_sink() is only called for devices +that implement the alloc_buffer operation. This prevents invalid +symlink creation for dummy sinks that do not implement alloc_buffer. + +Without this check, perf may attempt to use a dummy sink that lacks +alloc_buffer operationsu to initialise perf's ring buffer, leading +to runtime failures. + +Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver") +Signed-off-by: Yuanfang Zhang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index b7941d8abbfe7..f20d4cab8f1df 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1200,8 +1200,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) + goto out_unlock; + } + +- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { ++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || ++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && ++ sink_ops(csdev)->alloc_buffer) { + ret = etm_perf_add_symlink_sink(csdev); + + if (ret) { +-- +2.51.0 + diff --git a/queue-6.12/coresight-tmc-support-atclk.patch b/queue-6.12/coresight-tmc-support-atclk.patch new file mode 100644 index 0000000000..22693fb22a --- /dev/null +++ b/queue-6.12/coresight-tmc-support-atclk.patch @@ -0,0 +1,111 @@ +From 79d83976561649b471d894234f11122ea041e90b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:37 +0100 +Subject: coresight: tmc: Support atclk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ] + +The atclk is an optional clock for the CoreSight TMC, but the driver +misses to initialize it. In most cases, TMC shares the atclk clock with +other CoreSight components. Since these components enable the clock +before the TMC device is initialized, the TMC continues properly, +which is why we don’t observe any lockup issues. + +This change enables atclk in probe of the TMC driver. Given the clock +is optional, it is possible to return NULL if the clock does not exist. +IS_ERR() is tolerant for this case. + +Dynamically disable and enable atclk during suspend and resume. The +clock pointers will never be error values if the driver has successfully +probed, and the case of a NULL pointer case will be handled by the clock +core layer. The driver data is always valid after probe. Therefore, +remove the related checks. Also in the resume flow adds error handling. + +Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-tmc.h | 2 ++ + 2 files changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 475fa4bb6813b..96ef2517dd439 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -480,6 +480,10 @@ static int __tmc_probe(struct device *dev, struct resource *res) + struct coresight_desc desc = { 0 }; + struct coresight_dev_list *dev_list = NULL; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + ret = -ENOMEM; + + /* Validity for the resource is already checked by the AMBA core */ +@@ -700,18 +704,26 @@ static int tmc_runtime_suspend(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int tmc_runtime_resume(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 2671926be62a3..2a53acbb5990b 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -166,6 +166,7 @@ struct etr_buf { + + /** + * struct tmc_drvdata - specifics associated to an TMC component ++ * @atclk: optional clock for the core parts of the TMC. + * @pclk: APB clock if present, otherwise NULL + * @base: memory mapped base address for this component. + * @csdev: component vitals needed by the framework. +@@ -191,6 +192,7 @@ struct etr_buf { + * @perf_buf: PERF buffer for ETR. + */ + struct tmc_drvdata { ++ struct clk *atclk; + struct clk *pclk; + void __iomem *base; + struct coresight_device *csdev; +-- +2.51.0 + diff --git a/queue-6.12/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch b/queue-6.12/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch new file mode 100644 index 0000000000..3e59081c95 --- /dev/null +++ b/queue-6.12/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch @@ -0,0 +1,53 @@ +From b2ec4bc0c00bcef3916790b377cc02e8f7c65ef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 07:53:04 +0800 +Subject: coresight: tpda: fix the logic to setup the element size + +From: Jie Gan + +[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ] + +Some TPDM devices support both CMB and DSB datasets, requiring +the system to enable the port with both corresponding element sizes. + +Currently, the logic treats tpdm_read_element_size as successful if +the CMB element size is retrieved correctly, regardless of whether +the DSB element size is obtained. This behavior causes issues +when parsing data from TPDM devices that depend on both element sizes. + +To address this, the function should explicitly fail if the DSB +element size cannot be read correctly. + +Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element") +Reviewed-by: James Clark +Signed-off-by: Jie Gan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tpda.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c +index bfca103f9f847..865fd6273e5e4 100644 +--- a/drivers/hwtracing/coresight/coresight-tpda.c ++++ b/drivers/hwtracing/coresight/coresight-tpda.c +@@ -71,12 +71,15 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata, + if (tpdm_has_dsb_dataset(tpdm_data)) { + rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent), + "qcom,dsb-element-bits", &drvdata->dsb_esize); ++ if (rc) ++ goto out; + } + if (tpdm_has_cmb_dataset(tpdm_data)) { + rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent), + "qcom,cmb-element-bits", &drvdata->cmb_esize); + } + ++out: + if (rc) + dev_warn_once(&csdev->dev, + "Failed to read TPDM Element size: %d\n", rc); +-- +2.51.0 + diff --git a/queue-6.12/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.12/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..58dc61fc2a --- /dev/null +++ b/queue-6.12/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 064b9a5e300e17748e29d4ce905966a2ba57d18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 96a32b2136699..492b2612f64e0 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -22,7 +22,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-6.12/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.12/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..540bdde9d7 --- /dev/null +++ b/queue-6.12/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From 6285539af63522cf8653ff77ee6b623018bc49d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 492b2612f64e0..5755674913723 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -745,12 +745,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -760,7 +760,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-6.12/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.12/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..126655186a --- /dev/null +++ b/queue-6.12/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From 301c5bdad74138c9b387849dfbcf25ad0de107d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index beb660ca240cc..a2ec1addafc93 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -398,6 +399,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-6.12/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.12/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch new file mode 100644 index 0000000000..2e2d1fff9b --- /dev/null +++ b/queue-6.12/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch @@ -0,0 +1,58 @@ +From 4d09d95415696b6824041698878eb251450123c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 17:22:12 +0200 +Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe + +From: Johan Hovold + +[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ] + +Make sure to drop the reference to the saw device taken by +of_find_device_by_node() after retrieving its driver data during +probe(). + +Also drop the reference to the CPU node sooner to avoid leaking it in +case there is no saw node or device. + +Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index 1fc9968eae199..b6b06a510fd86 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.12/crypto-hisilicon-qm-check-whether-the-input-function.patch b/queue-6.12/crypto-hisilicon-qm-check-whether-the-input-function.patch new file mode 100644 index 0000000000..b1653c875c --- /dev/null +++ b/queue-6.12/crypto-hisilicon-qm-check-whether-the-input-function.patch @@ -0,0 +1,42 @@ +From 2d571fdcbc9fe57b3ae2993d71ccfdb5acea50e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:07 +0800 +Subject: crypto: hisilicon/qm - check whether the input function and PF are on + the same device + +From: Zhushuai Yin + +[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ] + +Function rate limiting is set through physical function driver. +Users configure by providing function information and rate limit values. +Before configuration, it is necessary to check whether the +provided function and PF belong to the same device. + +Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") +Signed-off-by: Zhushuai Yin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 5bbb2759a6691..a9550a05dfbd3 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -3657,6 +3657,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, + } + + pdev = container_of(dev, struct pci_dev, dev); ++ if (pci_physfn(pdev) != qm->pdev) { ++ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); ++ return -EINVAL; ++ } + + *fun_index = pdev->devfn; + +-- +2.51.0 + diff --git a/queue-6.12/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.12/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch new file mode 100644 index 0000000000..265e13e52f --- /dev/null +++ b/queue-6.12/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch @@ -0,0 +1,38 @@ +From d00bf0f99debc11048d8b719160a011700abc37d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:57:54 +0800 +Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs + +From: Chenghai Huang + +[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ] + +When the initialization of qm->debug.acc_diff_reg fails, +the probe process does not exit. However, after qm->debug.qm_diff_regs is +freed, it is not set to NULL. This can lead to a double free when the +remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs +should be set to NULL after it is freed. + +Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index 45e130b901eb5..17eb236e9ee4d 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.12/crypto-hisilicon-re-enable-address-prefetch-after-de.patch new file mode 100644 index 0000000000..b9669c222f --- /dev/null +++ b/queue-6.12/crypto-hisilicon-re-enable-address-prefetch-after-de.patch @@ -0,0 +1,200 @@ +From f2e795257b0bf03d8b3747bcb877646e1f222ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:05 +0800 +Subject: crypto: hisilicon - re-enable address prefetch after device resuming + +From: Chenghai Huang + +[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ] + +When the device resumes from a suspended state, it will revert to its +initial state and requires re-enabling. Currently, the address prefetch +function is not re-enabled after device resuming. Move the address prefetch +enable to the initialization process. In this way, the address prefetch +can be enabled when the device resumes by calling the initialization +process. + +Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +- + drivers/crypto/hisilicon/qm.c | 3 - + drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------ + drivers/crypto/hisilicon/zip/zip_main.c | 5 +- + 4 files changed, 43 insertions(+), 48 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index 34d30b7838134..a11fe5e276773 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index b18692ee7fd56..5bbb2759a6691 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4272,9 +4272,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 75c25f0d5f2b8..9014cc36705ff 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -441,6 +441,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -474,45 +513,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1094,7 +1095,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 18177aba3d3a6..323f53217f0c0 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; +@@ -568,6 +569,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return 0; +@@ -1163,9 +1165,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- hisi_zip_set_high_perf(qm); +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +-- +2.51.0 + diff --git a/queue-6.12/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.12/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch new file mode 100644 index 0000000000..f0b5b1f172 --- /dev/null +++ b/queue-6.12/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch @@ -0,0 +1,67 @@ +From b882359173578a59373ad3659209c512d0ac5f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:04 +0800 +Subject: crypto: hisilicon/zip - remove unnecessary validation for + high-performance mode configurations + +From: Chenghai Huang + +[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ] + +When configuring the high-performance mode register, there is no +need to verify whether the register has been successfully +enabled, as there is no possibility of a write failure for this +register. + +Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 80c2fcb1d26dc..18177aba3d3a6 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -449,10 +449,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -462,13 +461,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -1171,9 +1163,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; ++ hisi_zip_set_high_perf(qm); + + hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); +-- +2.51.0 + diff --git a/queue-6.12/crypto-keembay-add-missing-check-after-sg_nents_for_.patch b/queue-6.12/crypto-keembay-add-missing-check-after-sg_nents_for_.patch new file mode 100644 index 0000000000..04c5bf58a3 --- /dev/null +++ b/queue-6.12/crypto-keembay-add-missing-check-after-sg_nents_for_.patch @@ -0,0 +1,45 @@ +From 6a97cdd2947274b5eb32253986b94d412098364a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 14:03:30 +0200 +Subject: crypto: keembay - Add missing check after sg_nents_for_len() + +From: Thomas Fourier + +[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ] + +sg_nents_for_len() returns an int which is negative in case of error. + +Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +index fdeca861933cb..903f31dc663e9 100644 +--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c ++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + struct device *dev = rctx->hcu_dev->dev; + unsigned int remainder = 0; + unsigned int total; +- size_t nents; ++ int nents; + size_t count; + int rc; + int i; +@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + /* Determine the number of scatter gather list entries to process. */ + nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); + ++ if (nents < 0) ++ return nents; ++ + /* If there are entries to process, map them. */ + if (nents) { + rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, +-- +2.51.0 + diff --git a/queue-6.12/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch b/queue-6.12/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch new file mode 100644 index 0000000000..3201d245eb --- /dev/null +++ b/queue-6.12/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch @@ -0,0 +1,42 @@ +From 8ff0b5c303747f3600f6af49e649404a72c6eda1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:24:57 +0200 +Subject: crypto: octeontx2 - Call strscpy() with correct size argument + +From: Thorsten Blum + +[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ] + +In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length +of the source string rather than the size of the destination buffer. + +This is fine as long as the destination buffer is larger than the source +string, but we should still use the destination buffer size instead to +call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer, +we can safely omit the size argument and let strscpy() infer it using +sizeof(). + +Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups") +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +index 1493a373baf71..cf68b213c3e62 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +@@ -1614,7 +1614,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf, + return -EINVAL; + } + err_msg = "Invalid engine group format"; +- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1); ++ strscpy(tmp_buf, ctx->val.vstr); + start = tmp_buf; + + has_se = has_ie = has_ae = false; +-- +2.51.0 + diff --git a/queue-6.12/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch b/queue-6.12/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch new file mode 100644 index 0000000000..434b5fea22 --- /dev/null +++ b/queue-6.12/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch @@ -0,0 +1,51 @@ +From 4d577890cdc1ba13dffe47066fa20869fbe00dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 23:22:38 +0300 +Subject: dm vdo: return error on corrupted metadata in start_restoring_volume + functions + +From: Ivan Abramov + +[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ] + +The return values of VDO_ASSERT calls that validate metadata are not acted +upon. + +Return UDS_CORRUPT_DATA in case of an error. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a4eb7e255517 ("dm vdo: implement the volume index") +Signed-off-by: Ivan Abramov +Reviewed-by: Matthew Sakai +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-vdo/indexer/volume-index.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c +index 12f954a0c5325..afb062e1f1fb4 100644 +--- a/drivers/md/dm-vdo/indexer/volume-index.c ++++ b/drivers/md/dm-vdo/indexer/volume-index.c +@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) { + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0) + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +-- +2.51.0 + diff --git a/queue-6.12/documentation-trace-historgram-design-separate-sched.patch b/queue-6.12/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..94e369a017 --- /dev/null +++ b/queue-6.12/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From ec12a5ff221ad40a7a3bb4a6967ecd10f9263d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 5765eb3e9efa7..a30f4bed11b4e 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-6.12/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.12/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..04d9ff6d59 --- /dev/null +++ b/queue-6.12/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From b8af17afdcbeb6bdcbb12e707a0aa7c961f04d97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 6f09aa8e32237..deccfe68214ec 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -881,7 +881,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-6.12/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.12/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..8584d88fd4 --- /dev/null +++ b/queue-6.12/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From a18eb5e728273d13108cd050e16158029f058ade Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index eb72580288e62..6f09aa8e32237 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -879,6 +879,11 @@ int __register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.12/drm-amd-display-remove-redundant-semicolons.patch new file mode 100644 index 0000000000..6d5ff8ee61 --- /dev/null +++ b/queue-6.12/drm-amd-display-remove-redundant-semicolons.patch @@ -0,0 +1,34 @@ +From 08445c0404819e0f842f05391793223d0a4b4ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:50:14 +0800 +Subject: drm/amd/display: Remove redundant semicolons + +From: Liao Yuanhong + +[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ] + +Remove unnecessary semicolons. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Liao Yuanhong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4..6c75aa82327ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.12/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch new file mode 100644 index 0000000000..0a33c41245 --- /dev/null +++ b/queue-6.12/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch @@ -0,0 +1,57 @@ +From 366fdfa31f4ea7b3998dfbb665bb7feec312e971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:07 +0200 +Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ] + +Based on some comments in dm_pp_display_configuration +above the crtc_index and line_time fields, these values +are programmed to the SMC to work around an SMC hang +when it switches MCLK. + +According to Alex, the Windows driver programs them to: +mclk_change_block_cp_min = 200 / line_time +mclk_change_block_cp_max = 100 / line_time +Let's use the same for the sake of consistency. + +Previously we used the watermark values, but it seemed buggy +as the code was mixing up low/high and A/B watermarks, and +was not saving a low watermark value on DCE 6, so +mclk_change_block_cp_max would be always zero previously. + +Split this change off from the previous si_upload_smc_data +to make it easier to bisect, in case it causes any issues. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 341f2d796aeeb..a8fe6aa6845eb 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5809,8 +5809,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + crtc_index = amdgpu_crtc->crtc_id; + + if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; + } + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.12/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch new file mode 100644 index 0000000000..a1959119d6 --- /dev/null +++ b/queue-6.12/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch @@ -0,0 +1,48 @@ +From 285864728bf419d7720a9aef37c54de0db0d1919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:09 +0200 +Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ] + +According to pp_pm_compute_clocks the non-DC display code +has "issues with mclk switching with refresh rates over 120 hz". +The workaround is to disable MCLK switching in this case. + +Do the same for legacy DPM. + +Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c..2d2d2d5e67634 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.12/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch new file mode 100644 index 0000000000..6b9c5794ee --- /dev/null +++ b/queue-6.12/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch @@ -0,0 +1,99 @@ +From 7cc4bb0894ddeeefb953a247bd30cdb56fe9dc7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:10 +0200 +Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks + (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ] + +Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk +switching on Oland when two 4K 60Hz monitors are connected") + +This is an ad-hoc DPM fix, necessary because we don't have +proper bandwidth calculation for DCE 6. + +We define "high pixelclock" for SI as higher than necessary +for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into +this category. + +When two high pixel clock displays are connected to Oland, +additionally disable shader clock switching, which results in +a higher voltage, thereby addressing some visible flickering. + +v2: +Add more comments. +v3: +Split into two commits for easier review. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 76fc08cda7480..82167eca26683 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.12/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch new file mode 100644 index 0000000000..4f9d651b2e --- /dev/null +++ b/queue-6.12/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch @@ -0,0 +1,53 @@ +From cf781c7b185899bfe6acbf23b4466f54252f0b09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:04 +0200 +Subject: drm/amd/pm: Disable ULV even if unsupported (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ] + +Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode +is unsupported, to make sure it is properly turned off. + +v3: +Simplify si_disable_ulv further. +Always check the return value of amdgpu_si_send_msg_to_smc. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index a5ad1b60597e6..6a97ddcd695b5 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5613,14 +5613,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; ++ PPSMC_Result r; + +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; +- +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.12/drm-amd-pm-fix-si_upload_smc_data-v3.patch new file mode 100644 index 0000000000..855279909a --- /dev/null +++ b/queue-6.12/drm-amd-pm-fix-si_upload_smc_data-v3.patch @@ -0,0 +1,106 @@ +From 50abd6c9e72e7cea0e8b7abc4cf23762865a3f32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:06 +0200 +Subject: drm/amd/pm: Fix si_upload_smc_data (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ] + +The si_upload_smc_data function uses si_write_smc_soft_register +to set some register values in the SMC, and expects the result +to be PPSMC_Result_OK which is 1. + +The PPSMC_Result_OK / PPSMC_Result_Failed values are used for +checking the result of a command sent to the SMC. +However, the si_write_smc_soft_register actually doesn't send +any commands to the SMC and returns zero on success, +so this check was incorrect. + +Fix that by not checking the return value, just like other +calls to si_write_smc_soft_register. + +v3: +Additionally, when no display is plugged in, there is no need +to restrict MCLK switching, so program the registers to zero. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++---------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 6a97ddcd695b5..341f2d796aeeb 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5789,9 +5789,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5800,26 +5800,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.12/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch new file mode 100644 index 0000000000..7895c76e65 --- /dev/null +++ b/queue-6.12/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch @@ -0,0 +1,53 @@ +From 10b9bbaba69bdabd0c16ed89774b0431220e1f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:08 +0200 +Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ] + +Some parts of the code base expect that MCLK switching is turned +off when the vblank time is set to zero. + +According to pp_pm_compute_clocks the non-DC code has issues +with MCLK switching with refresh rates over 120 Hz. + +v3: +Add code comment to explain this better. +Add an if statement instead of changing the switch_limit. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index a8fe6aa6845eb..76fc08cda7480 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +-- +2.51.0 + diff --git a/queue-6.12/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.12/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..c5132e3816 --- /dev/null +++ b/queue-6.12/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From a082c22d0ea13a508714a29c4953538f08d97df5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 805d6662c88b6..21376d98ee498 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @handle: handle used to pass amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.12/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..52c64090ae --- /dev/null +++ b/queue-6.12/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From 9c6f33cd0e038d328fdcf5c09f55876505f82ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 3e9e0f36cd3f4..a8d4b3a3e77af 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4231,7 +4231,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-bridge-it6505-select-regmap_i2c.patch b/queue-6.12/drm-bridge-it6505-select-regmap_i2c.patch new file mode 100644 index 0000000000..175c44add3 --- /dev/null +++ b/queue-6.12/drm-bridge-it6505-select-regmap_i2c.patch @@ -0,0 +1,39 @@ +From 1de342a8efd76e4679fb729ea5984f496fa2c7dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 16:58:25 -0700 +Subject: drm/bridge: it6505: select REGMAP_I2C + +From: Chia-I Wu + +[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ] + +Fix + + aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe': + ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c' + +Signed-off-by: Chia-I Wu +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reviewed-by: Chen-Yu Tsai +Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index 3eb955333c809..66369b6a023f0 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -101,6 +101,7 @@ config DRM_ITE_IT6505 + select EXTCON + select CRYPTO + select CRYPTO_HASH ++ select REGMAP_I2C + help + ITE IT6505 DisplayPort bridge chip driver. + +-- +2.51.0 + diff --git a/queue-6.12/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.12/drm-msm-dpu-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..c9959a32a5 --- /dev/null +++ b/queue-6.12/drm-msm-dpu-fix-incorrect-type-for-ret.patch @@ -0,0 +1,40 @@ +From 8d007154f96372eb8d581e26e1492f8b16e76335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:20:45 +0800 +Subject: drm/msm/dpu: fix incorrect type for ret + +From: Qianfeng Rong + +[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ] + +Change 'ret' from unsigned long to int, as storing negative error codes +in an unsigned long makes it never equal to -ETIMEDOUT, causing logical +errors. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Qianfeng Rong +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/671100/ +Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 07035ab77b792..4597fdb653588 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -445,7 +445,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +-- +2.51.0 + diff --git a/queue-6.12/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.12/drm-panel-novatek-nt35560-fix-invalid-return-value.patch new file mode 100644 index 0000000000..6b54a9e94b --- /dev/null +++ b/queue-6.12/drm-panel-novatek-nt35560-fix-invalid-return-value.patch @@ -0,0 +1,42 @@ +From 7397d8821cda24cdaaac4be8145e1c519bcdc89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 21:23:41 -0600 +Subject: drm/panel: novatek-nt35560: Fix invalid return value + +From: Brigham Campbell + +[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ] + +Fix bug in nt35560_set_brightness() which causes the function to +erroneously report an error. mipi_dsi_dcs_write() returns either a +negative value when an error occurred or a positive number of bytes +written when no error occurred. The buggy code reports an error under +either condition. + +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Reviewed-by: Douglas Anderson +Reviewed-by: Neil Armstrong +Signed-off-by: Brigham Campbell +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index 5bbea734123bc..ee04c55175bb8 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.12/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..052da21ef1 --- /dev/null +++ b/queue-6.12/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From bbbd614293eff0335e254e31dc84929bb1bacc95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index ac77d1246b945..811265648a582 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-6.12/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch b/queue-6.12/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch new file mode 100644 index 0000000000..bd9162a9fe --- /dev/null +++ b/queue-6.12/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch @@ -0,0 +1,78 @@ +From ad4b08e0d88e677426862192cfdb9ca32a896563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:57:07 +0800 +Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller + +From: Qiuxu Zhuo + +[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ] + +When loading the i10nm_edac driver on some Intel Granite Rapids servers, +a call trace may appear as follows: + + UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 + shift exponent -66 is negative + ... + __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 + skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] + i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] + skx_register_mci+0x159/0x220 [skx_edac_common] + i10nm_init+0xcb0/0x1ff0 [i10nm_edac] + ... + +This occurs because some BIOS may disable a memory controller if there +aren't any memory DIMMs populated on this memory controller. The DIMMMTR +register of this disabled memory controller contains the invalid value +~0, resulting in the call trace above. + +Fix this call trace by skipping DIMM enumeration on a disabled memory +controller. + +Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support") +Reported-by: Jose Jesus Ambriz Meza +Reported-by: Chia-Lin Kao (AceLan) +Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/ +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index ac4b3d95531c5..d8cd12d906a72 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -967,6 +967,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) + return !!GET_BITFIELD(mcmtr, 2, 2); + } + ++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) ++{ ++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); ++ ++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); ++ ++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); ++} ++ + static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + struct res_config *cfg) + { +@@ -980,6 +989,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + if (!imc->mbase) + continue; + ++ if (i10nm_channel_disabled(imc, i)) { ++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); ++ continue; ++ } ++ + ndimms = 0; + + if (res_cfg->type != GNR) +-- +2.51.0 + diff --git a/queue-6.12/f2fs-fix-condition-in-__allow_reserved_blocks.patch b/queue-6.12/f2fs-fix-condition-in-__allow_reserved_blocks.patch new file mode 100644 index 0000000000..15298ea168 --- /dev/null +++ b/queue-6.12/f2fs-fix-condition-in-__allow_reserved_blocks.patch @@ -0,0 +1,45 @@ +From cef9cc299937273efc940ab05e5dad1481477de2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:03:38 +0800 +Subject: f2fs: fix condition in __allow_reserved_blocks() + +From: Chao Yu + +[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ] + +If reserve_root mount option is not assigned, __allow_reserved_blocks() +will return false, it's not correct, fix it. + +Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 2dec22f2ea639..0d3ef487f72ac 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2331,8 +2331,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, + { + if (!inode) + return true; +- if (!test_opt(sbi, RESERVE_ROOT)) +- return false; + if (IS_NOQUOTA(inode)) + return true; + if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) +@@ -2353,7 +2351,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode, cap)) ++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { +-- +2.51.0 + diff --git a/queue-6.12/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch b/queue-6.12/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch new file mode 100644 index 0000000000..bf359554e5 --- /dev/null +++ b/queue-6.12/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch @@ -0,0 +1,138 @@ +From fd7f8fd368e5334610f46861f95f8889475dc44c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 10:47:09 +0800 +Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() + +From: Chao Yu + +[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ] + +f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock +and page lookup, change as below to mitigate its overhead: +- check new_size before grabbing invalidate_lock +- lookup and invalidate pages only in range of [old_size, new_size] + +Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 39 +++++++++++++++++++-------------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index eb58d05284173..2a108c561e8bc 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -35,15 +35,23 @@ + #include + #include + +-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) ++static void f2fs_zero_post_eof_page(struct inode *inode, ++ loff_t new_size, bool lock) + { + loff_t old_size = i_size_read(inode); + + if (old_size >= new_size) + return; + ++ if (mapping_empty(inode->i_mapping)) ++ return; ++ ++ if (lock) ++ filemap_invalidate_lock(inode->i_mapping); + /* zero or drop pages only in range of [old_size, new_size] */ +- truncate_pagecache(inode, old_size); ++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); ++ if (lock) ++ filemap_invalidate_unlock(inode->i_mapping); + } + + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) +@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) + + f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); + + file_update_time(vmf->vma->vm_file); + filemap_invalidate_lock_shared(inode->i_mapping); +@@ -1089,7 +1095,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + filemap_invalidate_lock(inode->i_mapping); + + if (attr->ia_size > old_size) +- f2fs_zero_post_eof_page(inode, attr->ia_size); ++ f2fs_zero_post_eof_page(inode, attr->ia_size, false); + truncate_setsize(inode, attr->ia_size); + + if (attr->ia_size <= old_size) +@@ -1208,9 +1214,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) + if (ret) + return ret; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1495,7 +1499,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + + f2fs_lock_op(sbi); + f2fs_drop_extent_tree(inode); +@@ -1618,9 +1622,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + return ret; + +- filemap_invalidate_lock(mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1754,7 +1756,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + truncate_pagecache(inode, offset); + + while (!ret && idx > pg_start) { +@@ -1812,9 +1814,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + f2fs_balance_fs(sbi, true); + +@@ -4759,9 +4759,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, ++ iocb->ki_pos + iov_iter_count(from), true); + return count; + } + +-- +2.51.0 + diff --git a/queue-6.12/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch b/queue-6.12/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch new file mode 100644 index 0000000000..21933c6d0f --- /dev/null +++ b/queue-6.12/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch @@ -0,0 +1,83 @@ +From 02cdb957fbafcfd0dfab8e4487c2994ee552e0d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:40:24 +0800 +Subject: f2fs: fix to truncate first page in error path of f2fs_truncate() + +From: Chao Yu + +[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ] + +syzbot reports a bug as below: + +loop0: detected capacity change from 0 to 40427 +F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) +F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock +F2FS-fs (loop0): invalid crc value +F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. +------------[ cut here ]------------ +kernel BUG at fs/inode.c:753! +RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 +Call Trace: + + evict+0x504/0x9c0 fs/inode.c:810 + f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 + get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 + vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 + do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 + do_mount fs/namespace.c:4136 [inline] + __do_sys_mount fs/namespace.c:4347 [inline] + __se_sys_mount+0x317/0x410 fs/namespace.c:4324 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +During f2fs_evict_inode(), clear_inode() detects that we missed to truncate +all page cache before destorying inode, that is because in below path, we +will create page #0 in cache, but missed to drop it in error path, let's fix +it. + +- evict + - f2fs_evict_inode + - f2fs_truncate + - f2fs_convert_inline_inode + - f2fs_grab_cache_folio + : create page #0 in cache + - f2fs_convert_inline_folio + : sanity check failed, return -EFSCORRUPTED + - clear_inode detects that inode->i_data.nrpages is not zero + +Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large") +Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index fa77841f3e2cc..eb58d05284173 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -856,8 +856,16 @@ int f2fs_truncate(struct inode *inode) + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +- if (err) ++ if (err) { ++ /* ++ * Always truncate page #0 to avoid page cache ++ * leak in evict() path. ++ */ ++ truncate_inode_pages_range(inode->i_mapping, ++ F2FS_BLK_TO_BYTES(0), ++ F2FS_BLK_END_BYTES(0)); + return err; ++ } + } + + err = f2fs_truncate_blocks(inode, i_size_read(inode), true); +-- +2.51.0 + diff --git a/queue-6.12/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch b/queue-6.12/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch new file mode 100644 index 0000000000..91d17c23d8 --- /dev/null +++ b/queue-6.12/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch @@ -0,0 +1,56 @@ +From d8824daa309ce71fe6df0bea89575917045ed7c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:12:50 +0800 +Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() + +From: Chao Yu + +[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ] + +Script to reproduce: +mkfs.f2fs -O extra_attr,compression /dev/vdb -f +mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache +cd /mnt/f2fs +f2fs_io write 1 0 1024 rand dsync testfile +xfs_io testfile -c "fsync" +f2fs_io write 1 0 512 rand dsync testfile +xfs_io testfile -c "fsync" +cd / +umount /mnt/f2fs +mount /dev/vdb /mnt/f2fs +f2fs_io precache_extents /mnt/f2fs/testfile +umount /mnt/f2fs + +Tracepoint output: +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0 + +During precache_extents, there is off-by-one issue, we should update +map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is +valid and not contiguous to previous extent. + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index efc30626760a6..a008d70b9f5ec 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1786,7 +1786,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + map->m_len - ofs); + } + if (map->m_next_extent) +- *map->m_next_extent = pgofs + 1; ++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; + } + f2fs_put_dnode(&dn); + unlock_out: +-- +2.51.0 + diff --git a/queue-6.12/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.12/f2fs-fix-zero-sized-extent-for-precache-extents.patch new file mode 100644 index 0000000000..1db7fb071e --- /dev/null +++ b/queue-6.12/f2fs-fix-zero-sized-extent-for-precache-extents.patch @@ -0,0 +1,97 @@ +From 378691309a412ee14a0629f594cdc1b05ea93990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:36:21 +0800 +Subject: f2fs: fix zero-sized extent for precache extents + +From: wangzijie + +[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ] + +Script to reproduce: +f2fs_io write 1 0 1881 rand dsync testfile +f2fs_io fallocate 0 7708672 4096 testfile +f2fs_io write 1 1881 1 rand buffered testfile +fsync testfile +umount +mount +f2fs_io precache_extents testfile + +When the data layout is something like this: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +During precache_extents, we map the last block(valid blkaddr) in dnode1: +map->m_flags |= F2FS_MAP_MAPPED; +map->m_pblk = blkaddr(valid blkaddr); +map->m_len = 1; +then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: +map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: + +map->m_len = 1 +ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 +ei.fofs = start_pgofs = 1882 +ei.len = map->m_len - ofs = 1 - 1 = 0 + +Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: +A,B,C is valid blkaddr +case1: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case2: +dnode1: dnode2: +[0] A [0] C (C!=B+1) +[1] A+1 [1] C+1 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case3: +dnode1: dnode2: +[0] A [0] C (C!=B+2) +[1] A+1 [1] C+1 +... .... +[1015] A+1015 +[1016] B (B!=A+1016) +[1017] B+1 [1017] 0x0 + +[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: wangzijie +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index a008d70b9f5ec..040c06dfb8c03 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1781,9 +1781,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) + *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; +-- +2.51.0 + diff --git a/queue-6.12/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.12/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..d54e43d018 --- /dev/null +++ b/queue-6.12/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From a9f0ed2acdc8f1a8175e46198a1c5e3b73bdf06c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index b8d1e00a7982c..2dfeb158e848a 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-6.12/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch b/queue-6.12/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch new file mode 100644 index 0000000000..938ffa1bba --- /dev/null +++ b/queue-6.12/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch @@ -0,0 +1,64 @@ +From 221499d4ece1d9c0f828beab700a08938f89c2e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:53:43 +0800 +Subject: firmware: arm_scmi: Mark VirtIO ready before registering + scmi_virtio_driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Junnan Wu + +[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ] + +After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a +standalone driver”), the VirtIO transport probes independently. During +scmi_virtio_probe, scmi_probe() is called, which intune invokes +scmi_protocol_acquire() that sends a message over the virtqueue and +waits for a reply. + +Previously, DRIVER_OK was only set after scmi_vio_probe, in the core +virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device +Initialization): + | The driver MUST NOT send any buffer available notifications to the + | device before setting DRIVER_OK. + +Some type-1 hypervisors block available-buffer notifications until the +driver is marked OK. In such cases, scmi_vio_probe stalls in +scmi_wait_for_reply(), and the probe never completes. + +Resolve this by setting DRIVER_OK immediately after the device-specific +setup, so scmi_probe() can safely send notifications. + +Note after splitting the transports into modules, the probe sequence +changed a bit. We can no longer rely on virtio_device_ready() being +called by the core in virtio_dev_probe(), because scmi_vio_probe() +doesn’t complete until the core SCMI stack runs scmi_probe(), which +immediately issues the initial BASE protocol exchanges. + +Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver") +Signed-off-by: Junnan Wu +Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/transports/virtio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c +index d349766bc0b26..f78b87f334037 100644 +--- a/drivers/firmware/arm_scmi/transports/virtio.c ++++ b/drivers/firmware/arm_scmi/transports/virtio.c +@@ -870,6 +870,9 @@ static int scmi_vio_probe(struct virtio_device *vdev) + /* Ensure initialized scmi_vdev is visible */ + smp_store_mb(scmi_vdev, vdev); + ++ /* Set device ready */ ++ virtio_device_ready(vdev); ++ + ret = platform_driver_register(&scmi_virtio_driver); + if (ret) { + vdev->priv = NULL; +-- +2.51.0 + diff --git a/queue-6.12/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.12/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..1a3cae47e3 --- /dev/null +++ b/queue-6.12/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From 41ec0d71541ac6413b97b324fb1f7537878fd543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.12/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..5de9095d99 --- /dev/null +++ b/queue-6.12/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,87 @@ +From b1b9c93d3492bb8b3a7f63accb248883bed480ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 48566dff0dc92..662add939da78 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else { + /* The size of 'dlcn' can't be > 8. */ + return -EINVAL; + } + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-6.12/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch b/queue-6.12/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch new file mode 100644 index 0000000000..2b3e5c4a1b --- /dev/null +++ b/queue-6.12/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch @@ -0,0 +1,58 @@ +From 7627b5904f97d90fc835051c797bf3e6c88c22e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 10:40:16 -0700 +Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks + exist + +From: Moon Hee Lee + +[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ] + +Index allocation requires at least one bit in the $BITMAP attribute to +track usage of index entries. If the bitmap is empty while index blocks +are already present, this reflects on-disk corruption. + +syzbot triggered this condition using a malformed NTFS image. During a +rename() operation involving a long filename (which spans multiple +index entries), the empty bitmap allowed the name to be added without +valid tracking. Subsequent deletion of the original entry failed with +-ENOENT, due to unexpected index state. + +Reject such cases by verifying that the bitmap is not empty when index +blocks exist. + +Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64 +Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") +Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Signed-off-by: Moon Hee Lee +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 1bf2a6593dec6..6d1bf890929d9 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); + } + ++ /* ++ * Index blocks exist, but $BITMAP has zero valid bits. ++ * This implies an on-disk corruption and must be rejected. ++ */ ++ if (in->name == I30_NAME && ++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { ++ err = -EINVAL; ++ goto out1; ++ } ++ + bit = bmp_size << 3; + } + +-- +2.51.0 + diff --git a/queue-6.12/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch b/queue-6.12/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch new file mode 100644 index 0000000000..a57b364eef --- /dev/null +++ b/queue-6.12/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch @@ -0,0 +1,37 @@ +From 4f3e774ab27b03dd9d795f65b0dfd9ba8320af2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 23:57:24 +0200 +Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote + +From: Andreas Gruenbacher + +[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ] + +Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS +flag a second time after it has already been cleared. Fix that. + +Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 161fc76ed5b0e..e5558e63e2cba 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -801,8 +801,6 @@ __acquires(&gl->gl_lockref.lock) + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); + return; +- } else { +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/hid-hidraw-tighten-ioctl-command-parsing.patch b/queue-6.12/hid-hidraw-tighten-ioctl-command-parsing.patch new file mode 100644 index 0000000000..f23b030004 --- /dev/null +++ b/queue-6.12/hid-hidraw-tighten-ioctl-command-parsing.patch @@ -0,0 +1,310 @@ +From c314a8357cd860af56a61c0f4f1d4760d0d8a1bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 18:58:51 +0200 +Subject: HID: hidraw: tighten ioctl command parsing + +From: Benjamin Tissoires + +[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ] + +The handling for variable-length ioctl commands in hidraw_ioctl() is +rather complex and the check for the data direction is incomplete. + +Simplify this code by factoring out the various ioctls grouped by dir +and size, and using a switch() statement with the size masked out, to +ensure the rest of the command is correctly matched. + +Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw") +Reported-by: Arnd Bergmann +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hidraw.c | 224 ++++++++++++++++++++---------------- + include/uapi/linux/hidraw.h | 2 + + 2 files changed, 124 insertions(+), 102 deletions(-) + +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index c887f48756f4b..bbd6f23bce789 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list) + return 0; + } + +-static long hidraw_ioctl(struct file *file, unsigned int cmd, +- unsigned long arg) ++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *arg) + { +- struct inode *inode = file_inode(file); +- unsigned int minor = iminor(inode); +- long ret = 0; +- struct hidraw *dev; +- struct hidraw_list *list = file->private_data; +- void __user *user_arg = (void __user*) arg; +- +- down_read(&minors_rwsem); +- dev = hidraw_table[minor]; +- if (!dev || !dev->exist || hidraw_is_revoked(list)) { +- ret = -ENODEV; +- goto out; +- } ++ struct hid_device *hid = dev->hid; + + switch (cmd) { + case HIDIOCGRDESCSIZE: +- if (put_user(dev->hid->rsize, (int __user *)arg)) +- ret = -EFAULT; ++ if (put_user(hid->rsize, (int __user *)arg)) ++ return -EFAULT; + break; + + case HIDIOCGRDESC: +@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, + __u32 len; + + if (get_user(len, (int __user *)arg)) +- ret = -EFAULT; +- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1) +- ret = -EINVAL; +- else if (copy_to_user(user_arg + offsetof( +- struct hidraw_report_descriptor, +- value[0]), +- dev->hid->rdesc, +- min(dev->hid->rsize, len))) +- ret = -EFAULT; ++ return -EFAULT; ++ ++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1) ++ return -EINVAL; ++ ++ if (copy_to_user(arg + offsetof( ++ struct hidraw_report_descriptor, ++ value[0]), ++ hid->rdesc, ++ min(hid->rsize, len))) ++ return -EFAULT; ++ + break; + } + case HIDIOCGRAWINFO: + { + struct hidraw_devinfo dinfo; + +- dinfo.bustype = dev->hid->bus; +- dinfo.vendor = dev->hid->vendor; +- dinfo.product = dev->hid->product; +- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo))) +- ret = -EFAULT; ++ dinfo.bustype = hid->bus; ++ dinfo.vendor = hid->vendor; ++ dinfo.product = hid->product; ++ if (copy_to_user(arg, &dinfo, sizeof(dinfo))) ++ return -EFAULT; + break; + } + case HIDIOCREVOKE: + { +- if (user_arg) +- ret = -EINVAL; +- else +- ret = hidraw_revoke(list); +- break; ++ struct hidraw_list *list = file->private_data; ++ ++ if (arg) ++ return -EINVAL; ++ ++ return hidraw_revoke(list); + } + default: +- { +- struct hid_device *hid = dev->hid; +- if (_IOC_TYPE(cmd) != 'H') { +- ret = -EINVAL; +- break; +- } ++ /* ++ * None of the above ioctls can return -EAGAIN, so ++ * use it as a marker that we need to check variable ++ * length ioctls. ++ */ ++ return -EAGAIN; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } ++ return 0; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } ++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ int len = _IOC_SIZE(cmd); ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCSFEATURE(0): ++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCGFEATURE(0): ++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCSINPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCGINPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCSOUTPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ case HIDIOCGOUTPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } ++ return -EINVAL; ++} + +- /* Begin Read-only ioctls. */ +- if (_IOC_DIR(cmd) != _IOC_READ) { +- ret = -EINVAL; +- break; +- } ++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ struct hid_device *hid = dev->hid; ++ int len = _IOC_SIZE(cmd); ++ int field_len; ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCGRAWNAME(0): ++ field_len = strlen(hid->name) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len; ++ case HIDIOCGRAWPHYS(0): ++ field_len = strlen(hid->phys) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len; ++ case HIDIOCGRAWUNIQ(0): ++ field_len = strlen(hid->uniq) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) { +- int len = strlen(hid->name) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->name, len) ? +- -EFAULT : len; +- break; +- } ++ return -EINVAL; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) { +- int len = strlen(hid->phys) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->phys, len) ? +- -EFAULT : len; +- break; +- } ++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ struct inode *inode = file_inode(file); ++ unsigned int minor = iminor(inode); ++ struct hidraw *dev; ++ struct hidraw_list *list = file->private_data; ++ void __user *user_arg = (void __user *)arg; ++ int ret; + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) { +- int len = strlen(hid->uniq) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->uniq, len) ? +- -EFAULT : len; +- break; +- } +- } ++ down_read(&minors_rwsem); ++ dev = hidraw_table[minor]; ++ if (!dev || !dev->exist || hidraw_is_revoked(list)) { ++ ret = -ENODEV; ++ goto out; ++ } ++ ++ if (_IOC_TYPE(cmd) != 'H') { ++ ret = -EINVAL; ++ goto out; ++ } + ++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) { + ret = -ENOTTY; ++ goto out; + } ++ ++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg); ++ if (ret != -EAGAIN) ++ goto out; ++ ++ switch (_IOC_DIR(cmd)) { ++ case (_IOC_READ | _IOC_WRITE): ++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ case _IOC_READ: ++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ default: ++ /* Any other IOC_DIR is wrong */ ++ ret = -EINVAL; ++ } ++ + out: + up_read(&minors_rwsem); + return ret; +diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h +index d5ee269864e07..ebd701b3c18d9 100644 +--- a/include/uapi/linux/hidraw.h ++++ b/include/uapi/linux/hidraw.h +@@ -48,6 +48,8 @@ struct hidraw_devinfo { + #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len) + #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */ + ++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE) ++ + #define HIDRAW_FIRST_MINOR 0 + #define HIDRAW_MAX_DEVICES 64 + /* number of reports to buffer */ +-- +2.51.0 + diff --git a/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch new file mode 100644 index 0000000000..78125965cf --- /dev/null +++ b/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch @@ -0,0 +1,81 @@ +From eea6481fa69a67720377fb1ab32a54667eba54b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:02:54 +0530 +Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Deepanshu Kartikey + +[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] + +hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate +operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: +use new vma_lock for pmd sharing synchronization"), if the trylock fails +or the VMA has no lock, it should skip that VMA. Any remaining mapped +pages are handled by remove_inode_hugepages() which is called after +hugetlb_vmdelete_list() and uses proper lock ordering to guarantee +unmapping success. + +Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs +without shareable locks, the code proceeds to call unmap_hugepage_range(). +This causes assertion failures in huge_pmd_unshare() → +hugetlb_vma_assert_locked() because no lock is actually held: + + WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted + Call Trace: + hugetlb_vma_assert_locked+0x1dd/0x250 + huge_pmd_unshare+0x2c8/0x540 + __unmap_hugepage_range+0x6e3/0x1aa0 + unmap_hugepage_range+0x32e/0x410 + hugetlb_vmdelete_list+0x189/0x1f0 + +Fix by using goto to ensure locks acquired by trylock are always released, +even when skipping VMAs without shareable locks. + +Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com +Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") +Signed-off-by: Deepanshu Kartikey +Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 +Suggested-by: Andrew Morton +Cc: David Hildenbrand +Cc: Muchun Song +Cc: Oscar Salvador +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hugetlbfs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 4aa9a1428dd58..6fe6526c202cc 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -567,6 +567,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + if (!hugetlb_vma_trylock_write(vma)) + continue; + ++ /* ++ * Skip VMAs without shareable locks. Per the design in commit ++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() ++ * called after this function with proper locking. ++ */ ++ if (!__vma_shareable_lock(vma)) ++ goto skip; ++ + v_start = vma_offset_start(vma, start); + v_end = vma_offset_end(vma, end); + +@@ -577,6 +585,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + * vmas. Therefore, lock is not held when calling + * unmap_hugepage_range for private vmas. + */ ++skip: + hugetlb_vma_unlock_write(vma); + } + } +-- +2.51.0 + diff --git a/queue-6.12/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.12/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch new file mode 100644 index 0000000000..357c359c50 --- /dev/null +++ b/queue-6.12/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch @@ -0,0 +1,102 @@ +From e80f6aa709a554dc0f721eac55c5bc5a34286dc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:48:58 +0200 +Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from + different subsystems + +From: Vadim Pasternak + +[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ] + +Distinct between fan speed setting request coming for hwmon and +thermal subsystems. + +There are fields 'last_hwmon_state' and 'last_thermal_state' in the +structure 'mlxreg_fan_pwm', which respectively store the cooling state +set by the 'hwmon' and 'thermal' subsystem. +The purpose is to make arbitration of fan speed setting. For example, if +fan speed required to be not lower than some limit, such setting is to +be performed through 'hwmon' subsystem, thus 'thermal' subsystem will +not set fan below this limit. + +Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing +cooling state to never be set to a lower value. + +Eliminate update of 'last_thermal_state', when request is coming from +'hwmon' subsystem. + +Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index c25a54d5b39ad..0ba9195c9d713 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +-- +2.51.0 + diff --git a/queue-6.12/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.12/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..4fefc85343 --- /dev/null +++ b/queue-6.12/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 3b015dcca82ad93a3b681f1aa3a8a14311d74bbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 36c34252b4f63..3c514b4fbc8ae 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + if (IS_ERR(ks_sa_rng->regmap_cfg)) + return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n"); + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.12/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.12/hwrng-nomadik-add-arm_amba-dependency.patch new file mode 100644 index 0000000000..b9c9e7896e --- /dev/null +++ b/queue-6.12/hwrng-nomadik-add-arm_amba-dependency.patch @@ -0,0 +1,44 @@ +From 4f92a37c6b5e289cbe0ccff3987ed5de3d9fcb05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 17:28:00 +0200 +Subject: hwrng: nomadik - add ARM_AMBA dependency + +From: Arnd Bergmann + +[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ] + +Compile-testing this driver is only possible when the AMBA bus driver is +available in the kernel: + +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': +nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': +nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' +x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' + +The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be +specified for the COMPILE_TEST case. + +Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index b51d9e243f351..f0dde77f50b42 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.51.0 + diff --git a/queue-6.12/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.12/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..a85542770c --- /dev/null +++ b/queue-6.12/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From 3596738cbe344c95fdc714faa4bae9449df94dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 1615facff29c6..24c0ada72f6a5 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-6.12/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch b/queue-6.12/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch new file mode 100644 index 0000000000..385b42a063 --- /dev/null +++ b/queue-6.12/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch @@ -0,0 +1,68 @@ +From abf7d8d42999ccfc030a26cf9a7fbafe61ef65e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:10 +0900 +Subject: i2c: designware: Fix clock issue when PM is disabled + +From: Kunihiko Hayashi + +[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ] + +When the driver is removed, the clocks are first enabled by +calling pm_runtime_get_sync(), and then disabled with +pm_runtime_put_sync(). + +If CONFIG_PM=y, clocks for this controller are disabled when it's in +the idle state. So the clocks are properly disabled when the driver +exits. + +Othewise, the clocks are always enabled and the PM functions have +no effect. Therefore, the driver exits without disabling the clocks. + + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 18 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + +To ensure that the clocks can be disabled correctly even without +CONFIG_PM=y, should add the following fixes: + +- Replace with pm_runtime_put_noidle(), which only decrements the runtime + PM usage count. +- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Tested-by: Jarkko Nikula +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index ef9bed2f2dccb..1615facff29c6 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) + i2c_dw_disable(dev); + + pm_runtime_dont_use_autosuspend(device); +- pm_runtime_put_sync(device); ++ pm_runtime_put_noidle(device); + dw_i2c_plat_pm_cleanup(dev); + ++ i2c_dw_prepare_clk(dev, false); ++ + i2c_dw_remove_lock_support(dev); + + reset_control_assert(dev->rst); +-- +2.51.0 + diff --git a/queue-6.12/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.12/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..b4f2719c1b --- /dev/null +++ b/queue-6.12/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From dfa04b11a8529a3ca86d9f5baea6cd04b4070bba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index e0ba653dec2d6..8beef73960c74 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-6.12/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.12/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..a6dcfbb707 --- /dev/null +++ b/queue-6.12/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From 5d1ece0f231f5417625749851c79bbf8de9e1b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 7d8e1540f02ae..a1945bf9ef19e 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -377,6 +377,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.12/i3c-master-svc-use-manual-response-for-ibi-events.patch new file mode 100644 index 0000000000..d3deb27ec0 --- /dev/null +++ b/queue-6.12/i3c-master-svc-use-manual-response-for-ibi-events.patch @@ -0,0 +1,96 @@ +From 042a36e08309afacb57eedbe630fc91f69fe83c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:08 +0800 +Subject: i3c: master: svc: Use manual response for IBI events + +From: Stanley Chu + +[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ] + +Driver wants to nack the IBI request when the target is not in the +known address list. In below code, svc_i3c_master_nack_ibi() will +cause undefined behavior when using AUTOIBI with auto response rule, +because hw always auto ack the IBI request. + + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); + if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) + svc_i3c_master_nack_ibi(master); + ... + break; + +AutoIBI has another issue that the controller doesn't quit AutoIBI state +after IBIWON polling timeout when there is a SDA glitch(high->low->high). +1. SDA high->low: raising an interrupt to execute IBI ISR +2. SDA low->high +3. Driver writes an AutoIBI request +4. AutoIBI process does not start because SDA is not low +5. IBIWON polling times out +6. Controller reamins in AutoIBI state and doesn't accept EmitStop request + +Emitting broadcast address with IBIRESP_MANUAL avoids both issues. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 474a96ebda226..7d8e1540f02ae 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -438,9 +438,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -460,10 +475,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +-- +2.51.0 + diff --git a/queue-6.12/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.12/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..7f36cb09d8 --- /dev/null +++ b/queue-6.12/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 17f83bc5f1c1a12c2fc89218201d3609422ae882 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 53571e6b3162c..66df5bed6a562 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch b/queue-6.12/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch new file mode 100644 index 0000000000..38a7f1621c --- /dev/null +++ b/queue-6.12/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch @@ -0,0 +1,50 @@ +From a2eda285b83973516688315e2d2afa2f81ad6b12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 11:02:10 -0700 +Subject: idpf: fix mismatched free function for dma_alloc_coherent + +From: Alok Tiwari + +[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ] + +The mailbox receive path allocates coherent DMA memory with +dma_alloc_coherent(), but frees it with dmam_free_coherent(). +This is incorrect since dmam_free_coherent() is only valid for +buffers allocated with dmam_alloc_coherent(). + +Fix the mismatch by using dma_free_coherent() instead of +dmam_free_coherent + +Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg") +Signed-off-by: Alok Tiwari +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Jacob Keller +Reviewed-by: Madhu Chittim +Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +index f27a8cf3816db..d1f374da00981 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +@@ -727,9 +727,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter) + /* If post failed clear the only buffer we supplied */ + if (post_err) { + if (dma_mem) +- dmam_free_coherent(&adapter->pdev->dev, +- dma_mem->size, dma_mem->va, +- dma_mem->pa); ++ dma_free_coherent(&adapter->pdev->dev, ++ dma_mem->size, dma_mem->va, ++ dma_mem->pa); + break; + } + +-- +2.51.0 + diff --git a/queue-6.12/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch b/queue-6.12/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch new file mode 100644 index 0000000000..8e8f47cce4 --- /dev/null +++ b/queue-6.12/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch @@ -0,0 +1,56 @@ +From 50c8f4b769887a9bd4ed8e0a1365cba8c812ad31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:54:56 +0200 +Subject: idpf: fix Rx descriptor ready check barrier in splitq + +From: Alexander Lobakin + +[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ] + +No idea what the current barrier position was meant for. At that point, +nothing is read from the descriptor, only the pointer to the actual one +is fetched. +The correct barrier usage here is after the generation check, so that +only the first qword is read if the descriptor is not yet ready and we +need to stop polling. Debatable on coherent DMA as the Rx descriptor +size is <= cacheline size, but anyway, the current barrier position +only makes the codegen worse. + +Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") +Reviewed-by: Maciej Fijalkowski +Signed-off-by: Alexander Lobakin +Tested-by: Ramu R +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +index 4086a6ef352e5..087a3077d5481 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +@@ -3216,18 +3216,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget) + /* get the Rx desc from Rx queue based on 'next_to_clean' */ + rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb; + +- /* This memory barrier is needed to keep us from reading +- * any other fields out of the rx_desc +- */ +- dma_rmb(); +- + /* if the descriptor isn't done, no work yet to do */ + gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id, + VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M); +- + if (idpf_queue_has(GEN_CHK, rxq) != gen_id) + break; + ++ dma_rmb(); ++ + rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M, + rx_desc->rxdid_ucast); + if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) { +-- +2.51.0 + diff --git a/queue-6.12/iio-consumers-fix-handling-of-negative-channel-scale.patch b/queue-6.12/iio-consumers-fix-handling-of-negative-channel-scale.patch new file mode 100644 index 0000000000..3d9a9b1907 --- /dev/null +++ b/queue-6.12/iio-consumers-fix-handling-of-negative-channel-scale.patch @@ -0,0 +1,121 @@ +From 920eb68fc227f0c1f32d39f92884ec59dc51d736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:20 +0200 +Subject: iio: consumers: Fix handling of negative channel scale in + iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ] + +There is an issue with the handling of negative channel scales +in iio_convert_raw_to_processed_unlocked() when the channel-scale +is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type: + +Things work for channel-scale values > -1.0 and < 0.0 because of +the use of signed values in: + + *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); + +Things will break however for scale values < -1.0. Lets for example say +that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5. + +The result should then be 2 * 10 * -1.5 = -30. + +channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000, +now lets see what gets stored in processed: + +1. *processed = raw64 * scale_val * scale; +2. *processed += raw64 * scale_val2 * scale / 1000000LL; + +1. Sets processed to 2 * -1 * 10 = -20 +2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed + +And the end result is processed = -20 + 10 = -10, which is not correct. + +Fix this by always using the abs value of both scale_val and scale_val2 +and if either is negative multiply the end-result by -1. + +Note there seems to be an unwritten rule about negative +IIO_VAL_INT_PLUS_[MICRO|NANO] values that: + +i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx +ii. values <= -1.0 are written as val=-xxx val2=xxx + +But iio_format_value() will also correctly display a third option: + +iii. values <= -1.0 written as val=-xxx val2=-xxx + +Since iio_format_value() uses abs(val) when val2 < 0. + +This fix also makes iio_convert_raw_to_processed() properly handle +channel-scales using this third option. + +Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") +Cc: Matteo Martelli +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 1155487f7aeac..0f394266ff8c0 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -602,7 +603,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + { + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; +- s64 raw64 = raw; ++ s64 denominator, raw64 = raw; + + offset_type = iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); +@@ -646,20 +647,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000LL); +- break; + case IIO_VAL_INT_PLUS_NANO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000000LL); ++ switch (scale_type) { ++ case IIO_VAL_INT_PLUS_MICRO: ++ denominator = MICRO; ++ break; ++ case IIO_VAL_INT_PLUS_NANO: ++ denominator = NANO; ++ break; ++ } ++ *processed = raw64 * scale * abs(scale_val); ++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); ++ if (scale_val < 0 || scale_val2 < 0) ++ *processed *= -1; + break; + case IIO_VAL_FRACTIONAL: + *processed = div_s64(raw64 * (s64)scale_val * scale, +-- +2.51.0 + diff --git a/queue-6.12/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.12/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..1a7a9f5921 --- /dev/null +++ b/queue-6.12/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 70d5f28f1058536d5bd039767ad00138c9272697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 0f394266ff8c0..85ba80c57d08f 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -638,7 +638,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch b/queue-6.12/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch new file mode 100644 index 0000000000..67918346b9 --- /dev/null +++ b/queue-6.12/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch @@ -0,0 +1,83 @@ +From 71e26e6ec850be8329ae06c9b12705dd03a605fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:30:51 +0000 +Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup() + +From: Eric Dumazet + +[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ] + +We need to check socket netns before considering them in ping_get_port(). +Otherwise, one malicious netns could 'consume' all ports. + +Add corresponding check in ping_lookup(). + +Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Reviewed-by: Yue Haibing +Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ping.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 619ddc087957f..37a3fa98d904f 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, + + int ping_get_port(struct sock *sk, unsigned short ident) + { ++ struct net *net = sock_net(sk); + struct inet_sock *isk, *isk2; + struct hlist_head *hlist; + struct sock *sk2 = NULL; +@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + for (i = 0; i < (1L << 16); i++, result++) { + if (!result) + result++; /* avoid zero */ +- hlist = ping_hashslot(&ping_table, sock_net(sk), +- result); ++ hlist = ping_hashslot(&ping_table, net, result); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + if (isk2->inet_num == result) +@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + if (i >= (1L << 16)) + goto fail; + } else { +- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); ++ hlist = ping_hashslot(&ping_table, net, ident); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + /* BUG? Why is this reuse and not reuseaddr? ping.c +@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) + pr_debug("was not hashed\n"); + sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); +- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ sock_prot_inuse_add(net, sk->sk_prot, 1); + } + spin_unlock(&ping_table.lock); + return 0; +@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + } + + sk_for_each_rcu(sk, hslot) { ++ if (!net_eq(sock_net(sk), net)) ++ continue; + isk = inet_sk(sk); + + pr_debug("iterate\n"); +-- +2.51.0 + diff --git a/queue-6.12/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.12/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch new file mode 100644 index 0000000000..4b42426542 --- /dev/null +++ b/queue-6.12/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch @@ -0,0 +1,39 @@ +From a2904f35d70501996333aadb601789378b47f528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:11:05 +0200 +Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD + +From: Geert Uytterhoeven + +[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ] + +INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and +init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to +prevent asking the user about this feature when configuring a kernel +without initramfs support. + +Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Martin Wilck +Reviewed-by: David Disseldorp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 45990792cb4a6..219ccdb0af732 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1440,6 +1440,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +-- +2.51.0 + diff --git a/queue-6.12/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch b/queue-6.12/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch new file mode 100644 index 0000000000..43ea3b5877 --- /dev/null +++ b/queue-6.12/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch @@ -0,0 +1,79 @@ +From bd77ba121ab472a70388310f0e95fbcb4486d33b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 13:01:59 +0800 +Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic + +From: Vineeth Pillai (Google) + +[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ] + +In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR +maybe uninitialized or zero in that case and may cause oops like: + + Oops: general protection fault, probably for non-canonical address + 0xf00087d3f000f000: 0000 [#1] SMP NOPTI + CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 + RIP: 0010:pgtable_walk_level+0x98/0x150 + RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 + RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e + RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 + RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 + R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 + R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 + FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 + PKRU: 55555554 + Call Trace: + + pgtable_walk_level+0x88/0x150 + domain_translation_struct_show.isra.0+0x2d9/0x300 + dev_domain_translation_struct_show+0x20/0x40 + seq_read_iter+0x12d/0x490 +... + +Avoid walking the page table if TT is not 00b or 01b. + +Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") +Signed-off-by: Vineeth Pillai (Google) +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c +index affbf4a1558de..5aa7f46a420b5 100644 +--- a/drivers/iommu/intel/debugfs.c ++++ b/drivers/iommu/intel/debugfs.c +@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, + } + pgd &= VTD_PAGE_MASK; + } else { /* legacy mode */ +- pgd = context->lo & VTD_PAGE_MASK; +- agaw = context->hi & 7; ++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; ++ ++ /* ++ * According to Translation Type(TT), ++ * get the page table pointer(SSPTPTR). ++ */ ++ switch (tt) { ++ case CONTEXT_TT_MULTI_LEVEL: ++ case CONTEXT_TT_DEV_IOTLB: ++ pgd = context->lo & VTD_PAGE_MASK; ++ agaw = context->hi & 7; ++ break; ++ default: ++ goto iommu_unlock; ++ } + } + + seq_printf(m, "Device %04x:%02x:%02x.%x ", +-- +2.51.0 + diff --git a/queue-6.12/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch b/queue-6.12/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch new file mode 100644 index 0000000000..49189cef8f --- /dev/null +++ b/queue-6.12/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch @@ -0,0 +1,52 @@ +From f390ebe5eb1d0ea430998c4b82abe1a4464d4f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 10:41:30 +0800 +Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk + +From: Lu Baolu + +[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ] + +Dirty page tracking relies on the IOMMU atomically updating the dirty bit +in the paging-structure entry. For this operation to succeed, the paging- +structure memory must be coherent between the IOMMU and the CPU. In +another word, if the iommu page walk is incoherent, dirty page tracking +doesn't work. + +The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: + +"Remapping hardware encountering the need to atomically update A/EA/D bits + in a paging-structure entry that is not snooped will result in a non- + recoverable fault." + +To prevent an IOMMU from being incorrectly configured for dirty page +tracking when it is operating in an incoherent mode, mark SSADS as +supported only when both ecap_slads and ecap_smpwc are supported. + +Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") +Signed-off-by: Lu Baolu +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h +index f521155fb793b..df24a62e8ca40 100644 +--- a/drivers/iommu/intel/iommu.h ++++ b/drivers/iommu/intel/iommu.h +@@ -541,7 +541,8 @@ enum { + #define pasid_supported(iommu) (sm_supported(iommu) && \ + ecap_pasid((iommu)->ecap)) + #define ssads_supported(iommu) (sm_supported(iommu) && \ +- ecap_slads((iommu)->ecap)) ++ ecap_slads((iommu)->ecap) && \ ++ ecap_smpwc(iommu->ecap)) + #define nested_supported(iommu) (sm_supported(iommu) && \ + ecap_nest((iommu)->ecap)) + +-- +2.51.0 + diff --git a/queue-6.12/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.12/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..d64609e127 --- /dev/null +++ b/queue-6.12/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From 954ea043a2c7506b8d05757781f1ed75613661e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index d8a284999544b..206c6700e2006 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-6.12/ipvs-use-read_once-write_once-for-ipvs-enable.patch b/queue-6.12/ipvs-use-read_once-write_once-for-ipvs-enable.patch new file mode 100644 index 0000000000..590940bc55 --- /dev/null +++ b/queue-6.12/ipvs-use-read_once-write_once-for-ipvs-enable.patch @@ -0,0 +1,223 @@ +From f0b771c570a7b813d82da0b4356f431d9952ff5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 21:46:54 +0800 +Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable + +From: Zhang Tengfei + +[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ] + +KCSAN reported a data-race on the `ipvs->enable` flag, which is +written in the control path and read concurrently from many other +contexts. + +Following a suggestion by Julian, this patch fixes the race by +converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. +This lightweight approach ensures atomic access and acts as a +compiler barrier, preventing unsafe optimizations where the flag +is checked in loops (e.g., in ip_vs_est.c). + +Additionally, the `enable` checks in the fast-path hooks +(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are +removed. These are unnecessary since commit 857ca89711de +("ipvs: register hooks only with services"). The `enable=0` +condition they check for can only occur in two rare and non-fatal +scenarios: 1) after hooks are registered but before the flag is set, +and 2) after hooks are unregistered on cleanup_net. In the worst +case, a single packet might be mishandled (e.g., dropped), which +does not lead to a system crash or data corruption. Adding a check +in the performance-critical fast-path to handle this harmless +condition is not a worthwhile trade-off. + +Fixes: 857ca89711de ("ipvs: register hooks only with services") +Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 +Suggested-by: Julian Anastasov +Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ +Signed-off-by: Zhang Tengfei +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + net/netfilter/ipvs/ip_vs_core.c | 11 ++++------- + net/netfilter/ipvs/ip_vs_ctl.c | 6 +++--- + net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++-------- + 4 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index c0289f83f96df..327baa17882a8 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t) + * conntrack cleanup for the net. + */ + smp_rmb(); +- if (ipvs->enable) ++ if (READ_ONCE(ipvs->enable)) + ip_vs_conn_drop_conntrack(cp); + } + +@@ -1433,7 +1433,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) + cond_resched_rcu(); + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + break; + } + rcu_read_unlock(); +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index c7a8a08b73089..5ea7ab8bf4dcc 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat + if (unlikely(!skb_dst(skb))) + return NF_ACCEPT; + +- if (!ipvs->enable) +- return NF_ACCEPT; +- + ip_vs_fill_iph_skb(af, skb, false, &iph); + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state + return NF_ACCEPT; + } + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + ip_vs_fill_iph_skb(af, skb, false, &iph); +@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, + int r; + + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + if (state->pf == NFPROTO_IPV4) { +@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net) + return -ENOMEM; + + /* Hold the beast until a service is registered */ +- ipvs->enable = 0; ++ WRITE_ONCE(ipvs->enable, 0); + ipvs->net = net; + /* Counters used for creating unique names */ + ipvs->gen = atomic_read(&ipvs_netns_cnt); +@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) + ipvs = net_ipvs(net); + ip_vs_unregister_hooks(ipvs, AF_INET); + ip_vs_unregister_hooks(ipvs, AF_INET6); +- ipvs->enable = 0; /* Disable packet reception */ ++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 3224f6e17e736..3219338feca4d 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) + struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock; + if (!kd) + continue; +@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + + *svc_p = svc; + +- if (!ipvs->enable) { ++ if (!READ_ONCE(ipvs->enable)) { + /* Now there is a service - full throttle */ +- ipvs->enable = 1; ++ WRITE_ONCE(ipvs->enable, 1); + + /* Start estimation for first time */ + ip_vs_est_reload_start(ipvs); +diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c +index f821ad2e19b35..3492108bb3b97 100644 +--- a/net/netfilter/ipvs/ip_vs_est.c ++++ b/net/netfilter/ipvs/ip_vs_est.c +@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data) + void ip_vs_est_reload_start(struct netns_ipvs *ipvs) + { + /* Ignore reloads before first service is added */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + return; + ip_vs_est_stopped_recalc(ipvs); + /* Bump the kthread configuration genid */ +@@ -305,7 +305,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + int i; + + if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && +- ipvs->enable && ipvs->est_max_threads) ++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) + return -EINVAL; + + mutex_lock(&ipvs->est_mutex); +@@ -342,7 +342,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + } + + /* Start kthread tasks only when services are present */ +- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { ++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { + ret = ip_vs_est_kthread_start(ipvs, kd); + if (ret < 0) + goto out; +@@ -485,7 +485,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) + struct ip_vs_estimator *est = &stats->est; + int ret; + +- if (!ipvs->est_max_threads && ipvs->enable) ++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) + ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); + + est->ktid = -1; +@@ -662,7 +662,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + /* Wait for cpufreq frequency transition */ + wait_event_idle_timeout(wq, kthread_should_stop(), + HZ / 50); +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + } + +@@ -680,7 +680,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + rcu_read_unlock(); + local_bh_enable(); + +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + cond_resched(); + +@@ -756,7 +756,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + mutex_lock(&ipvs->est_mutex); + for (id = 1; id < ipvs->est_kt_count; id++) { + /* netns clean up started, abort */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock2; + kd = ipvs->est_kt_arr[id]; + if (!kd) +@@ -786,7 +786,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + id = ipvs->est_kt_count; + + next_kt: +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto unlock; + id--; + if (id < 0) +-- +2.51.0 + diff --git a/queue-6.12/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch b/queue-6.12/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch new file mode 100644 index 0000000000..76a7d25c90 --- /dev/null +++ b/queue-6.12/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch @@ -0,0 +1,85 @@ +From 3fc9ceb0def44f61b7f08622b8150f1f84539696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 21:15:50 +0000 +Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing + +From: Fan Wu + +[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ] + +Fix the X.509 Basic Constraints CA flag parsing to correctly handle +the ASN.1 DER encoded structure. The parser was incorrectly treating +the length field as the boolean value. + +Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. +According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: + +Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) + +The basicConstraints extension with CA:TRUE is encoded as: + + SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) + ^-- v[2] ^-- v[3] ^-- v[4] + +The parser was checking v[3] (the length field, always 0x01) instead +of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). + +Also handle the case where the extension is an empty SEQUENCE (30 00), +which is valid for CA:FALSE when the default value is omitted as +required by DER encoding rules (X.690 section 11.5). + +Per ITU-T X.690-0207: +- Section 11.5: Default values must be omitted in DER +- Section 11.1: DER requires TRUE to be encoded as 0xFF + +Link: https://datatracker.ietf.org/doc/html/rfc5280 +Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf +Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") +Signed-off-by: Fan Wu +Reviewed-by: Lukas Wunner +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index ee2fdab42334f..7e0ce7bf68c99 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -611,11 +611,14 @@ int x509_process_extension(void *context, size_t hdrlen, + /* + * Get hold of the basicConstraints + * v[1] is the encoding size +- * (Expect 0x2 or greater, making it 1 or more bytes) ++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or ++ * 0x03 or greater for non-empty SEQUENCE) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) +- * v[3] is the contents of the ASN1_BOOL +- * (Expect 1 if the CA is TRUE) ++ * v[3] is the length of the ASN1_BOOL ++ * (Expect 1 for a single byte boolean) ++ * v[4] is the contents of the ASN1_BOOL ++ * (Expect 0xFF if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) +@@ -624,8 +627,13 @@ int x509_process_extension(void *context, size_t hdrlen, + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; +- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) ++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ ++ if (v[1] == 0) ++ return 0; ++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; ++ else ++ return -EBADMSG; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/leds-flash-leds-qcom-flash-update-torch-current-clam.patch b/queue-6.12/leds-flash-leds-qcom-flash-update-torch-current-clam.patch new file mode 100644 index 0000000000..e38a04f972 --- /dev/null +++ b/queue-6.12/leds-flash-leds-qcom-flash-update-torch-current-clam.patch @@ -0,0 +1,141 @@ +From efeac4b74bba20364303a2eea9f87d78db22ab5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 12:51:22 +0800 +Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting + +From: Fenglin Wu + +[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ] + +There is a register to clamp the flash current per LED channel when +safety timer is disabled. It needs to be updated according to the +maximum torch LED current setting to ensure the torch current won't +be clamped unexpectedly. + +Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") +Signed-off-by: Fenglin Wu +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------ + 1 file changed, 36 insertions(+), 26 deletions(-) + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index 07a83bb2dfdf6..bb00097b1ae59 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -114,36 +114,39 @@ enum { + REG_THERM_THRSH1, + REG_THERM_THRSH2, + REG_THERM_THRSH3, ++ REG_TORCH_CLAMP, + REG_MAX_COUNT, + }; + + static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x08, 0, 7), /* status1 */ +- REG_FIELD(0x09, 0, 7), /* status2 */ +- REG_FIELD(0x0a, 0, 7), /* status3 */ +- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ +- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x47, 0, 5), /* iresolution */ +- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ +- REG_FIELD(0x4c, 0, 2), /* chan_en */ +- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ +- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ ++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), ++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), ++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), ++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), + }; + + static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x06, 0, 7), /* status1 */ +- REG_FIELD(0x07, 0, 6), /* status2 */ +- REG_FIELD(0x09, 0, 7), /* status3 */ +- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ +- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x49, 0, 3), /* iresolution */ +- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ +- REG_FIELD(0x4e, 0, 3), /* chan_en */ +- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ ++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), ++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), ++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), + }; + + struct qcom_flash_data { +@@ -156,6 +159,7 @@ struct qcom_flash_data { + u8 max_channels; + u8 chan_en_bits; + u8 revision; ++ u8 torch_clamp; + }; + + struct qcom_flash_led { +@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, + u32 current_ua, timeout_us; + u32 channels[4]; + int i, rc, count; ++ u8 torch_clamp; + + count = fwnode_property_count_u32(node, "led-sources"); + if (count <= 0) { +@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, + current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); + led->max_torch_current_ma = current_ua / UA_PER_MA; + ++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; ++ if (torch_clamp != 0) ++ torch_clamp--; ++ ++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); ++ + if (fwnode_property_present(node, "flash-max-microamp")) { + flash->led_cdev.flags |= LED_DEV_CAP_FLASH; + +@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) + flash_data->leds_count++; + } + +- return 0; +- ++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); + release: + fwnode_handle_put(child); + while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) +-- +2.51.0 + diff --git a/queue-6.12/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch b/queue-6.12/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch new file mode 100644 index 0000000000..fc363bb708 --- /dev/null +++ b/queue-6.12/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch @@ -0,0 +1,64 @@ +From 314bbd72b2fe8db98f10d14bf8872e2291c73ca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:47:12 +0200 +Subject: leds: leds-lp55xx: Use correct address for memory programming + +From: Andrei Lalaev + +[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ] + +Memory programming doesn't work for devices without page support. +For example, LP5562 has 3 engines but doesn't support pages, +the start address is changed depending on engine number. +According to datasheet [1], the PROG MEM register addresses for each +engine are as follows: + + Engine 1: 0x10 + Engine 2: 0x30 + Engine 3: 0x50 + +However, the current implementation incorrectly calculates the address +of PROG MEM register using the engine index starting from 1: + + prog_mem_base = 0x10 + LP55xx_BYTES_PER_PAGE = 0x20 + + Engine 1: 0x10 + 0x20 * 1 = 0x30 + Engine 2: 0x10 + 0x20 * 2 = 0x50 + Engine 3: 0x10 + 0x20 * 3 = 0x70 + +This results in writing to the wrong engine memory, causing pattern +programming to fail. + +To correct it, the engine index should be decreased: + Engine 1: 0x10 + 0x20 * 0 = 0x10 + Engine 2: 0x10 + 0x20 * 1 = 0x30 + Engine 3: 0x10 + 0x20 * 2 = 0x50 + +1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf + +Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function") +Signed-off-by: Andrei Lalaev +Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp55xx-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c +index e71456a56ab8d..fd447eb7eb15e 100644 +--- a/drivers/leds/leds-lp55xx-common.c ++++ b/drivers/leds/leds-lp55xx-common.c +@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip, + * For LED chip that support page, PAGE is already set in load_engine. + */ + if (!cfg->pages_per_engine) +- start_addr += LP55xx_BYTES_PER_PAGE * idx; ++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1); + + for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) { + /* Write to the next page each 32 bytes (if supported) */ +-- +2.51.0 + diff --git a/queue-6.12/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch b/queue-6.12/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch new file mode 100644 index 0000000000..58cb4fd407 --- /dev/null +++ b/queue-6.12/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch @@ -0,0 +1,121 @@ +From 259b4f9a6d5ccfd040d73ad3a43c13d5e88fffc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 15:17:51 +0800 +Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf + +From: D. Wythe + +[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ] + +When a module registers a struct_ops, the struct_ops type and its +corresponding map_value type ("bpf_struct_ops_") may reside in different +btf objects, here are four possible case: + ++--------+---------------+-------------+---------------------------------+ +| |bpf_struct_ops_| xxx_ops | | ++--------+---------------+-------------+---------------------------------+ +| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux | ++--------+---------------+-------------+---------------------------------+ +| case 1 | btf_vmlinux | mod_btf | INVALID | ++--------+---------------+-------------+---------------------------------+ +| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in | +| | | | vmlinux and mod. | ++--------+---------------+-------------+---------------------------------+ +| case 3 | mod_btf | mod_btf | be used and reg only in mod | ++--------+---------------+-------------+---------------------------------+ + +Currently we figure out the mod_btf by searching with the struct_ops type, +which makes it impossible to figure out the mod_btf when the struct_ops +type is in btf_vmlinux while it's corresponding map_value type is in +mod_btf (case 2). + +The fix is to use the corresponding map_value type ("bpf_struct_ops_") +as the lookup anchor instead of the struct_ops type to figure out the +`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate +the kern_type_id via btf__find_by_name_kind() with the `btf` we just +obtained from find_ksym_btf_id(). + +With this change the lookup obtains the correct btf and mod_btf for case 2, +preserves correct behavior for other valid cases, and still fails as +expected for the invalid scenario (case 1). + +Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") +Signed-off-by: D. Wythe +Signed-off-by: Andrii Nakryiko +Acked-by: Andrii Nakryiko +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index ac5ad30266a5e..060aecf60b76b 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -990,35 +990,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + const struct btf_member *kern_data_member; + struct btf *btf = NULL; + __s32 kern_vtype_id, kern_type_id; +- char tname[256]; ++ char tname[192], stname[256]; + __u32 i; + + snprintf(tname, sizeof(tname), "%.*s", + (int)bpf_core_essential_name_len(tname_raw), tname_raw); + +- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT, +- &btf, mod_btf); +- if (kern_type_id < 0) { +- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", +- tname); +- return kern_type_id; +- } +- kern_type = btf__type_by_id(btf, kern_type_id); ++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname); + +- /* Find the corresponding "map_value" type that will be used +- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example, +- * find "struct bpf_struct_ops_tcp_congestion_ops" from the +- * btf_vmlinux. ++ /* Look for the corresponding "map_value" type that will be used ++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf ++ * and the mod_btf. ++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops". + */ +- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX, +- tname, BTF_KIND_STRUCT); ++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf); + if (kern_vtype_id < 0) { +- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n", +- STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname); + return kern_vtype_id; + } + kern_vtype = btf__type_by_id(btf, kern_vtype_id); + ++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT); ++ if (kern_type_id < 0) { ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname); ++ return kern_type_id; ++ } ++ kern_type = btf__type_by_id(btf, kern_type_id); ++ + /* Find "struct tcp_congestion_ops" from + * struct bpf_struct_ops_tcp_congestion_ops { + * [ ... ] +@@ -1031,8 +1029,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + break; + } + if (i == btf_vlen(kern_vtype)) { +- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n", +- tname, STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n", ++ tname, stname); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.12/libbpf-fix-reuse-of-devmap.patch b/queue-6.12/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..09aa544b35 --- /dev/null +++ b/queue-6.12/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From 0b61366b104a411d6b9f77b578af539da1918f27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e33cf3caf8b64..ac5ad30266a5e 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5056,6 +5056,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-6.12/lsm-config_lsm-can-depend-on-config_security.patch b/queue-6.12/lsm-config_lsm-can-depend-on-config_security.patch new file mode 100644 index 0000000000..78940d41db --- /dev/null +++ b/queue-6.12/lsm-config_lsm-can-depend-on-config_security.patch @@ -0,0 +1,39 @@ +From 1fa257c3b923ad686301414a9049c6f70f7d8bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 15:28:00 -0700 +Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY + +From: Randy Dunlap + +[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ] + +When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does +not need to be visible and settable since builtin_lsm_order is defined in +security.o, which is only built when CONFIG_SECURITY=y. + +So make CONFIG_LSM depend on CONFIG_SECURITY. + +Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM") +Signed-off-by: Randy Dunlap +[PM: subj tweak] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/Kconfig b/security/Kconfig +index 28e685f53bd1a..ce9f1a651ccc3 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -264,6 +264,7 @@ endchoice + + config LSM + string "Ordered list of enabled LSMs" ++ depends on SECURITY + default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK + default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR + default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO +-- +2.51.0 + diff --git a/queue-6.12/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.12/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..ed1356a8a6 --- /dev/null +++ b/queue-6.12/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From bddf177ce3ee0c590abb728cd96cb6ef708b1ab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index b7ca39f63dba8..6dfc912168510 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client) + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-6.12/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.12/media-st-delta-avoid-excessive-stack-usage.patch new file mode 100644 index 0000000000..94424183da --- /dev/null +++ b/queue-6.12/media-st-delta-avoid-excessive-stack-usage.patch @@ -0,0 +1,92 @@ +From 675cd0c462276cd6a27ab0e542f9d4305509c046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 11:31:56 +0200 +Subject: media: st-delta: avoid excessive stack usage + +From: Arnd Bergmann + +[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ] + +Building with a reduced stack warning limit shows that delta_mjpeg_decode() +copies a giant structure to the stack each time but only uses three of +its members: + +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] + +Open-code the passing of the structure members that are actually used here. + +Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d24..a078f1107300e 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +-- +2.51.0 + diff --git a/queue-6.12/media-zoran-remove-zoran_fh-structure.patch b/queue-6.12/media-zoran-remove-zoran_fh-structure.patch new file mode 100644 index 0000000000..c1bf53eaf3 --- /dev/null +++ b/queue-6.12/media-zoran-remove-zoran_fh-structure.patch @@ -0,0 +1,63 @@ +From d6dfd17d0c7f3a65de1b3ea81fa2c9abf095ba60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 04:30:15 +0300 +Subject: media: zoran: Remove zoran_fh structure + +From: Jacopo Mondi + +[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ] + +The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been +mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), +but the structure stayed by mistake. It is now used in a single +location, assigned from a void pointer and then recast to a void +pointer, without being every accessed. Drop it. + +Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") +Signed-off-by: Jacopo Mondi +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/zoran/zoran.h | 6 ------ + drivers/media/pci/zoran/zoran_driver.c | 3 +-- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 1cd990468d3de..d05e222b39215 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index 5c05e64c71a90..80377992a6073 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +-- +2.51.0 + diff --git a/queue-6.12/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.12/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..f99f8f2959 --- /dev/null +++ b/queue-6.12/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From 1bb85c3dabf2c8b175801ef711f791bdd9d628f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-6.12/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch b/queue-6.12/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch new file mode 100644 index 0000000000..b746a15f70 --- /dev/null +++ b/queue-6.12/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch @@ -0,0 +1,56 @@ +From 407b11bc4c7fa320078613ef7a5936a8da324861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:06:05 +0200 +Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() + +From: Bean Huo + +[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ] + +Rename the inner 'frm' variable to 'resp_frm' in the write path of +mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable. + +The function declares 'frm' at function scope pointing to the request +frame, but then redeclares another 'frm' variable inside the write +block pointing to the response frame. This shadowing makes the code +confusing and error-prone. + +Using 'resp_frm' for the response frame makes the distinction clear +and improves code readability. + +Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") +Reviewed-by: Avri Altman +Reviewed-by: Jens Wiklander +Signed-off-by: Bean Huo +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 1d08009f2bd83..08b8276e1da93 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -2876,15 +2876,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req, + return -ENOMEM; + + if (write) { +- struct rpmb_frame *frm = (struct rpmb_frame *)resp; ++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp; + + /* Send write request frame(s) */ + set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK, + 1 | MMC_CMD23_ARG_REL_WR, req, req_len); + + /* Send result request frame */ +- memset(frm, 0, sizeof(*frm)); +- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); ++ memset(resp_frm, 0, sizeof(*resp_frm)); ++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); + set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp, + resp_len); + +-- +2.51.0 + diff --git a/queue-6.12/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.12/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch new file mode 100644 index 0000000000..42df1fb0b0 --- /dev/null +++ b/queue-6.12/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch @@ -0,0 +1,50 @@ +From 7cb2a3fa41d38fa9b31ab88cc91648a7bcc0ee82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 14:07:27 +0300 +Subject: mtd: rawnand: atmel: Fix error handling path in + atmel_nand_controller_add_nands + +From: Erick Karanja + +[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ] + +In case of a jump to the err label due to atmel_nand_create() or +atmel_nand_controller_add_nand() failure, the reference to nand_np +need to be released + +Use for_each_child_of_node_scoped() to fix the issue. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") + +Signed-off-by: Erick Karanja +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 5b02119d8ba23..543a0be9dc645 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +-- +2.51.0 + diff --git a/queue-6.12/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.12/nbd-restrict-sockets-to-tcp-and-udp.patch new file mode 100644 index 0000000000..41448b3918 --- /dev/null +++ b/queue-6.12/nbd-restrict-sockets-to-tcp-and-udp.patch @@ -0,0 +1,54 @@ +From fe7a71406a6d220629b489ed324e65392c779ea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:22:43 +0000 +Subject: nbd: restrict sockets to TCP and UDP + +From: Eric Dumazet + +[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] + +Recently, syzbot started to abuse NBD with all kinds of sockets. + +Commit cf1b2326b734 ("nbd: verify socket is supported during setup") +made sure the socket supported a shutdown() method. + +Explicitely accept TCP and UNIX stream sockets. + +Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") +Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 +Signed-off-by: Eric Dumazet +Cc: Mike Christie +Cc: Richard W.M. Jones +Cc: Jens Axboe +Cc: Yu Kuai +Cc: linux-block@vger.kernel.org +Cc: nbd@other.debian.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index c705acc4d6f4b..de692eed98740 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1156,6 +1156,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.12/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..156bd15986 --- /dev/null +++ b/queue-6.12/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From fb1560ac0f018e2e31e2e9004c02ae393411adb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 2c1b551e14423..92856cf387c76 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-6.12/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.12/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..e12600e00a --- /dev/null +++ b/queue-6.12/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 391556b67d9bcbdbc779956c3d8da5d169b5eb73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 60fb35ec4b15a..0b2e257b591f0 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-6.12/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.12/net-mlx5-fw-reset-add-reset-timeout-work.patch new file mode 100644 index 0000000000..ee8578abe8 --- /dev/null +++ b/queue-6.12/net-mlx5-fw-reset-add-reset-timeout-work.patch @@ -0,0 +1,97 @@ +From 384b815e1e96e4ac5d508b7b5833257950e17c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:09 +0300 +Subject: net/mlx5: fw reset, add reset timeout work + +From: Moshe Shemesh + +[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ] + +Add sync reset timeout to stop poll_sync_reset in case there was no +reset done or abort event within timeout. Otherwise poll sync reset will +just continue and in case of fw fatal error no health reporting will be +done. + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 516df7f1997eb..35d2fe08c0fb5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -27,6 +27,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + u8 reset_method; + struct timer_list timer; +@@ -258,6 +259,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -328,6 +331,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -728,6 +736,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -811,6 +832,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + static const struct devlink_param mlx5_fw_reset_devlink_params[] = { +@@ -854,6 +876,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +-- +2.51.0 + diff --git a/queue-6.12/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.12/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch new file mode 100644 index 0000000000..871a617a2b --- /dev/null +++ b/queue-6.12/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch @@ -0,0 +1,57 @@ +From 1aca7f06a3d668ea874b0869c8c78846dee2d3a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:08 +0300 +Subject: net/mlx5: pagealloc: Fix reclaim race during command interface + teardown + +From: Shay Drory + +[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ] + +The reclaim_pages_cmd() function sends a command to the firmware to +reclaim pages if the command interface is active. + +A race condition can occur if the command interface goes down (e.g., due +to a PCI error) while the mlx5_cmd_do() call is in flight. In this +case, mlx5_cmd_do() will return an error. The original code would +propagate this error immediately, bypassing the software-based page +reclamation logic that is supposed to run when the command interface is +down. + +Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark +that command interface is down. If this is the case, fall through to +the software reclamation path. If the command failed for any another +reason, or finished successfully, return as before. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 9bc9bd83c2324..cd68c4b2c0bf9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +-- +2.51.0 + diff --git a/queue-6.12/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.12/net-mlx5-stop-polling-for-command-response-if-interf.patch new file mode 100644 index 0000000000..352a12ba05 --- /dev/null +++ b/queue-6.12/net-mlx5-stop-polling-for-command-response-if-interf.patch @@ -0,0 +1,53 @@ +From 62210f219ddbe35d04a7abc2b175720de6f1a033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:07 +0300 +Subject: net/mlx5: Stop polling for command response if interface goes down + +From: Moshe Shemesh + +[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ] + +Stop polling on firmware response to command in polling mode if the +command interface got down. This situation can occur, for example, if a +firmware fatal error is detected during polling. + +This change halts the polling process when the command interface goes +down, preventing unnecessary waits. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 5bb4940da59d4..b51c006277598 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1066,7 +1070,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +-- +2.51.0 + diff --git a/queue-6.12/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.12/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..343ccff407 --- /dev/null +++ b/queue-6.12/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From ae069485c3b2b5882ba390b828cd0ede0a642eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98e..92add3daadbb1 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.12/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.12/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..7d454014f5 --- /dev/null +++ b/queue-6.12/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 7b724ae389cee66b045f390afd6e2487fadaa541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 5251524b96afa..5e4453e9ef8e7 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -63,7 +63,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-6.12/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch b/queue-6.12/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch new file mode 100644 index 0000000000..c5240ed7c6 --- /dev/null +++ b/queue-6.12/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch @@ -0,0 +1,51 @@ +From b03db210155879ff1c4b2e6a9cb808da8f61f625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 14:40:43 +0200 +Subject: netfilter: nfnetlink: reset nlh pointer during batch replay + +From: Fernando Fernandez Mancera + +[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ] + +During a batch replay, the nlh pointer is not reset until the parsing of +the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle +ACK flags for batch messages") that is problematic as the condition to +add an ACK for batch begin will evaluate to true even if NLM_F_ACK +wasn't used for batch begin message. + +If there is an error during the command processing, netlink is sending +an ACK despite that. This misleads userspace tools which think that the +return code was 0. Reset the nlh pointer to the original one when a +replay is triggered. + +Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") +Signed-off-by: Fernando Fernandez Mancera +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 7784ec094097b..f12d0d229aaa5 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + const struct nfnetlink_subsystem *ss; + const struct nfnl_callback *nc; + struct netlink_ext_ack extack; ++ struct nlmsghdr *onlh = nlh; + LIST_HEAD(err_list); + u32 status; + int err; +@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + status = 0; + replay_abort: + skb = netlink_skb_clone(oskb, GFP_KERNEL); ++ nlh = onlh; + if (!skb) + return netlink_ack(oskb, nlh, -ENOMEM, NULL); + +-- +2.51.0 + diff --git a/queue-6.12/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.12/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..833fcf40ef --- /dev/null +++ b/queue-6.12/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From 16600aa1c3b118c58c48bcecb22d26fb59b39e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index fbca8d0efd858..37a46596268a0 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-6.12/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.12/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..d0d5140b2c --- /dev/null +++ b/queue-6.12/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From f86d95dc1cbb2932accbcd5e6fb4748fcd99879d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ea92483d5e71e..c21e63027fc0e 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9393,7 +9393,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.12/null_blk-fix-the-description-of-the-cache_size-modul.patch new file mode 100644 index 0000000000..7c127e9ea8 --- /dev/null +++ b/queue-6.12/null_blk-fix-the-description-of-the-cache_size-modul.patch @@ -0,0 +1,56 @@ +From 45ca99b725d73a3a18b1f5269073a4981783e67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:07:32 +0800 +Subject: null_blk: Fix the description of the cache_size module argument + +From: Genjian Zhang + +[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ] + +When executing modinfo null_blk, there is an error in the description +of module parameter mbps, and the output information of cache_size is +incomplete.The output of modinfo before and after applying this patch +is as follows: + +Before: +[...] +parm: cache_size:ulong +[...] +parm: mbps:Cache size in MiB for memory-backed device. + Default: 0 (none) (uint) +[...] + +After: +[...] +parm: cache_size:Cache size in MiB for memory-backed device. + Default: 0 (none) (ulong) +[...] +parm: mbps:Limit maximum bandwidth (in MiB/s). + Default: 0 (no limit) (uint) +[...] + +Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") +Signed-off-by: Genjian Zhang +Reviewed-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index f10369ad90f76..ceb7aeca5d9bd 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static bool g_fua = true; + module_param_named(fua, g_fua, bool, 0444); +-- +2.51.0 + diff --git a/queue-6.12/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.12/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..1c9c5cfbfa --- /dev/null +++ b/queue-6.12/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From d06a55625aa73e5f0f7d34fb8c48fff27b92c522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index ef8c5961e10c8..0ade23610ae64 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1412,7 +1412,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-6.12/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.12/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..582e6af799 --- /dev/null +++ b/queue-6.12/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 03ac265131f828d93649eeca5a9797d586f9dcb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 77edcd70f72c2..c5236b3ed168f 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-6.12/once-fix-race-by-moving-do_once-to-separate-section.patch b/queue-6.12/once-fix-race-by-moving-do_once-to-separate-section.patch new file mode 100644 index 0000000000..f4ddb4a7e3 --- /dev/null +++ b/queue-6.12/once-fix-race-by-moving-do_once-to-separate-section.patch @@ -0,0 +1,91 @@ +From 7e7a425d46b4a4ce22d7bf9a2d2fe6dadafc2615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 19:29:10 +0800 +Subject: once: fix race by moving DO_ONCE to separate section + +From: Qi Xi + +[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ] + +The commit c2c60ea37e5b ("once: use __section(".data.once")") moved +DO_ONCE's ___done variable to .data.once section, which conflicts with +DO_ONCE_LITE() that also uses the same section. + +This creates a race condition when clear_warn_once is used: + +Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) +__do_once_start + read ___done (false) + acquire once_lock +execute func +__do_once_done + write ___done (true) __do_once_start + release once_lock // Thread 3 clear_warn_once reset ___done + read ___done (false) + acquire once_lock + execute func +schedule once_work __do_once_done +once_deferred: OK write ___done (true) +static_branch_disable release once_lock + schedule once_work + once_deferred: + BUG_ON(!static_key_enabled) + +DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning +macros. Keep its ___done flag in the .data..once section and allow resetting +by clear_warn_once, as originally intended. + +In contrast, DO_ONCE() is used for functions like get_random_once() and +relies on its ___done flag for internal synchronization. We should not reset +DO_ONCE() by clear_warn_once. + +Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, +shielding it from clear_warn_once. + +Fixes: c2c60ea37e5b ("once: use __section(".data.once")") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 1 + + include/linux/once.h | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 23b358a1271cd..3c75199947f09 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -354,6 +354,7 @@ + __start_once = .; \ + *(.data..once) \ + __end_once = .; \ ++ *(.data..do_once) \ + STRUCT_ALIGN(); \ + *(__tracepoints) \ + /* implement dynamic printk debug */ \ +diff --git a/include/linux/once.h b/include/linux/once.h +index 30346fcdc7995..449a0e34ad5ad 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + unsigned long ___flags; \ +@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE_SLEEPABLE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_sleepable_start(&___done); \ +-- +2.51.0 + diff --git a/queue-6.12/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch b/queue-6.12/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch new file mode 100644 index 0000000000..5c04027515 --- /dev/null +++ b/queue-6.12/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch @@ -0,0 +1,52 @@ +From f3c965c6d918e9efe054cf7e9be2eb59fcfd301b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 14:46:42 -0700 +Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak + +From: Nirmoy Das + +[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ] + +pci_acpi_preserve_config() leaks memory by returning early without freeing +the ACPI object on success. Fix that by always freeing the obj, which is +not needed by the caller. + +Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()") +Signed-off-by: Nirmoy Das +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index 99c58ee09fbb0..0cd8a75e22580 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle) + + bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + { ++ bool ret = false; ++ + if (ACPI_HANDLE(&host_bridge->dev)) { + union acpi_object *obj; + +@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + 1, DSM_PCI_PRESERVE_BOOT_CONFIG, + NULL, ACPI_TYPE_INTEGER); + if (obj && obj->integer.value == 0) +- return true; ++ ret = true; + ACPI_FREE(obj); + } + +- return false; ++ return ret; + } + + /* _HPX PCI Setting Record (Type 0); same as _HPP */ +-- +2.51.0 + diff --git a/queue-6.12/pci-j721e-fix-incorrect-error-message-in-probe.patch b/queue-6.12/pci-j721e-fix-incorrect-error-message-in-probe.patch new file mode 100644 index 0000000000..caf1250c2e --- /dev/null +++ b/queue-6.12/pci-j721e-fix-incorrect-error-message-in-probe.patch @@ -0,0 +1,42 @@ +From 780e2f629f5a3073c5550f83d9d33b8ac911f2a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 14:14:34 -0700 +Subject: PCI: j721e: Fix incorrect error message in probe() + +From: Alok Tiwari + +[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ] + +The probe() function prints "pm_runtime_get_sync failed" when +j721e_pcie_ctrl_init() returns an error. This is misleading since +the failure is not from pm_runtime, but from the controller init +routine. Update the error message to correctly reflect the source. + +No functional changes. + +Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") +Signed-off-by: Alok Tiwari +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Siddharth Vadapalli +Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index bae829ac759e1..eb772c18d44ed 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -531,7 +531,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + ret = j721e_pcie_ctrl_init(pcie); + if (ret < 0) { +- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n"); ++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n"); + goto err_get_sync; + } + +-- +2.51.0 + diff --git a/queue-6.12/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch b/queue-6.12/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch new file mode 100644 index 0000000000..25ddceac5f --- /dev/null +++ b/queue-6.12/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch @@ -0,0 +1,65 @@ +From a42a99d6d769a22ffa53a21f4af809cda9d34571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:45:58 +0200 +Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585 +Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC +domain, after reset has been asserted by writing a matching reset bit into +register SRCR, it is mandatory to wait 1ms. + +Because it is the controller driver which can determine whether or not the +controller is in HSC domain based on its compatible string, add the missing +delay in the controller driver. + +This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear +whether S4 is affected as well. This patch does apply the extra delay on +R-Car S4 as well. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Suggested-by: Geert Uytterhoeven +Signed-off-by: Marek Vasut +[mani: added the missing r-b tag from Krzysztof] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Krzysztof Wilczyński +Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 5d77a01648606..5382008e366ec 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + return ret; + } + +- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) ++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) { + reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ /* ++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. ++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B) ++ * indicates that for peripherals in HSC domain, after ++ * reset has been asserted by writing a matching reset bit ++ * into register SRCR, it is mandatory to wait 1ms. ++ */ ++ fsleep(1000); ++ } + + val = readl(rcar->base + PCIEMSR0); + if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) { +-- +2.51.0 + diff --git a/queue-6.12/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch b/queue-6.12/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch new file mode 100644 index 0000000000..19e873c8f2 --- /dev/null +++ b/queue-6.12/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch @@ -0,0 +1,56 @@ +From 7322e6e08e489a2e0bd936b23472696aa33968af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 02:55:45 +0200 +Subject: PCI: rcar-gen4: Assure reset occurs before DBI access + +From: Marek Vasut + +[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ] + +Assure the reset is latched and the core is ready for DBI access. On R-Car +V4H, the PCIe reset is asynchronous and does not take effect immediately, +but needs a short time to complete. In case DBI access happens in that +short time, that access generates an SError. Make sure that condition can +never happen, read back the state of the reset, which should turn the +asynchronous reset into a synchronous one, and wait a little over 1ms to +add additional safety margin. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 5382008e366ec..30d16f85f6465 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + if (ret) + goto err_unprepare; + ++ /* ++ * Assure the reset is latched and the core is ready for DBI access. ++ * On R-Car V4H, the PCIe reset is asynchronous and does not take ++ * effect immediately, but needs a short time to complete. In case ++ * DBI access happens in that short time, that access generates an ++ * SError. To make sure that condition can never happen, read back the ++ * state of the reset, which should turn the asynchronous reset into ++ * synchronous one, and wait a little over 1ms to add additional ++ * safety margin. ++ */ ++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ fsleep(1000); ++ + if (rcar->drvdata->additional_common_init) + rcar->drvdata->additional_common_init(rcar); + +-- +2.51.0 + diff --git a/queue-6.12/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch b/queue-6.12/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch new file mode 100644 index 0000000000..f365e738ca --- /dev/null +++ b/queue-6.12/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch @@ -0,0 +1,54 @@ +From befacbcc4e840716533156b11c60f5fc7dcdb18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 01:58:40 +0200 +Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization + +From: Marek Vasut + +[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 +Figure 104.3b Initial Setting of PCIEC(example), third quarter of the +figure indicates that register 0xf8 should be polled until bit 18 becomes +set to 1. + +Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is +set to 1 in less than 1 ms afterward. The current readl_poll_timeout() +break condition is inverted and returns when register 0xf8, bit 18 is set +to 0, which in most cases means immediately. In case +CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first +readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and +afterward never read register 0xf8, bit 18 as 0, which leads to timeout +and failure to start the PCIe controller. + +Fix this by inverting the poll condition to match the reference manual +initialization sequence. + +Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 30d16f85f6465..14f69efa243c3 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable + val &= ~APP_HOLD_PHY_RST; + writel(val, rcar->base + PCIERSTCTRL1); + +- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000); ++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000); + if (ret < 0) + return ret; + +-- +2.51.0 + diff --git a/queue-6.12/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.12/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..04b409be22 --- /dev/null +++ b/queue-6.12/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 3d4fa57a3c41ab1312e39c7907870921340e59f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index d7517c3976e7f..4f70b7f2ded9c 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.12/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.12/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch new file mode 100644 index 0000000000..0048d6e255 --- /dev/null +++ b/queue-6.12/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch @@ -0,0 +1,53 @@ +From fabf625486eff836c5b054bd6fd7b7ac22b45756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 11:30:22 +0200 +Subject: PCI: tegra194: Fix duplicate PLL disable in + pex_ep_event_pex_rst_assert() + +From: Nagarjuna Kristam + +[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ] + +During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently +called twice. + +pex_ep_event_pex_rst_assert() should do the opposite of +pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate +tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate +tegra_pcie_bpmp_set_pll_state() call should instead be a call to +tegra_pcie_bpmp_set_ctrl_state(). + +With this, the uninitialization sequence also matches that of +tegra_pcie_unconfig_controller(). + +Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") +Signed-off-by: Nagarjuna Kristam +[cassel: improve commit log] +Signed-off-by: Niklas Cassel +Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index ced3b7e7bdade..815599ef72db8 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1721,9 +1721,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +-- +2.51.0 + diff --git a/queue-6.12/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.12/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..21e91acf9a --- /dev/null +++ b/queue-6.12/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 8a60113fecc9d29b1d456dec0eed46d01a09ffdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 3569050f9cf37..abd23430dc033 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -96,7 +96,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-6.12/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch b/queue-6.12/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch new file mode 100644 index 0000000000..7e9729414c --- /dev/null +++ b/queue-6.12/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch @@ -0,0 +1,69 @@ +From b6340a4638fa75f3a4e501ea83a4de6214894f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 07:23:22 +0000 +Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 + +From: Jonas Karlman + +[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ] + +The boot firmware may disable the U3 port early during boot and leave it +up to the controller or PHY driver to re-enable U3 when needed. + +The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, +something the Rockchip Naneng Combo PHY driver never does for RK3568. +This may result in USB 3.0 ports being limited to only using USB 2.0 or +in special cases not working at all on RK3568. + +Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled +when a PHY with PHY_TYPE_USB3 mode is used. + +Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index 1ef6d9630f7e0..fbaeb7ca600d1 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg { + struct combphy_reg pipe_xpcs_phy_ready; + struct combphy_reg pipe_pcie1l0_sel; + struct combphy_reg pipe_pcie1l1_sel; ++ struct combphy_reg u3otg0_port_en; ++ struct combphy_reg u3otg1_port_en; + }; + + struct rockchip_combphy_cfg { +@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); ++ switch (priv->id) { ++ case 0: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); ++ break; ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); ++ break; ++ } + break; + + case PHY_TYPE_SATA: +@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + /* pipe-grf */ + .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, + .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, ++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, ++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { +-- +2.51.0 + diff --git a/queue-6.12/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.12/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..668a138c21 --- /dev/null +++ b/queue-6.12/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From f3b9a4890ee3c009cce443d2e1362dac9642eb87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 9171de657f978..a75762e4d2641 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-6.12/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch b/queue-6.12/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch new file mode 100644 index 0000000000..d959d28d1a --- /dev/null +++ b/queue-6.12/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch @@ -0,0 +1,49 @@ +From caf1c74d6309e73092e0bcf81021855185885ef1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 17:08:13 +0100 +Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in + rzg3s_oen_read() + +From: Lad Prabhakar + +[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ] + +rzg3s_oen_read() returns a u32 value, but previously propagated a negative +error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large +positive value due to unsigned conversion. This caused incorrect +output-enable reporting for certain pins. + +Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported +as "output enabled" in the pinconf-pins debugfs file. With this fix, only +P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the +hardware manual. + +Fix this by returning 0 when the OEN bit lookup fails, treating the pin +as output-disabled by default. + +Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index bde58f5a743cb..698ab8cc970a6 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -1074,7 +1074,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin) + + bit = rzg3s_pin_to_oen_bit(pctrl, _pin); + if (bit < 0) +- return bit; ++ return 0; + + return !(readb(pctrl->base + ETH_MODE) & BIT(bit)); + } +-- +2.51.0 + diff --git a/queue-6.12/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.12/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..eaf0cd8f7a --- /dev/null +++ b/queue-6.12/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From f077c9d8b0a06c9623b0b1753207e4a58cdc8207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 29d16c9c1bd19..3a742f74ecd1d 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-6.12/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.12/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch new file mode 100644 index 0000000000..4d8d2e9e22 --- /dev/null +++ b/queue-6.12/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch @@ -0,0 +1,40 @@ +From 0b588ff056b6e161f96828e64db03ac8d8da1658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:58:23 +0300 +Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in + probe() + +From: Dan Carpenter + +[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ] + +The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which +would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check +that the pointer is valid. + +Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") +Signed-off-by: Dan Carpenter +Signed-off-by: Chanwoo Choi +Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/mtk-cci-devfreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index 7ad5225b0381d..6e608d92f7e66 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +-- +2.51.0 + diff --git a/queue-6.12/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch b/queue-6.12/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch new file mode 100644 index 0000000000..13c16948f9 --- /dev/null +++ b/queue-6.12/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch @@ -0,0 +1,88 @@ +From 5b660d58f495f70b3d0ee872160add49126e896e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 May 2025 15:38:08 +0200 +Subject: PM / devfreq: rockchip-dfi: double count on RK3588 + +From: Nicolas Frattaroli + +[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ] + +On RK3588 with LPDDR4X memory, the cycle count as returned by + + perf stat -a -e rockchip_ddr/cycles/ sleep 1 + +consistently reads half as much as what the actual DDR frequency is at. +For a LPDDR4X module running at 2112MHz, I get more like 1056059916 +cycles per second, which is almost bang-on half what it should be. No, +I'm not mixing up megatransfers and megahertz. + +Consulting the downstream driver, this appears to be because the RK3588 +hardware specifically (and RK3528 as well, for future reference) needs a +multiplier of 2 to get to the correct frequency with everything but +LPDDR5. + +The RK3588's actual memory bandwidth measurements in MB/s are correct +however, as confirmed with stress-ng --stream. This makes me think the +access counters are not affected in the same way. This tracks with the +vendor kernel not multiplying the access counts either. + +Solve this by adding a new member to the dfi struct, which each SoC can +set to whatever they want, but defaults to 1 if left unset by the SoC +init functions. The event_get_count op can then use this multiplier if +the cycle count is requested. + +The cycle multiplier is not used in rockchip_dfi_get_event because the +vendor driver doesn't use it there either, and we don't do other actual +bandwidth unit conversion stuff in there anyway. + +Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588") +Signed-off-by: Nicolas Frattaroli +Signed-off-by: Chanwoo Choi +Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/event/rockchip-dfi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c +index e2a1e4463b6f5..712df781436ce 100644 +--- a/drivers/devfreq/event/rockchip-dfi.c ++++ b/drivers/devfreq/event/rockchip-dfi.c +@@ -116,6 +116,7 @@ struct rockchip_dfi { + int buswidth[DMC_MAX_CHANNELS]; + int ddrmon_stride; + bool ddrmon_ctrl_single; ++ unsigned int count_multiplier; /* number of data clocks per count */ + }; + + static int rockchip_dfi_enable(struct rockchip_dfi *dfi) +@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event) + + switch (event->attr.config) { + case PERF_EVENT_CYCLES: +- count = total.c[0].clock_cycles; ++ count = total.c[0].clock_cycles * dfi->count_multiplier; + break; + case PERF_EVENT_READ_BYTES: + for (i = 0; i < dfi->max_channels; i++) +@@ -656,6 +657,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi) + break; + } + ++ if (!dfi->count_multiplier) ++ dfi->count_multiplier = 1; ++ + ret = perf_pmu_register(pmu, "rockchip_ddr", -1); + if (ret) + return ret; +@@ -752,6 +756,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi) + dfi->max_channels = 4; + + dfi->ddrmon_stride = 0x4000; ++ dfi->count_multiplier = 2; + + return 0; + }; +-- +2.51.0 + diff --git a/queue-6.12/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.12/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..1043fbc9e3 --- /dev/null +++ b/queue-6.12/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From e6682851845ed16047956e5a03a4d5a89b09ae71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index faf4cdec23f04..abb16a5bb7967 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -628,8 +628,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-6.12/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.12/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch new file mode 100644 index 0000000000..7b3a9341fd --- /dev/null +++ b/queue-6.12/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch @@ -0,0 +1,37 @@ +From abbd864b84f796e250d7b32d8c75fd0a926216bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 20:32:59 +0800 +Subject: power: supply: cw2015: Fix a alignment coding style issue + +From: Andy Yan + +[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ] + +Fix the checkpatch warning: +CHECK: Alignment should match open parenthesis + +Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") +Signed-off-by: Andy Yan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index f63c3c4104515..382dff8805c62 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +-- +2.51.0 + diff --git a/queue-6.12/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch b/queue-6.12/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch new file mode 100644 index 0000000000..8bdd823f59 --- /dev/null +++ b/queue-6.12/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch @@ -0,0 +1,64 @@ +From 277d9bd0543597178c84a983c1fb78bd5c15212c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 08:30:18 +0200 +Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs + +From: Christophe Leroy + +[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ] + +Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all +PGDIRs and preallocate execmem page tables") was supposed to extend +to powerpc 603 the copy of kernel PGD entries into all PGDIRs +implemented in a previous patch on the 8xx. But 603 is book3s/32 and +uses a duplicate of pgd_alloc() defined in another header. + +So really do the copy at the correct place for the 603. + +Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++-- + arch/powerpc/include/asm/nohash/pgalloc.h | 2 +- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h +index dd4eb30631758..f4390704d5ba2 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h +@@ -7,8 +7,14 @@ + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { +- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ ++#ifdef CONFIG_PPC_BOOK3S_603 ++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, ++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); ++#endif ++ return pgd; + } + + static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) +diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h +index bb5f3e8ea912d..4ef780b291bc3 100644 +--- a/arch/powerpc/include/asm/nohash/pgalloc.h ++++ b/arch/powerpc/include/asm/nohash/pgalloc.h +@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm) + pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), + pgtable_gfp_flags(mm, GFP_KERNEL)); + +-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603) ++#ifdef CONFIG_PPC_8xx + memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, + (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); + #endif +-- +2.51.0 + diff --git a/queue-6.12/powerpc-8xx-remove-left-over-instruction-and-comment.patch b/queue-6.12/powerpc-8xx-remove-left-over-instruction-and-comment.patch new file mode 100644 index 0000000000..f96681733f --- /dev/null +++ b/queue-6.12/powerpc-8xx-remove-left-over-instruction-and-comment.patch @@ -0,0 +1,71 @@ +From baada0017c55b94cb18393ba2fb18c1416d10b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 18:33:26 +0200 +Subject: powerpc/8xx: Remove left-over instruction and comments in + DataStoreTLBMiss handler + +From: Christophe Leroy + +[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ] + +Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in +DTLB misses") removed the test that needed the valeur in SPRN_EPN but +failed to remove the read. + +Remove it. + +And remove related comments, including the very same comment +in InstructionTLBMiss that should have been removed by +commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in +ITLB misses"). + +Also update the comment about absence of a second level table which +has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx: +remove tests on PGDIR entry validity"). + +Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 56c5ebe21b99a..613606400ee99 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -162,7 +162,7 @@ instruction_counter: + * For the MPC8xx, this is a software tablewalk to load the instruction + * TLB. The task switch loads the M_TWB register with the pointer to the first + * level table. +- * If we discover there is no second level table (value is zero) or if there ++ * If there is no second level table (value is zero) or if there + * is an invalid pte, we load that into the TLB, which causes another fault + * into the TLB Error interrupt where we can handle such problems. + * We have to use the MD_xxx registers for the tablewalk because the +@@ -183,9 +183,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ + mfspr r10, SPRN_SRR0 /* Get effective address of fault */ + INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11) + mtspr SPRN_MD_EPN, r10 +@@ -228,10 +225,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ +- mfspr r10, SPRN_MD_EPN + mfspr r10, SPRN_M_TWB /* Get level 1 table */ + lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */ + +-- +2.51.0 + diff --git a/queue-6.12/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.12/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..920df71928 --- /dev/null +++ b/queue-6.12/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From 71518fcc5def8ff9581f59034d6860eced4de10e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index 9463232af8d2e..c6b8b64782761 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-6.12/ptp-add-a-upper-bound-on-max_vclocks.patch b/queue-6.12/ptp-add-a-upper-bound-on-max_vclocks.patch new file mode 100644 index 0000000000..7ad60f694d --- /dev/null +++ b/queue-6.12/ptp-add-a-upper-bound-on-max_vclocks.patch @@ -0,0 +1,58 @@ +From 55910d674a756cddc8e108aefc24a93cf8d3dd7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 21:29:08 +0530 +Subject: ptp: Add a upper bound on max_vclocks + +From: I Viswanath + +[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ] + +syzbot reported WARNING in max_vclocks_store. + +This occurs when the argument max is too large for kcalloc to handle. + +Extend the guard to guard against values that are too large for +kcalloc + +Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df +Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") +Signed-off-by: I Viswanath +Acked-by: Richard Cochran +Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_private.h | 1 + + drivers/ptp/ptp_sysfs.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index b352df4cd3f97..f329263f33aa1 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -22,6 +22,7 @@ + #define PTP_MAX_TIMESTAMPS 128 + #define PTP_BUF_TIMESTAMPS 30 + #define PTP_DEFAULT_MAX_VCLOCKS 20 ++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int))) + #define PTP_MAX_CHANNELS 2048 + + enum { +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index 6b1b8f57cd951..200eaf5006968 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev, + size_t size; + u32 max; + +- if (kstrtou32(buf, 0, &max) || max == 0) ++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT) + return -EINVAL; + + if (max == ptp->max_vclocks) +-- +2.51.0 + diff --git a/queue-6.12/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch b/queue-6.12/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch new file mode 100644 index 0000000000..85e740a7a7 --- /dev/null +++ b/queue-6.12/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch @@ -0,0 +1,49 @@ +From 3fe394b7e2cc49ce0b4dd83f8285357fb4f20dfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:00:59 +0200 +Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ] + +The pwm driver calls pm_runtime_get_sync() when the hardware becomes +enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's +state is kept when a consumer goes away, so the call to +pm_runtime_put_sync() in the .free() callback is unbalanced resulting in +a non-functional device and a reference underlow for the second consumer. + +The easiest fix for that issue is to just not drop the runtime PM +reference in .free(), so do that. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 0125e73b98dfb..5e674a7bbf3be 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- if (pwm_is_enabled(pwm)) { +- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n"); +- pm_runtime_put_sync(pwmchip_parent(chip)); +- } +- + /* set period value to zero on free */ + pc->period_cycles[pwm->hwpwm] = 0; + } +-- +2.51.0 + diff --git a/queue-6.12/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.12/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..c40f6d2db9 --- /dev/null +++ b/queue-6.12/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From 2d5be7f51f58e459525d0da8d5c82789592d060f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a23e48b8523db..7a86cb090f76f 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(pwmchip_parent(chip), "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch b/queue-6.12/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch new file mode 100644 index 0000000000..95217ac7d4 --- /dev/null +++ b/queue-6.12/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch @@ -0,0 +1,279 @@ +From a4e3b013ec3ff2b3018dd7b2165c34a5af96a9d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:01 +0200 +Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle + calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ] + +In Up-Count Mode the timer is reset to zero one tick after it reaches +TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both +the documentation and measurements. So the value written to the TBPRD has +to be one less than the calculated period_cycles value. + +A complication here is that for a 100% relative duty-cycle the value +written to the CMPx register has to be TBPRD + 1 which might overflow if +TBPRD is 0xffff. To handle that the calculation of the AQCTLx register +has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to +be skipped. + +Additionally the AQCTL_PRD register field has to be 0 because that defines +the hardware's action when the maximal counter value is reached, which is +(as above) one clock tick before the period's end. The period start edge +has to happen when the counter is reset and so is defined in the AQCTL_ZRO +field. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++---------------------- + 1 file changed, 58 insertions(+), 85 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a94b1e387b924..a23e48b8523db 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -36,7 +36,7 @@ + + #define CLKDIV_MAX 7 + #define HSPCLKDIV_MAX 7 +-#define PERIOD_MAX 0xFFFF ++#define PERIOD_MAX 0x10000 + + /* compare module registers */ + #define CMPA 0x12 +@@ -65,14 +65,10 @@ + #define AQCTL_ZRO_FRCHIGH BIT(1) + #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0)) + +-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) +-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW) + + #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6)) + #define AQSFRC_RLDCSF_ZRO 0 +@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip { + unsigned long clk_rate; + void __iomem *mmio_base; + unsigned long period_cycles[NUM_PWM_CHANNEL]; +- enum pwm_polarity polarity[NUM_PWM_CHANNEL]; + struct clk *tbclk; + struct ehrpwm_context ctx; + }; +@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + return 1; + } + +-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan) +-{ +- u16 aqctl_val, aqctl_mask; +- unsigned int aqctl_reg; +- +- /* +- * Configure PWM output to HIGH/LOW level on counter +- * reaches compare register value and LOW/HIGH level +- * on counter value reaches period register value and +- * zero value on counter +- */ +- if (chan == 1) { +- aqctl_reg = AQCTLB; +- aqctl_mask = AQCTL_CBU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANB_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANB_POLNORMAL; +- } else { +- aqctl_reg = AQCTLA; +- aqctl_mask = AQCTL_CAU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANA_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANA_POLNORMAL; +- } +- +- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; +- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); +-} +- + /* + * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE + * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE + */ + static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, +- u64 duty_ns, u64 period_ns) ++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + u32 period_cycles, duty_cycles; + u16 ps_divval, tb_divval; + unsigned int i, cmp_reg; + unsigned long long c; ++ u16 aqctl_val, aqctl_mask; ++ unsigned int aqctl_reg; + + if (period_ns > NSEC_PER_SEC) + return -ERANGE; +@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + do_div(c, NSEC_PER_SEC); + period_cycles = (unsigned long)c; + +- if (period_cycles < 1) { +- period_cycles = 1; +- duty_cycles = 1; +- } else { +- c = pc->clk_rate; +- c = c * duty_ns; +- do_div(c, NSEC_PER_SEC); +- duty_cycles = (unsigned long)c; +- } ++ c = pc->clk_rate; ++ c = c * duty_ns; ++ do_div(c, NSEC_PER_SEC); ++ duty_cycles = (unsigned long)c; + + /* + * Period values should be same for multiple PWM channels as IP uses +@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + return -EINVAL; + } + +- pm_runtime_get_sync(pwmchip_parent(chip)); +- +- /* Update clock prescaler values */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); +- + /* Update period & duty cycle with presacler division */ + period_cycles = period_cycles / ps_divval; + duty_cycles = duty_cycles / ps_divval; + +- /* Configure shadow loading on Period register */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ if (period_cycles < 1) ++ period_cycles = 1; + +- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles); ++ pm_runtime_get_sync(pwmchip_parent(chip)); + +- /* Configure ehrpwm counter for up-count mode */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, +- TBCTL_CTRMODE_UP); ++ /* Update clock prescaler values */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); + +- if (pwm->hwpwm == 1) ++ if (pwm->hwpwm == 1) { + /* Channel 1 configured with compare B register */ + cmp_reg = CMPB; +- else ++ ++ aqctl_reg = AQCTLB; ++ aqctl_mask = AQCTL_CBU_MASK; ++ ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANB_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANB_POLNORMAL; ++ ++ /* if duty_cycle is big, don't toggle on CBU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CBU_MASK; ++ ++ } else { + /* Channel 0 configured with compare A register */ + cmp_reg = CMPA; + +- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); ++ aqctl_reg = AQCTLA; ++ aqctl_mask = AQCTL_CAU_MASK; + +- pm_runtime_put_sync(pwmchip_parent(chip)); ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANA_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANA_POLNORMAL; + +- return 0; +-} ++ /* if duty_cycle is big, don't toggle on CAU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CAU_MASK; ++ } + +-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip, +- struct pwm_device *pwm, +- enum pwm_polarity polarity) +-{ +- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); ++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; ++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); ++ ++ /* Configure shadow loading on Period register */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ ++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1); ++ ++ /* Configure ehrpwm counter for up-count mode */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, ++ TBCTL_CTRMODE_UP); ++ ++ if (!(duty_cycles > period_cycles)) ++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); + +- /* Configuration of polarity in hardware delayed, do at enable */ +- pc->polarity[pwm->hwpwm] = polarity; ++ pm_runtime_put_sync(pwmchip_parent(chip)); + + return 0; + } +@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + + ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); + +- /* Channels polarity can be configured from action qualifier module */ +- configure_polarity(pc, pwm->hwpwm); +- + /* Enable TBCLK */ + ret = clk_enable(pc->tbclk); + if (ret) { +@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + ehrpwm_pwm_disable(chip, pwm); + enabled = false; + } +- +- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity); +- if (err) +- return err; + } + + if (!state->enabled) { +@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + return 0; + } + +- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period); ++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity); + if (err) + return err; + +-- +2.51.0 + diff --git a/queue-6.12/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch b/queue-6.12/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch new file mode 100644 index 0000000000..d171b5b5b3 --- /dev/null +++ b/queue-6.12/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch @@ -0,0 +1,40 @@ +From bbc3cd61e4cdd59687ebb9bf9f8bac9037e104f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:00 +0200 +Subject: pwm: tiehrpwm: Make code comment in .free() more useful +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ] + +Instead of explaining trivia to everyone who can read C describe the +higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero. + +Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 5e674a7bbf3be..a94b1e387b924 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- /* set period value to zero on free */ ++ /* Don't let a pwm without consumer block requests to the other channel */ + pc->period_cycles[pwm->hwpwm] = 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.12/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..c910ce40de --- /dev/null +++ b/queue-6.12/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From 5fc6bbc184eb8cf7b1cfc5418bba780be3f4830e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index d45e3909dafe1..50bb3c43f40bf 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-6.12/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.12/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..1f5f48fa54 --- /dev/null +++ b/queue-6.12/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From eda3de897b24a2840002f2cc4d00549424452b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index be0743dac3fff..929e89841c12a 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch b/queue-6.12/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch new file mode 100644 index 0000000000..f52f6e38be --- /dev/null +++ b/queue-6.12/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch @@ -0,0 +1,115 @@ +From f4e857fa0de006331a50a40340491f125f449df2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:39:56 +0300 +Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Or Har-Toov + +[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ] + +The mlx5 driver currently derives max_qp_wr directly from the +log_max_qp_sz HCA capability: + + props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); + +However, this value represents the number of WQEs in units of Basic +Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size +of a WQE can vary depending on transport type and features (e.g., atomic +operations, UMR, LSO), the actual number of WQEs can be significantly +smaller than the WQEBB count suggests. + +This patch introduces a conservative estimation of the worst-case WQE size +— considering largest segments possible with 1 SGE and no inline data or +special features. It uses this to derive a more accurate max_qp_wr value. + +Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling") +Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org +Reported-by: Chuck Lever +Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/ +Signed-off-by: Or Har-Toov +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++- + 1 file changed, 47 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 435c456a4fd5b..29d0bc583169b 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -865,6 +866,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev, + resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask(); + } + ++/* ++ * Calculate maximum SQ overhead across all QP types. ++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT) ++ * have smaller overhead than the types calculated below, ++ * so they are implicitly included. ++ */ ++static u32 mlx5_ib_calc_max_sq_overhead(void) ++{ ++ u32 max_overhead_xrc, overhead_ud_lso, a, b; ++ ++ /* XRC_INI */ ++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg); ++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg); ++ a = sizeof(struct mlx5_wqe_atomic_seg) + ++ sizeof(struct mlx5_wqe_raddr_seg); ++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) + ++ sizeof(struct mlx5_mkey_seg) + ++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD; ++ max_overhead_xrc += max(a, b); ++ ++ /* UD with LSO */ ++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg); ++ ++ return max(max_overhead_xrc, overhead_ud_lso); ++} ++ ++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev) ++{ ++ struct mlx5_core_dev *mdev = dev->mdev; ++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ u32 max_wqe_size; ++ /* max QP overhead + 1 SGE, no inline, no special features */ ++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() + ++ sizeof(struct mlx5_wqe_data_seg); ++ ++ max_wqe_size = roundup_pow_of_two(max_wqe_size); ++ ++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB); ++ ++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size; ++} ++ + static int mlx5_ib_query_device(struct ib_device *ibdev, + struct ib_device_attr *props, + struct ib_udata *uhw) +@@ -1023,7 +1069,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, + props->max_mr_size = ~0ull; + props->page_size_cap = ~(min_page_size - 1); + props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp); +- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev); + max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) / + sizeof(struct mlx5_wqe_data_seg); + max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512); +-- +2.51.0 + diff --git a/queue-6.12/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/queue-6.12/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch new file mode 100644 index 0000000000..ee5053a57c --- /dev/null +++ b/queue-6.12/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch @@ -0,0 +1,117 @@ +From 72cd2f492edbdba796acfe0567940a5ec28f7852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:41:19 +0300 +Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device + +From: Patrisious Haddad + +[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ] + +Previously loopback for MPV was supposed to be permanently enabled, +however other driver flows were able to over-ride that configuration and +disable it. + +Add force_lb parameter that indicates that loopback should always be +enabled which prevents all other driver flows from disabling it. + +Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") +Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++---- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 29d0bc583169b..f3e58797705d7 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1813,7 +1813,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + } + + static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + int err; + +@@ -1825,6 +1826,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + if (err) + goto out; + ++ lb_state->force_enable = true; + return 0; + + out: +@@ -1833,16 +1835,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + } + + static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + mlx5_nic_vport_update_local_lb(slave, false); + mlx5_nic_vport_update_local_lb(master, false); ++ ++ lb_state->force_enable = false; + } + + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; + ++ if (dev->lb.force_enable) ++ return 0; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td++; +@@ -1864,6 +1872,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + + void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { ++ if (dev->lb.force_enable) ++ return; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td--; +@@ -3521,7 +3532,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + +- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + + mlx5_core_mp_event_replay(ibdev->mdev, + MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, +@@ -3618,7 +3629,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + MLX5_DRIVER_EVENT_AFFILIATION_DONE, + &key); + +- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + if (err) + goto unbind; + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 29bde64ea1eac..f49cb588a856d 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1083,6 +1083,7 @@ struct mlx5_ib_lb_state { + u32 user_td; + int qps; + bool enabled; ++ bool force_enable; + }; + + struct mlx5_ib_pf_eq { +-- +2.51.0 + diff --git a/queue-6.12/rdma-rxe-fix-race-in-do_task-when-draining.patch b/queue-6.12/rdma-rxe-fix-race-in-do_task-when-draining.patch new file mode 100644 index 0000000000..ff8039656a --- /dev/null +++ b/queue-6.12/rdma-rxe-fix-race-in-do_task-when-draining.patch @@ -0,0 +1,62 @@ +From ba1c61e85c4f22266ffdb92c30e2104a76e0cd14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 02:52:12 +0000 +Subject: RDMA/rxe: Fix race in do_task() when draining + +From: Gui-Dong Han + +[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ] + +When do_task() exhausts its iteration budget (!ret), it sets the state +to TASK_STATE_IDLE to reschedule, without a secondary check on the +current task->state. This can overwrite the TASK_STATE_DRAINING state +set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). + +While state changes are protected by a spinlock, both rxe_cleanup_task() +and rxe_disable_task() release the lock while waiting for the task to +finish draining in the while(!is_done(task)) loop. The race occurs if +do_task() hits its iteration limit and acquires the lock in this window. +The cleanup logic may then proceed while the task incorrectly +reschedules itself, leading to a potential use-after-free. + +This bug was introduced during the migration from tasklets to workqueues, +where the special handling for the draining case was lost. + +Fix this by restoring the original pre-migration behavior. If the state is +TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to +force a new loop iteration. This allows the task to finish its work, so +that a subsequent iteration can reach the switch statement and correctly +transition the state to TASK_STATE_DRAINED, stopping the task as intended. + +Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks") +Reviewed-by: Zhu Yanjun +Signed-off-by: Gui-Dong Han +Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 80332638d9e3a..be6cd8ce4d97e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) + * yield the cpu and reschedule the task + */ + if (!ret) { +- task->state = TASK_STATE_IDLE; +- resched = 1; ++ if (task->state != TASK_STATE_DRAINING) { ++ task->state = TASK_STATE_IDLE; ++ resched = 1; ++ } else { ++ cont = 1; ++ } + goto exit; + } + +-- +2.51.0 + diff --git a/queue-6.12/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.12/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..a264c576b2 --- /dev/null +++ b/queue-6.12/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 4dfe9fa8a4c5abdf508d0e4f641e7be86a9b550c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 7ca0297d68a4a..d0c0cde09f118 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -773,7 +773,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -959,9 +959,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -986,15 +994,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.12/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..be2c0bb268 --- /dev/null +++ b/queue-6.12/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From 493272f0e756c6465547e97e44e499f0dba99e05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index de4e2f3db942a..66b3840bd96e3 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -828,7 +828,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +-- +2.51.0 + diff --git a/queue-6.12/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.12/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..2979d8134f --- /dev/null +++ b/queue-6.12/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 730ca5c191e6780cb3cad75f15ec29902a414dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 9df726f10ad12..6d609c42e4793 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-6.12/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.12/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..3ffb8e75e6 --- /dev/null +++ b/queue-6.12/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From 69e8a45fc6a14536a5dcd394941a13554b17429f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 4ee5e67a9f03f..769c6d6d6a731 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-6.12/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.12/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..7bdeb4588b --- /dev/null +++ b/queue-6.12/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From 40e2d0b05ab95902b368442c31954df829461875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 66d276a1be836..f4a19ffbb641c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index de2327ffb0f78..4a2f58a9d7066 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -47,7 +47,6 @@ + #include "en.h" + #include "en/dim.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2918,11 +2917,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2932,18 +2929,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.12/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.12/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..ee82e86a8f --- /dev/null +++ b/queue-6.12/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From abf2014fd63d0695a0d13607f4d0fdad389faf8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 1002fa51a25aa..f377725a12128 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1199,19 +1199,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +-- +2.51.0 + diff --git a/queue-6.12/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch b/queue-6.12/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch new file mode 100644 index 0000000000..fd11bf35e3 --- /dev/null +++ b/queue-6.12/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch @@ -0,0 +1,139 @@ +From 699b849dbe3684035a00a579ebf99e1759d90406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 01:24:48 +0000 +Subject: riscv, bpf: Sign extend struct ops return values properly + +From: Hengqi Chen + +[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ] + +The ns_bpf_qdisc selftest triggers a kernel panic: + + Unable to handle kernel paging request at virtual address ffffffffa38dbf58 + Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 + [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 + Oops [#1] + Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] + CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE + Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE + Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 + epc : __qdisc_run+0x82/0x6f0 + ra : __qdisc_run+0x6e/0x6f0 + epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 + gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 + t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 + s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 + a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 + a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 + s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 + s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 + s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 + s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 + t5 : 0000000000000000 t6 : ff60000093a6a8b6 + status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d + [] __qdisc_run+0x82/0x6f0 + [] __dev_queue_xmit+0x4c0/0x1128 + [] neigh_resolve_output+0xd0/0x170 + [] ip6_finish_output2+0x226/0x6c8 + [] ip6_finish_output+0x10c/0x2a0 + [] ip6_output+0x5e/0x178 + [] ip6_xmit+0x29a/0x608 + [] inet6_csk_xmit+0xe6/0x140 + [] __tcp_transmit_skb+0x45c/0xaa8 + [] tcp_connect+0x9ce/0xd10 + [] tcp_v6_connect+0x4ac/0x5e8 + [] __inet_stream_connect+0xd8/0x318 + [] inet_stream_connect+0x3e/0x68 + [] __sys_connect_file+0x50/0x88 + [] __sys_connect+0x96/0xc8 + [] __riscv_sys_connect+0x20/0x30 + [] do_trap_ecall_u+0x256/0x378 + [] handle_exception+0x14a/0x156 + Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 + ---[ end trace 0000000000000000 ]--- + +The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer +is treated as a 32bit value and sign extend to 64bit in epilogue. This +behavior is right for most bpf prog types but wrong for struct ops which +requires RISC-V ABI. + +So let's sign extend struct ops return values according to the function +model and RISC-V ABI([0]). + + [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf + +Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") +Signed-off-by: Hengqi Chen +Signed-off-by: Daniel Borkmann +Tested-by: Pu Lehui +Reviewed-by: Pu Lehui +Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com +Signed-off-by: Sasha Levin +--- + arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c +index 563425b4963c9..497945aa3e2c4 100644 +--- a/arch/riscv/net/bpf_jit_comp64.c ++++ b/arch/riscv/net/bpf_jit_comp64.c +@@ -559,6 +559,39 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64, + } + } + ++/* ++ * Sign-extend the register if necessary ++ */ ++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) ++{ ++ if (!sign && (sz == 1 || sz == 2)) { ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ return 0; ++ } ++ ++ switch (sz) { ++ case 1: ++ emit_sextb(rd, rs, ctx); ++ break; ++ case 2: ++ emit_sexth(rd, rs, ctx); ++ break; ++ case 4: ++ emit_sextw(rd, rs, ctx); ++ break; ++ case 8: ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ break; ++ default: ++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) + #define BPF_FIXUP_REG_MASK GENMASK(31, 27) + #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */ +@@ -1020,8 +1053,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); + + if (save_ret) { +- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); + emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); ++ if (is_struct_ops) { ++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, ++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); ++ if (ret) ++ goto out; ++ } else { ++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); ++ } + } + + emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); +-- +2.51.0 + diff --git a/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch b/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch new file mode 100644 index 0000000000..52a4e6efd1 --- /dev/null +++ b/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch @@ -0,0 +1,77 @@ +From 882dd701c2d8315a4578bc4c9e860b155f90a8e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:29 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL + +From: Ilya Leoshkevich + +[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ] + +The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is +as follows: + + entry() + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + +entry() copies its tail call counter to the subprog_tail()'s frame, +which then increments it. However, the incremented result is discarded, +leading to an astronomically large number of tail calls. + +Fix by writing the incremented counter back to the entry()'s frame. + +Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index ead8d9ba9032c..a88d53fe87743 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1775,13 +1775,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + jit->seen |= SEEN_FUNC; + /* + * Copy the tail call counter to where the callee expects it. +- * +- * Note 1: The callee can increment the tail call counter, but +- * we do not load it back, since the x86 JIT does not do this +- * either. +- * +- * Note 2: We assume that the verifier does not let us call the +- * main program, which clears the tail call counter on entry. + */ + /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */ + _EMIT6(0xd203f000 | STK_OFF_TCCNT, +@@ -1807,6 +1800,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + call_r1(jit); + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); ++ ++ /* ++ * Copy the potentially updated tail call counter back. ++ */ ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc frame_off+tail_call_cnt(%r15), ++ * tail_call_cnt(4,%r15) ++ */ ++ _EMIT6(0xd203f000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt)), ++ 0xf000 | offsetof(struct prog_frame, ++ tail_call_cnt)); ++ + break; + } + case BPF_JMP | BPF_TAIL_CALL: { +-- +2.51.0 + diff --git a/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch b/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch new file mode 100644 index 0000000000..0252b82d2f --- /dev/null +++ b/queue-6.12/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch @@ -0,0 +1,52 @@ +From d40209feea67fcabbea45b180dc3afdba8ba225b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:30 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG + +From: Ilya Leoshkevich + +[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ] + +The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call +graph is as follows: + + entry() + subprog_tail() + trampoline() + fentry() + the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG + return to entry() + +The problem is that the rest of subprog_tail() increments the tail call +counter, but the trampoline discards the incremented value. This +results in an astronomically large number of tail calls. + +Fix by making the trampoline write the incremented tail call counter +back. + +Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index a88d53fe87743..c15be6955cc7f 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -2808,6 +2808,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r2,retval_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, + tjit->retval_off); ++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ ++ _EMIT6(0xd203f000 | tjit->tccnt_off, ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + + im->ip_after_call = jit->prg_buf + jit->prg; + +-- +2.51.0 + diff --git a/queue-6.12/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.12/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..ca8bd7fd01 --- /dev/null +++ b/queue-6.12/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From 5424ec409e0b866c9440787877f17c68bed5c929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index d84413b77d849..421db8996927b 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-6.12/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.12/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..bfbd059cd8 --- /dev/null +++ b/queue-6.12/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From 8740cdd296352faab3fa0e00855d6d1ba74cdd81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 1469d0c54e455..5a02fd3bc6c9e 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-6.12/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.12/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..5b5c5a6605 --- /dev/null +++ b/queue-6.12/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From 416fb1857e72ed8b4c76261713abdb5a11d3827e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index a9d6dac413346..4daab8b6d6752 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.12/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..77b16b163b --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From 064c7c2d6b6b068a0232ba52bae5fa815e53dc2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index dcde55c8ee5de..be20e2c457b8e 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch b/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch new file mode 100644 index 0000000000..7ff9c930a0 --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch @@ -0,0 +1,39 @@ +From 0309c1683a97e979ad07857c64257e7dd10729ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:45 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + qla_nvme_xmt_ls_rsp() + +From: Qianfeng Rong + +[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ] + +Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to +align with qla2x00_start_sp() returning negative error codes or +QLA_SUCCESS, preventing logical errors. + +Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 8ee2e337c9e1b..316594aa40cc5 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(PURLS_MSLEEP_INTERVAL); + cnt++; + if (cnt < PURLS_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..9f53b0837d --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From 3d8d516328aba3be0673ede2383d8bc402767e6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 79cdfec2bca35..8bd4aa935e22b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-6.12/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.12/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch new file mode 100644 index 0000000000..c393868d37 --- /dev/null +++ b/queue-6.12/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch @@ -0,0 +1,78 @@ +From 80d0039f388e835a092856b3bedf0c0047327a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 18:31:18 +0200 +Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too + fast + +From: Johannes Nixdorf + +[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ] + +Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an +event to the tracer, and starts to wait interruptibly. With +SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the +message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting +and is subsequently interrupted, the tracee begins to wait again +uninterruptibly (but killable). + +This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee +is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a +condition to begin waiting again. In this case the tracee is interrupted +even though the tracer already acted on its behalf. This breaks the +assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, +namely that the tracer can be sure the syscall is not interrupted or +restarted on the tracee after it is received on the tracer. Fix this +by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to +switch to uninterruptible waiting. + +With the condition changed the loop in seccomp_do_user_notification() +would exit immediately after deciding that noninterruptible waiting +is required if the operation already reached SECCOMP_NOTIFY_REPLIED, +skipping the code that processes pending addfd commands first. Prevent +this by executing the remaining loop body one last time in this case. + +Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") +Reported-by: Ali Polatel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 +Signed-off-by: Johannes Nixdorf +Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + kernel/seccomp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 0cd1f8b5a102e..267b00005eaf2 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1124,7 +1124,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1171,13 +1171,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +-- +2.51.0 + diff --git a/queue-6.12/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.12/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..f1c501d3be --- /dev/null +++ b/queue-6.12/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From 5dda8fe41090378fc9be57bc413c1935eb7f8f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-6.12/selftests-nolibc-fix-expect_nz-macro.patch b/queue-6.12/selftests-nolibc-fix-expect_nz-macro.patch new file mode 100644 index 0000000000..bd8e0fa983 --- /dev/null +++ b/queue-6.12/selftests-nolibc-fix-expect_nz-macro.patch @@ -0,0 +1,42 @@ +From d3fb5db132f2c477077737ed00f76e5f673a5d7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 22:12:22 +0200 +Subject: selftests/nolibc: fix EXPECT_NZ macro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benjamin Berg + +[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ] + +The expect non-zero macro was incorrect and never used. Fix its +definition. + +Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests") +Signed-off-by: Benjamin Berg +Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index 6fba7025c5e3c..d73bff23c61e7 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen) + } + + +-#define EXPECT_NZ(cond, expr, val) \ +- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) ++#define EXPECT_NZ(cond, expr) \ ++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) + + static __attribute__((unused)) + int expect_nz(int expr, int llen) +-- +2.51.0 + diff --git a/queue-6.12/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch b/queue-6.12/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch new file mode 100644 index 0000000000..cd452ce49f --- /dev/null +++ b/queue-6.12/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch @@ -0,0 +1,79 @@ +From 87942a3c38219483b142cc85e39ae48f1bbce358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:02 +0200 +Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ] + +The _rval register variable is meant to be an output operand of the asm +statement but is instead used as input operand. +clang 20.1 notices this and triggers -Wuninitialized warnings: + +tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized] + 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL' + 59 | : "r" (_rval) \ + | ^~~~~ +tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here +tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL' + 47 | register long _rval asm ("r3"); \ + | ^ + +It seems the list of input and output operands have been switched around. +However as the argument registers are not always initialized they can not +be marked as pure inputs as that would trigger -Wuninitialized warnings. +Adding _rval as another input and output operand does also not work as it +would collide with the existing _r3 variable. + +Instead reuse _r3 for both the argument and the return value. + +Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc") +Reported-by: kernel test robot +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Reviewed-by: Christophe Leroy +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de +Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_call.h | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h +index bb237d771051b..e7205584cbdca 100644 +--- a/tools/testing/selftests/vDSO/vdso_call.h ++++ b/tools/testing/selftests/vDSO/vdso_call.h +@@ -44,7 +44,6 @@ + register long _r6 asm ("r6"); \ + register long _r7 asm ("r7"); \ + register long _r8 asm ("r8"); \ +- register long _rval asm ("r3"); \ + \ + LOADARGS_##nr(fn, args); \ + \ +@@ -54,13 +53,13 @@ + " bns+ 1f\n" \ + " neg 3, 3\n" \ + "1:" \ +- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \ ++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \ + "+r" (_r6), "+r" (_r7), "+r" (_r8) \ +- : "r" (_rval) \ ++ : \ + : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \ + "cr6", "cr7", "xer", "lr", "ctr", "memory" \ + ); \ +- _rval; \ ++ _r3; \ + }) + + #else +-- +2.51.0 + diff --git a/queue-6.12/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch b/queue-6.12/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch new file mode 100644 index 0000000000..84415d618a --- /dev/null +++ b/queue-6.12/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch @@ -0,0 +1,62 @@ +From 18023e10a99913d3b239788cc008dc1bbbfa3f26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:03 +0200 +Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with + missing vDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ] + +If AT_SYSINFO_EHDR is missing the whole test needs to be skipped. +Currently this results in the following output: + + TAP version 13 + 1..16 + # AT_SYSINFO_EHDR is not present! + +This output is incorrect, as "1..16" still requires the subtest lines to +be printed, which isn't done however. + +Switch to the correct skipping functions, so the output now correctly +indicates that no subtests are being run: + + TAP version 13 + 1..0 # SKIP AT_SYSINFO_EHDR is not present! + +Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c +index a54424e2336f4..67cbfc56e4e1b 100644 +--- a/tools/testing/selftests/vDSO/vdso_test_abi.c ++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c +@@ -182,12 +182,11 @@ int main(int argc, char **argv) + unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR); + + ksft_print_header(); +- ksft_set_plan(VDSO_TEST_PLAN); + +- if (!sysinfo_ehdr) { +- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n"); +- return KSFT_SKIP; +- } ++ if (!sysinfo_ehdr) ++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n"); ++ ++ ksft_set_plan(VDSO_TEST_PLAN); + + version = versions[VDSO_VERSION]; + name = (const char **)&names[VDSO_NAMES]; +-- +2.51.0 + diff --git a/queue-6.12/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.12/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..2a01d014a2 --- /dev/null +++ b/queue-6.12/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 159e675e06201f1c69991c9531a8a386d132e686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index a1f506ba55786..4f09c5db0c7f3 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-6.12/serial-max310x-add-error-checking-in-probe.patch b/queue-6.12/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..5396dbc66f --- /dev/null +++ b/queue-6.12/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From 6e0fd1aecd2510613741550bde4804877eee07ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 35369a2f77b29..2f8e3ea4fe128 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1641,6 +1641,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regcfg_i2c.name = max310x_regmap_name(i); + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..3b42b893cb --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,224 @@ +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +init-initramfs_preserve_mtime-should-depend-on-blk_d.patch +seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch +powerpc-8xx-remove-left-over-instruction-and-comment.patch +powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch +uprobes-uprobe_warn-should-use-passed-task.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +smb-server-fix-ird-ord-negotiation-with-the-client.patch +edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +lsm-config_lsm-can-depend-on-config_security.patch +btrfs-return-any-hit-error-from-extent_writepage_io.patch +pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch +arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +bpf-selftests-fix-test_tcpnotify_user.patch +bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch +libbpf-fix-reuse-of-devmap.patch +arm-dts-renesas-porter-fix-can-pin-group.patch +leds-flash-leds-qcom-flash-update-torch-current-clam.patch +s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch +s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +firmware-arm_scmi-mark-virtio-ready-before-registeri.patch +arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch +arm64-dts-imx93-kontron-fix-usb-port-assignment.patch +arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +arm-at91-pm-fix-mckx-restore-routine.patch +arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +selftests-nolibc-fix-expect_nz-macro.patch +leds-leds-lp55xx-use-correct-address-for-memory-prog.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +vdso-add-struct-__kernel_old_timeval-forward-declara.patch +arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch +arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch +arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch +pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch +power-supply-cw2015-fix-a-alignment-coding-style-iss.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +null_blk-fix-the-description-of-the-cache_size-modul.patch +selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch +selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch +arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch +nbd-restrict-sockets-to-tcp-and-udp.patch +pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch +cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch +arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch +arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch +mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch +arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch +arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch +pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch +pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +acpica-fix-largest-possible-resource-descriptor-inde.patch +riscv-bpf-sign-extend-struct-ops-return-values-prope.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +i3c-master-svc-use-manual-response-for-ibi-events.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +spi-fix-return-code-when-spi-device-has-too-many-chi.patch +bpf-mark-kfuncs-as-__noclone.patch +once-fix-race-by-moving-do_once-to-separate-section.patch +hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-fix-clock-issue-when-pm-is-disabled.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch +bpf-enforce-expected_attach_type-for-tailcall-compat.patch +drm-panel-novatek-nt35560-fix-invalid-return-value.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +f2fs-fix-condition-in-__allow_reserved_blocks.patch +drm-bridge-it6505-select-regmap_i2c.patch +media-zoran-remove-zoran_fh-structure.patch +phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch +serial-max310x-add-error-checking-in-probe.patch +drm-amd-display-remove-redundant-semicolons.patch +crypto-keembay-add-missing-check-after-sg_nents_for_.patch +hwrng-nomadik-add-arm_amba-dependency.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +crypto-octeontx2-call-strscpy-with-correct-size-argu.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch +rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch +pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +media-st-delta-avoid-excessive-stack-usage.patch +crypto-hisilicon-zip-remove-unnecessary-validation-f.patch +crypto-hisilicon-re-enable-address-prefetch-after-de.patch +crypto-hisilicon-qm-check-whether-the-input-function.patch +inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch +coresight-only-register-perf-symlink-for-sinks-with-.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch +drm-amd-pm-fix-si_upload_smc_data-v3.patch +drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch +drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch +drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch +drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +wifi-iwlwifi-remove-redundant-header-files.patch +idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +drm-msm-dpu-fix-incorrect-type-for-ret.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch +iio-consumers-fix-handling-of-negative-channel-scale.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +ipvs-use-read_once-write_once-for-ipvs-enable.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch +wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch +wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch +f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch +f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch +f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch +alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch +hid-hidraw-tighten-ioctl-command-parsing.patch +f2fs-fix-zero-sized-extent-for-precache-extents.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch +wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch +asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-31255 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27521 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16389 +vfio-pds-replace-bitmap_free-with-vfree.patch +crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch +rdma-rxe-fix-race-in-do_task-when-draining.patch +wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch +pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch +coresight-etm4x-conditionally-access-register-trcext.patch +coresight-tmc-support-atclk.patch +coresight-catu-support-atclk.patch +coresight-etm4x-support-atclk.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +coresight-tpda-fix-the-logic-to-setup-the-element-si.patch +coresight-fix-incorrect-handling-for-return-value-of.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch +pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch +pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch +iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +ptp-add-a-upper-bound-on-max_vclocks.patch +vhost-vringh-fix-copy_to_iter-return-value-check.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch +bluetooth-iso-free-rx_skb-if-not-consumed.patch +bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch +bluetooth-hci_sync-fix-using-random-address-for-big-.patch +keys-x.509-fix-basic-constraints-ca-flag-parsing.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch +pci-j721e-fix-incorrect-error-message-in-probe.patch +idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +net-mlx5-stop-polling-for-command-response-if-interf.patch +net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch +net-mlx5-fw-reset-add-reset-timeout-work.patch +smb-client-fix-crypto-buffers-in-non-linear-memory.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch +vhost-vringh-modify-the-return-value-check.patch +bpf-reject-negative-offsets-for-alu-ops.patch diff --git a/queue-6.12/smb-client-fix-crypto-buffers-in-non-linear-memory.patch b/queue-6.12/smb-client-fix-crypto-buffers-in-non-linear-memory.patch new file mode 100644 index 0000000000..8a87fde5d3 --- /dev/null +++ b/queue-6.12/smb-client-fix-crypto-buffers-in-non-linear-memory.patch @@ -0,0 +1,169 @@ +From f29d92a601356c5ed820971021bc18834b1e1bba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 12:10:33 -0300 +Subject: smb: client: fix crypto buffers in non-linear memory + +From: Enzo Matsumiya + +[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ] + +The crypto API, through the scatterlist API, expects input buffers to be +in linear memory. We handle this with the cifs_sg_set_buf() helper +that converts vmalloc'd memory to their corresponding pages. + +However, when we allocate our aead_request buffer (@creq in +smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly +puts aead_request->__ctx in vmalloc area. + +AEAD algorithm then uses ->__ctx for its private/internal data and +operations, and uses sg_set_buf() for such data on a few places. + +This works fine as long as @creq falls into kmalloc zone (small +requests) or vmalloc'd memory is still within linear range. + +Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too +many tasks will increment the base stacks' addresses to a point where +virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that +happens. + +In practice: too many parallel reads and writes on an encrypted mount +will trigger this bug. + +To fix this, always alloc @creq with kmalloc() instead. +Also drop the @sensitive_size variable/arguments since +kfree_sensitive() doesn't need it. + +Backtrace: + +[ 945.272081] ------------[ cut here ]------------ +[ 945.272774] kernel BUG at include/linux/scatterlist.h:209! +[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) +[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 +[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) +[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 +[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b +[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 +[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 +[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 +[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 +[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 +[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 +[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 +[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 +[ 945.286683] Call Trace: +[ 945.286952] +[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] +[ 945.287719] crypto_gcm_encrypt+0x36/0xe0 +[ 945.288152] crypt_message+0x54a/0xad0 [cifs] +[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] +[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] +[ 945.289944] cifs_call_async+0x178/0x340 [cifs] +[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] +[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] +[ 945.291759] ? find_held_lock+0x32/0x90 +[ 945.292212] ? netfs_advance_write+0xf2/0x310 +[ 945.292723] netfs_advance_write+0xf2/0x310 +[ 945.293210] netfs_write_folio+0x346/0xcc0 +[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 +[ 945.294250] netfs_writepages+0x117/0x460 +[ 945.294724] do_writepages+0xbe/0x170 +[ 945.295152] ? find_held_lock+0x32/0x90 +[ 945.295600] ? kvm_sched_clock_read+0x11/0x20 +[ 945.296103] __writeback_single_inode+0x56/0x4b0 +[ 945.296643] writeback_sb_inodes+0x229/0x550 +[ 945.297140] __writeback_inodes_wb+0x4c/0xe0 +[ 945.297642] wb_writeback+0x2f1/0x3f0 +[ 945.298069] wb_workfn+0x300/0x490 +[ 945.298472] process_one_work+0x1fe/0x590 +[ 945.298949] worker_thread+0x1ce/0x3c0 +[ 945.299397] ? __pfx_worker_thread+0x10/0x10 +[ 945.299900] kthread+0x119/0x210 +[ 945.300285] ? __pfx_kthread+0x10/0x10 +[ 945.300729] ret_from_fork+0x119/0x1b0 +[ 945.301163] ? __pfx_kthread+0x10/0x10 +[ 945.301601] ret_from_fork_asm+0x1a/0x30 +[ 945.302055] + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: Enzo Matsumiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index ab911a9672465..c946c3a09245c 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4223,7 +4223,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct sg_table *sgt, +- unsigned int *num_sgs, size_t *sensitive_size) ++ unsigned int *num_sgs) + { + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); +@@ -4240,9 +4240,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += array_size(*num_sgs, sizeof(struct scatterlist)); +- *sensitive_size = len; + +- p = kvzalloc(len, GFP_NOFS); ++ p = kzalloc(len, GFP_NOFS); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -4256,16 +4255,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + + static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, +- struct aead_request **req, struct scatterlist **sgl, +- size_t *sensitive_size) ++ struct aead_request **req, struct scatterlist **sgl) + { + struct sg_table sgtable = {}; + unsigned int skip, num_sgs, i, j; + ssize_t rc; + void *p; + +- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, +- &num_sgs, sensitive_size); ++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); + if (IS_ERR(p)) + return ERR_CAST(p); + +@@ -4354,7 +4351,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + DECLARE_CRYPTO_WAIT(wait); + unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; +- size_t sensitive_size; + + rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); + if (rc) { +@@ -4380,8 +4376,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + return rc; + } + +- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, +- &sensitive_size); ++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (IS_ERR(creq)) + return PTR_ERR(creq); + +@@ -4411,7 +4406,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + if (!rc && enc) + memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); + +- kvfree_sensitive(creq, sensitive_size); ++ kfree_sensitive(creq); + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.12/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.12/smb-server-fix-ird-ord-negotiation-with-the-client.patch new file mode 100644 index 0000000000..ace43f1117 --- /dev/null +++ b/queue-6.12/smb-server-fix-ird-ord-negotiation-with-the-client.patch @@ -0,0 +1,192 @@ +From a15bbd49a291ac140f978ab0e6526cc16098a403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 15:34:58 +0200 +Subject: smb: server: fix IRD/ORD negotiation with the client + +From: Stefan Metzmacher + +[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ] + +Already do real negotiation in smb_direct_handle_connect_request() +where we see the requested initiator_depth and responder_resources +from the client. + +We should detect legacy iwarp clients using MPA v1 +with the custom IRD/ORD negotiation. + +We need to send the custom IRD/ORD in big endian, +but we need to try to let clients with broken requests +using little endian (older cifs.ko) to work. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +Acked-by: Namjae Jeon +Cc: Steve French +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++----- + 1 file changed, 85 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index d059c890d1428..05dfef7ad67f5 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -152,6 +152,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.12/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.12/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..91b71019a9 --- /dev/null +++ b/queue-6.12/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From e2b4532ea3bdb7fbe1e24f027bd271ea21ab5112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index f25e20617b7eb..fa6faf50fb43b 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -891,16 +891,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch b/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch new file mode 100644 index 0000000000..3e1fa24afa --- /dev/null +++ b/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch @@ -0,0 +1,79 @@ +From 1ac3e8e688347874959b77a24e723260b597ac35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:50 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure + +From: Johan Hovold + +[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index 9a91298c12539..cf9f5e6af6472 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2167,6 +2167,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp, + return dev; + } + ++static void svs_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; +@@ -2218,11 +2225,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + dev = svs_add_device_link(svsp, "thermal-sensor"); + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get thermal device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2232,6 +2241,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2248,6 +2258,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch b/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch new file mode 100644 index 0000000000..1a10ba6355 --- /dev/null +++ b/queue-6.12/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch @@ -0,0 +1,67 @@ +From add5c99117f55dd9518af0a6f7f25dda53e5f3a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:51 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure + +From: Johan Hovold + +[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index cf9f5e6af6472..4cb8169aec6b5 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2178,6 +2178,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst"); + if (IS_ERR(svsp->rst)) +@@ -2188,6 +2189,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get lvts device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2197,6 +2199,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2216,6 +2219,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.12/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..acb0916630 --- /dev/null +++ b/queue-6.12/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From d8f1deb29c7ba3dd161ddde0d991fa57d21fe26e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 641f29a98cbd2..cc72a31a450e4 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); +-- +2.51.0 + diff --git a/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..ff56395cde --- /dev/null +++ b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 5797865b0a49b466297f01aec4f0fac88afd4dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index 635398ec7540e..154fbd35400ca 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16389 b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16389 new file mode 100644 index 0000000000..8c0298efae --- /dev/null +++ b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16389 @@ -0,0 +1,112 @@ +From 5f032eef236826ebc7940e26b1e0dcd463881915 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27521 b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27521 new file mode 100644 index 0000000000..3269e50400 --- /dev/null +++ b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27521 @@ -0,0 +1,111 @@ +From 94f59ff2e43e43713c5e997f468dc2893ed753a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894..bbd3ea0a64822 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-31255 b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-31255 new file mode 100644 index 0000000000..2b3f7da3a3 --- /dev/null +++ b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-31255 @@ -0,0 +1,67 @@ +From afc36dc0a5791c80ec89254ef030457e4c7b028b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..1a169556a8 --- /dev/null +++ b/queue-6.12/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From 5d9a544bd9f8ec6f0ee9dd253754dcbd75d7e07a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-6.12/spi-fix-return-code-when-spi-device-has-too-many-chi.patch b/queue-6.12/spi-fix-return-code-when-spi-device-has-too-many-chi.patch new file mode 100644 index 0000000000..2ff5ab9c68 --- /dev/null +++ b/queue-6.12/spi-fix-return-code-when-spi-device-has-too-many-chi.patch @@ -0,0 +1,36 @@ +From d8318879df80e1feabfb290c63998f7ae348b93f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 20:37:19 +0200 +Subject: spi: fix return code when spi device has too many chipselects + +From: Jonas Gorski + +[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ] + +Don't return a positive value when there are too many chipselects. + +Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core") +Signed-off-by: Jonas Gorski +Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 8d6341b0d8668..5ad9f4a2148fa 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2462,7 +2462,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + if (rc > ctlr->num_chipselect) { + dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n", + nc, rc); +- return rc; ++ return -EINVAL; + } + if ((of_property_read_bool(nc, "parallel-memories")) && + (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) { +-- +2.51.0 + diff --git a/queue-6.12/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.12/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..88a9720df6 --- /dev/null +++ b/queue-6.12/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From 1146b9ce7f5b4f82f4b5254f49d372b5099a3256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 988992ff898b3..739931aabb4e3 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3058,8 +3058,8 @@ bool tcp_check_oom(const struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -3078,11 +3078,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-6.12/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.12/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..c4893955aa --- /dev/null +++ b/queue-6.12/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From 4b4fe08ae99def1f98e63cab8f2d64adc227132f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index d2d49264cf83a..7c299184c59b1 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.12/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.12/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..4287ae37cb --- /dev/null +++ b/queue-6.12/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From dfaa57dc93ee61478a3df701afa5b650af021171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebb..a6bb01082ec69 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-6.12/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.12/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..c31ac12df0 --- /dev/null +++ b/queue-6.12/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From 53b73dd411a4230aa47babd03fc521e25db8bbb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index a9d8b5b51f37f..f24953f8b949c 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -33,6 +33,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-6.12/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch b/queue-6.12/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch new file mode 100644 index 0000000000..6d779bdb7e --- /dev/null +++ b/queue-6.12/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch @@ -0,0 +1,82 @@ +From 4d2559254777f5d2c0d7c20dc80e4c670b88d7d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:26:56 +0300 +Subject: tty: n_gsm: Don't block input queue by waiting MSC + +From: Seppo Takalo + +[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ] + +Currently gsm_queue() processes incoming frames and when opening +a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). +If basic mode is used it calls gsm_modem_upd_via_msc() and it +cannot block the input queue by waiting the response to come +into the same input queue. + +Instead allow sending Modem Status Command without waiting for remote +end to respond. Define a new function gsm_modem_send_initial_msc() +for this purpose. As MSC is only valid for basic encoding, it does +not do anything for advanced or when convergence layer type 2 is used. + +Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") +Signed-off-by: Seppo Takalo +Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 252849910588f..c917fc20b469a 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); + static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); + static void gsmld_write_trigger(struct gsm_mux *gsm); + static void gsmld_write_task(struct work_struct *work); ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); + + /** + * gsm_fcs_add - update FCS +@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + pr_debug("DLCI %d goes open.\n", dlci->addr); + /* Send current modem state */ + if (dlci->addr) { +- gsm_modem_update(dlci, 0); ++ gsm_modem_send_initial_msc(dlci); + } else { + /* Start keep-alive control */ + gsm->ka_num = 0; +@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) + return gsm_control_wait(dlci->gsm, ctrl); + } + ++/** ++ * gsm_modem_send_initial_msc - Send initial modem status message ++ * ++ * @dlci channel ++ * ++ * Send an initial MSC message after DLCI open to set the initial ++ * modem status lines. This is only done for basic mode. ++ * Does not wait for a response as we cannot block the input queue ++ * processing. ++ */ ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) ++{ ++ u8 modembits[2]; ++ ++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) ++ return 0; ++ ++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ ++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; ++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); ++} ++ + /** + * gsm_modem_update - send modem status line state + * @dlci: channel +-- +2.51.0 + diff --git a/queue-6.12/uprobes-uprobe_warn-should-use-passed-task.patch b/queue-6.12/uprobes-uprobe_warn-should-use-passed-task.patch new file mode 100644 index 0000000000..de7997e454 --- /dev/null +++ b/queue-6.12/uprobes-uprobe_warn-should-use-passed-task.patch @@ -0,0 +1,40 @@ +From f16ae291793d1688d90052cede179a0152b1139e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 22:34:21 -0500 +Subject: uprobes: uprobe_warn should use passed task + +From: Jeremy Linton + +[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ] + +uprobe_warn() is passed a task structure, yet its using current. For +the most part this shouldn't matter, but since a task structure is +provided, lets use it. + +Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances") +Signed-off-by: Jeremy Linton +Reviewed-by: Catalin Marinas +Acked-by: Oleg Nesterov +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index e60f5e71e35df..c00981cc6fe5b 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -114,7 +114,7 @@ struct xol_area { + + static void uprobe_warn(struct task_struct *t, const char *msg) + { +- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg); ++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg); + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.12/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..6b510584c1 --- /dev/null +++ b/queue-6.12/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From b9abbc6b2aa3025b65dcb95246878a8aea822045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 1b4d0056f1d08..82282373c786b 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-6.12/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.12/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..42ea284c2a --- /dev/null +++ b/queue-6.12/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From d240572cf9bfbbcc4117df554606280b4b0779ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index dcf31a592f5d1..4b5f03f683f77 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-6.12/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch b/queue-6.12/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch new file mode 100644 index 0000000000..1ad4605fc1 --- /dev/null +++ b/queue-6.12/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch @@ -0,0 +1,143 @@ +From 6ea40cd492c5408c21d36f63fe4a949450e55690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:31:32 +0530 +Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls + +From: Komal Bajaj + +[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ] + +EUD_MODE_MANAGER2 register is mapped to a memory region that is marked +as read-only for operating system running at EL1, enforcing access +restrictions that prohibit direct memory-mapped writes via writel(). + +Attempts to write to this region from HLOS can result in silent failures +or memory access violations, particularly when toggling EUD (Embedded +USB Debugger) state. To ensure secure register access, modify the driver +to use qcom_scm_io_writel(), which routes the write operation to Qualcomm +Secure Channel Monitor (SCM). SCM has the necessary permissions to access +protected memory regions, enabling reliable control over EUD state. + +SC7280, the only user of EUD is also affected, indicating that this could +never have worked on a properly fused device. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Signed-off-by: Melody Olvera +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Souradeep Chowdhury +Signed-off-by: Komal Bajaj +Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/Kconfig | 1 + + drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++--------- + 2 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig +index 6497c4e81e951..9bf8fc6247bac 100644 +--- a/drivers/usb/misc/Kconfig ++++ b/drivers/usb/misc/Kconfig +@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY + config USB_QCOM_EUD + tristate "QCOM Embedded USB Debugger(EUD) Driver" + depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + select USB_ROLE_SWITCH + help + This module enables support for Qualcomm Technologies, Inc. +diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c +index 19906301a4eb8..012e3b9d9bcc8 100644 +--- a/drivers/usb/misc/qcom_eud.c ++++ b/drivers/usb/misc/qcom_eud.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define EUD_REG_INT1_EN_MASK 0x0024 + #define EUD_REG_INT_STATUS_1 0x0044 +@@ -34,7 +35,7 @@ struct eud_chip { + struct device *dev; + struct usb_role_switch *role_sw; + void __iomem *base; +- void __iomem *mode_mgr; ++ phys_addr_t mode_mgr; + unsigned int int_status; + int irq; + bool enabled; +@@ -43,18 +44,29 @@ struct eud_chip { + + static int enable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); ++ if (ret) ++ return ret; ++ + writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); + writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, + priv->base + EUD_REG_INT1_EN_MASK); +- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); + + return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); + } + +-static void disable_eud(struct eud_chip *priv) ++static int disable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); ++ if (ret) ++ return ret; ++ + writel(0, priv->base + EUD_REG_CSR_EUD_EN); +- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); ++ return 0; + } + + static ssize_t enable_show(struct device *dev, +@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, + chip->enabled = enable; + else + disable_eud(chip); ++ + } else { +- disable_eud(chip); ++ ret = disable_eud(chip); + } + +- return count; ++ return ret < 0 ? ret : count; + } + + static DEVICE_ATTR_RW(enable); +@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) + static int eud_probe(struct platform_device *pdev) + { + struct eud_chip *chip; ++ struct resource *res; + int ret; + + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); +@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) + if (IS_ERR(chip->base)) + return PTR_ERR(chip->base); + +- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(chip->mode_mgr)) +- return PTR_ERR(chip->mode_mgr); ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -ENODEV; ++ chip->mode_mgr = res->start; + + chip->irq = platform_get_irq(pdev, 0); + if (chip->irq < 0) +-- +2.51.0 + diff --git a/queue-6.12/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.12/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..43aa0ec806 --- /dev/null +++ b/queue-6.12/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From 8e78447426577abca3fba619f130301389ffa4f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index da09cff55abce..0e732cd53b629 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-6.12/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.12/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..901f1914d3 --- /dev/null +++ b/queue-6.12/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From bce4126a9fcec9bb7fc760d6680699bcc5f6911e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 8dac1edc74d4e..a793e30d46b78 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-6.12/vdso-add-struct-__kernel_old_timeval-forward-declara.patch b/queue-6.12/vdso-add-struct-__kernel_old_timeval-forward-declara.patch new file mode 100644 index 0000000000..b1885b54d1 --- /dev/null +++ b/queue-6.12/vdso-add-struct-__kernel_old_timeval-forward-declara.patch @@ -0,0 +1,42 @@ +From a65ec2a88cb9eb206642a8833c8240a55e8ab573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:41:10 +0200 +Subject: vdso: Add struct __kernel_old_timeval forward declaration to + gettime.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ] + +The prototype of __vdso_gettimeofday() uses this struct. However +gettime.h's own includes do not provide a definition for it. + +Add a forward declaration, similar to other used structs. + +Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de +Signed-off-by: Sasha Levin +--- + include/vdso/gettime.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h +index c50d152e7b3e0..9ac161866653a 100644 +--- a/include/vdso/gettime.h ++++ b/include/vdso/gettime.h +@@ -5,6 +5,7 @@ + #include + + struct __kernel_timespec; ++struct __kernel_old_timeval; + struct timezone; + + #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64) +-- +2.51.0 + diff --git a/queue-6.12/vfio-pds-replace-bitmap_free-with-vfree.patch b/queue-6.12/vfio-pds-replace-bitmap_free-with-vfree.patch new file mode 100644 index 0000000000..bb786ae378 --- /dev/null +++ b/queue-6.12/vfio-pds-replace-bitmap_free-with-vfree.patch @@ -0,0 +1,43 @@ +From 8b65358592cb378c787031510cce28f8f6b3fba7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 15:31:54 +0000 +Subject: vfio/pds: replace bitmap_free with vfree + +From: Zilin Guan + +[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ] + +host_seq_bmp is allocated with vzalloc but is currently freed with +bitmap_free, which uses kfree internally. This mismach prevents the +resource from being released properly and may result in memory leaks +or other issues. + +Fix this by freeing host_seq_bmp with vfree to match the vzalloc +allocation. + +Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") +Signed-off-by: Zilin Guan +Reviewed-by: Brett Creeley +Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/dirty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c +index c51f5e4c3dd6d..481992142f790 100644 +--- a/drivers/vfio/pci/pds/dirty.c ++++ b/drivers/vfio/pci/pds/dirty.c +@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region, + + host_ack_bmp = vzalloc(bytes); + if (!host_ack_bmp) { +- bitmap_free(host_seq_bmp); ++ vfree(host_seq_bmp); + return -ENOMEM; + } + +-- +2.51.0 + diff --git a/queue-6.12/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.12/vhost-vringh-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..3935c55ebb --- /dev/null +++ b/queue-6.12/vhost-vringh-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,53 @@ +From 3c9d4bf59785f0281c52c9e53cb7abcc7bed2535 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:04:08 -0400 +Subject: vhost: vringh: Fix copy_to_iter return value check + +From: Michael S. Tsirkin + +[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ] + +The return value of copy_to_iter can't be negative, check whether the +copied length is equal to the requested length instead of checking for +negative values. + +Cc: zhang jiao +Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Simon Horman +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 73e153f9b4495..0db4f3babe961 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.12/vhost-vringh-modify-the-return-value-check.patch b/queue-6.12/vhost-vringh-modify-the-return-value-check.patch new file mode 100644 index 0000000000..8af37cf904 --- /dev/null +++ b/queue-6.12/vhost-vringh-modify-the-return-value-check.patch @@ -0,0 +1,50 @@ +From f77aead14f84cbba197fce4dcf131ae11dc60c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:17:38 +0800 +Subject: vhost: vringh: Modify the return value check + +From: zhang jiao + +[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ] + +The return value of copy_from_iter and copy_to_iter can't be negative, +check whether the copied lengths are equal. + +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Cc: "Stefano Garzarella" +Signed-off-by: zhang jiao +Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 0db4f3babe961..781731eb95cfe 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.12/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.12/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..b077e4654a --- /dev/null +++ b/queue-6.12/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 5343f2487b361e0b4b473bf9c597450545c83651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 867f9f3113797..a4b497ecfa205 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.12/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..bee43558f3 --- /dev/null +++ b/queue-6.12/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From bbb0df5ec09deab540c52bb013f4d3c4cac7a280 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 09066e6aca402..fdab67a56e438 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-6.12/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch b/queue-6.12/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch new file mode 100644 index 0000000000..ece9093379 --- /dev/null +++ b/queue-6.12/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch @@ -0,0 +1,53 @@ +From 27ea6ac357d8495f5ee4c5c339ae7d3b06eb4179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 09:44:57 +0800 +Subject: wifi: ath12k: fix wrong logging ID used for CE + +From: Baochen Qiang + +[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ] + +ATH12K_DBG_AHB is used for CE logging which is not proper. Add +ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it. + +Compile tested only. + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/ce.c | 2 +- + drivers/net/wireless/ath/ath12k/debug.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c +index b66d23d6b2bd9..bd21e8fe9c90b 100644 +--- a/drivers/net/wireless/ath/ath12k/ce.c ++++ b/drivers/net/wireless/ath/ath12k/ce.c +@@ -388,7 +388,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe) + } + + while ((skb = __skb_dequeue(&list))) { +- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n", ++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n", + pipe->pipe_num, skb->len); + pipe->recv_cb(ab, skb); + } +diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h +index f7005917362c6..ea711e02ca03c 100644 +--- a/drivers/net/wireless/ath/ath12k/debug.h ++++ b/drivers/net/wireless/ath/ath12k/debug.h +@@ -26,6 +26,7 @@ enum ath12k_debug_mask { + ATH12K_DBG_DP_TX = 0x00002000, + ATH12K_DBG_DP_RX = 0x00004000, + ATH12K_DBG_WOW = 0x00008000, ++ ATH12K_DBG_CE = 0x00010000, + ATH12K_DBG_ANY = 0xffffffff, + }; + +-- +2.51.0 + diff --git a/queue-6.12/wifi-iwlwifi-remove-redundant-header-files.patch b/queue-6.12/wifi-iwlwifi-remove-redundant-header-files.patch new file mode 100644 index 0000000000..fb02798898 --- /dev/null +++ b/queue-6.12/wifi-iwlwifi-remove-redundant-header-files.patch @@ -0,0 +1,36 @@ +From c7a40804870e1e14c7697323417fc3738b23b191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 20:11:51 +0800 +Subject: wifi: iwlwifi: Remove redundant header files + +From: Liao Yuanhong + +[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ] + +The header file "fw/img.h" is already included on line 9. Remove the +redundant include. + +Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") +Signed-off-by: Liao Yuanhong +Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com +Signed-off-by: Miri Korenblit +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +index 81787501d4a4f..11704163876b8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +@@ -12,7 +12,6 @@ + #include "fw/api/phy.h" + #include "fw/api/config.h" + #include "fw/api/nvm-reg.h" +-#include "fw/img.h" + #include "iwl-trans.h" + + #define BIOS_SAR_MAX_PROFILE_NUM 4 +-- +2.51.0 + diff --git a/queue-6.12/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.12/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch new file mode 100644 index 0000000000..7539b12bf0 --- /dev/null +++ b/queue-6.12/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch @@ -0,0 +1,87 @@ +From c3c1f5439a932172a2503bb40d0dd07c43bec3c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 12:42:03 +0530 +Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not + available + +From: Aditya Kumar Singh + +[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ] + +In ieee80211_rx_handle_packet(), if the caller does not provide pubsta +information, an attempt is made to find the station using the address 2 +(source address) field in the header. Since pubsta is missing, link +information such as link_valid and link_id is also unavailable. Now if such +a situation comes, and if a matching ML station entry is found based on +the source address, currently the packet is dropped due to missing link ID +in the status field which is not correct. + +Hence, to fix this issue, if link_valid is not set and the station is an +ML station, make an attempt to find a link station entry using the source +address. If a valid link station is found, derive the link ID and proceed +with packet processing. Otherwise, drop the packet as per the existing +flow. + +Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") +Suggested-by: Vasanthakumar Thiagarajan +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 8c0d91dfd7e2b..538c6eea645f2 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5280,12 +5280,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5293,10 +5301,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +-- +2.51.0 + diff --git a/queue-6.12/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.12/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..38319d3ce2 --- /dev/null +++ b/queue-6.12/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From de3cb7769487b3a645e125212df50fb9c1eb36b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ec02148a7f1f7..2ee8a6e1e310e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch b/queue-6.12/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch new file mode 100644 index 0000000000..9e2098ab30 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch @@ -0,0 +1,132 @@ +From a723d3010734596fd645b594c3db835cbf0ef9c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 14:48:24 +0800 +Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration + +From: Zhi-Jun You + +[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ] + +In vendor driver, size of group cal and dpd cal for mt7981 includes 6G +although the chip doesn't support it. + +mt76 doesn't take this into account which results in reading from the +incorrect offset. + +For devices with precal, this would lead to lower bitrate. + +Fix this by aligning groupcal size with vendor driver and switch to +freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset. + +Below are iwinfo of the test device with two clients connected +(iPhone 16, Intel AX210). +Before : + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 612.4 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +After: + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 900.6 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +Tested-on: mt7981 20240823 + +Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration") +Signed-off-by: Zhi-Jun You +Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++-- + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++-------------- + 2 files changed, 10 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +index 509fb43d8a688..2908e8113e48a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +@@ -50,9 +50,9 @@ enum mt7915_eeprom_field { + #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16) ++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT) + #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT) +-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */ + + #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0) + #define MT_EE_WIFI_CONF0_BAND_SEL GENMASK(7, 6) +@@ -179,6 +179,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev) + val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val); + return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G : + MT_EE_CAL_GROUP_SIZE_7916; ++ } else if (is_mt7981(&dev->mt76)) { ++ return MT_EE_CAL_GROUP_SIZE_7981; + } else if (mt7915_check_adie(dev, false)) { + return MT_EE_CAL_GROUP_SIZE_7976; + } else { +@@ -191,8 +193,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev) + { + if (is_mt7915(&dev->mt76)) + return MT_EE_CAL_DPD_SIZE_V1; +- else if (is_mt7981(&dev->mt76)) +- return MT_EE_CAL_DPD_SIZE_V2_7981; + else + return MT_EE_CAL_DPD_SIZE_V2; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 3398c25cb03c0..7b481aea76b6c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -3004,30 +3004,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw) + /* 5G BW160 */ + 5250, 5570, 5815 + }; +- static const u16 freq_list_v2_7981[] = { +- /* 5G BW20 */ +- 5180, 5200, 5220, 5240, +- 5260, 5280, 5300, 5320, +- 5500, 5520, 5540, 5560, +- 5580, 5600, 5620, 5640, +- 5660, 5680, 5700, 5720, +- 5745, 5765, 5785, 5805, +- 5825, 5845, 5865, 5885, +- /* 5G BW160 */ +- 5250, 5570, 5815 +- }; +- const u16 *freq_list = freq_list_v1; +- int n_freqs = ARRAY_SIZE(freq_list_v1); +- int idx; ++ const u16 *freq_list; ++ int idx, n_freqs; + + if (!is_mt7915(&dev->mt76)) { +- if (is_mt7981(&dev->mt76)) { +- freq_list = freq_list_v2_7981; +- n_freqs = ARRAY_SIZE(freq_list_v2_7981); +- } else { +- freq_list = freq_list_v2; +- n_freqs = ARRAY_SIZE(freq_list_v2); +- } ++ freq_list = freq_list_v2; ++ n_freqs = ARRAY_SIZE(freq_list_v2); ++ } else { ++ freq_list = freq_list_v1; ++ n_freqs = ARRAY_SIZE(freq_list_v1); + } + + if (freq < 4000) { +-- +2.51.0 + diff --git a/queue-6.12/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch b/queue-6.12/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch new file mode 100644 index 0000000000..73c05a88a1 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch @@ -0,0 +1,95 @@ +From 121d8855b5543ac3b9e8adb0b499d6a7c565b656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:19 +0200 +Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE + +From: Lorenzo Bianconi + +[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ] + +Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not +break endianness + +Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++--- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------ + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index c550385541143..91b7d35bdb431 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -679,6 +679,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev) + static int mt7996_wed_rro_init(struct mt7996_dev *dev) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mtk_wed_device *wed = &dev->mt76.mmio.wed; + u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0; + struct mt7996_wed_rro_addr *addr; +@@ -718,7 +719,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + + addr = dev->wed_rro.addr_elem[i].ptr; + for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -736,7 +737,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + dev->wed_rro.session.ptr = ptr; + addr = dev->wed_rro.session.ptr; + for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -836,6 +837,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev) + static void mt7996_wed_rro_work(struct work_struct *work) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mt7996_dev *dev; + LIST_HEAD(list); + +@@ -872,7 +874,7 @@ static void mt7996_wed_rro_work(struct work_struct *work) + MT7996_RRO_WINDOW_MAX_LEN; + reset: + elem = ptr + elem_id * sizeof(*elem); +- elem->signature = 0xff; ++ elem->data |= cpu_to_le32(val); + } + mt7996_mcu_wed_rro_reset_sessions(dev, e->id); + out: +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index 425fd030bee00..29e7289c3a169 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -194,13 +194,12 @@ struct mt7996_hif { + int irq; + }; + ++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24) ++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4) ++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0) + struct mt7996_wed_rro_addr { +- u32 head_low; +- u32 head_high : 4; +- u32 count: 11; +- u32 oor: 1; +- u32 rsv : 8; +- u32 signature : 8; ++ __le32 head_low; ++ __le32 data; + }; + + struct mt7996_wed_rro_session_id { +-- +2.51.0 + diff --git a/queue-6.12/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch b/queue-6.12/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch new file mode 100644 index 0000000000..894dc05389 --- /dev/null +++ b/queue-6.12/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch @@ -0,0 +1,46 @@ +From 2ad41f05a85f52d126fcedea49cad0826620f719 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:17 +0200 +Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED + device + +From: Lorenzo Bianconi + +[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ] + +In order to properly set the number of rx packets for primary WED device +if hif device is available, move hif pointer initialization before +running mt7996_mmio_wed_init routine. + +Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +index 04056181368a6..dbd05612f2e4a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +@@ -132,6 +132,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + mdev = &dev->mt76; + mt7996_wfsys_reset(dev); + hif2 = mt7996_pci_init_hif2(pdev); ++ dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, pdev, false, &irq); + if (ret < 0) +@@ -156,7 +157,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + + if (hif2) { + hif2_dev = container_of(hif2->dev, struct pci_dev, dev); +- dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.12/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.12/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..e50a2d6a4a --- /dev/null +++ b/queue-6.12/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From b40b51f4a25242bf891592c905823ae9c16fa007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 59bea82eab294..8801b93eacd42 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-6.12/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.12/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch new file mode 100644 index 0000000000..5845879141 --- /dev/null +++ b/queue-6.12/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch @@ -0,0 +1,149 @@ +From d846e3904ba53e5f5b6fd8dc6365e524ca1b93a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:50 +0300 +Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run() + +From: Fedor Pchelkin + +[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ] + +Lockdep gives a splat [1] when ser_hdl_work item is executed. It is +scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a +wiphy lock inside. However, this workqueue can be flushed when e.g. +closing the interface and wiphy lock is already taken in that case. + +Choosing wiphy_work_queue() for SER is likely not suitable. Back on to +the global workqueue. + +[1]: + + WARNING: possible circular locking dependency detected + 6.17.0-rc2 #17 Not tainted + ------------------------------------------------------ + kworker/u32:1/61 is trying to acquire lock: + ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] + + but task is already holding lock: + ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: + process_one_work+0x7c6/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + -> #1 ((wq_completion)phy0){+.+.}-{0:0}: + touch_wq_lockdep_map+0x8e/0x180 + __flush_workqueue+0x129/0x10d0 + ieee80211_stop_device+0xa8/0x110 + ieee80211_do_stop+0x14ce/0x2880 + ieee80211_stop+0x13a/0x2c0 + __dev_close_many+0x18f/0x510 + __dev_change_flags+0x25f/0x670 + netif_change_flags+0x7b/0x160 + do_setlink.isra.0+0x1640/0x35d0 + rtnl_newlink+0xd8c/0x1d30 + rtnetlink_rcv_msg+0x700/0xb80 + netlink_rcv_skb+0x11d/0x350 + netlink_unicast+0x49a/0x7a0 + netlink_sendmsg+0x759/0xc20 + ____sys_sendmsg+0x812/0xa00 + ___sys_sendmsg+0xf7/0x180 + __sys_sendmsg+0x11f/0x1b0 + do_syscall_64+0xbb/0x360 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + other info that might help us debug this: + + Chain exists of: + &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&ser->ser_hdl_work)); + lock((wq_completion)phy0); + lock((work_completion)(&ser->ser_hdl_work)); + lock(&rdev->wiphy.mtx); + + *** DEADLOCK *** + + 2 locks held by kworker/u32:1/61: + #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 + #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + stack backtrace: + CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 + Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] + Call Trace: + + dump_stack_lvl+0x5d/0x80 + print_circular_bug.cold+0x178/0x1be + check_noncircular+0x14c/0x170 + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index c0f0e3d71f5f5..2a303a758e276 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.12/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..06a54f21f2 --- /dev/null +++ b/queue-6.12/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 4fdb37f55bfcdf6eb333fa96705c87e60c0d768b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 9d6411c659205..00cefbb59fa98 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch b/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch new file mode 100644 index 0000000000..d56ac970a9 --- /dev/null +++ b/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch @@ -0,0 +1,60 @@ +From 26e5a0102eafd8515f8836d038658e4a1306ed5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:39:17 +0800 +Subject: accel/amdxdna: Use int instead of u32 to store error codes + +From: Qianfeng Rong + +[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ] + +Change the 'ret' variable from u32 to int to store -EINVAL. Storing the +negative error codes in unsigned type, doesn't cause an issue at runtime +but it's ugly as pants. + +Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may +trigger a GCC warning when the -Wsign-conversion flag is enabled. + +Fixes: aac243092b70 ("accel/amdxdna: Add command execution") +Signed-off-by: Qianfeng Rong +Reviewed-by: Lizhi Hou +Signed-off-by: Lizhi Hou +Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/aie2_ctx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c +index e04549f64d69e..842cf1f0aa1be 100644 +--- a/drivers/accel/amdxdna/aie2_ctx.c ++++ b/drivers/accel/amdxdna/aie2_ctx.c +@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size) + { + struct amdxdna_sched_job *job = handle; + struct amdxdna_gem_obj *cmd_abo; +- u32 ret = 0; ++ int ret = 0; + u32 status; + + cmd_abo = job->cmd_bo; +@@ -222,7 +222,7 @@ static int + aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size) + { + struct amdxdna_sched_job *job = handle; +- u32 ret = 0; ++ int ret = 0; + u32 status; + + if (unlikely(!data)) +@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size) + u32 fail_cmd_status; + u32 fail_cmd_idx; + u32 cmd_status; +- u32 ret = 0; ++ int ret = 0; + + cmd_abo = job->cmd_bo; + if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) { +-- +2.51.0 + diff --git a/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..0074223e6c --- /dev/null +++ b/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From e23e2ecdbad769c07b99656570daaf0d689d745d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index ae035b93da087..3eb56b77cb6d9 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..3e98805146 --- /dev/null +++ b/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From 593c49ce0932512d12f64858e203183fa1bfa5e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 2c2dc559e0f8d..d0fc045a8d310 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-6.16/acpica-apply-acpi_nonstring.patch b/queue-6.16/acpica-apply-acpi_nonstring.patch new file mode 100644 index 0000000000..e32119b6b5 --- /dev/null +++ b/queue-6.16/acpica-apply-acpi_nonstring.patch @@ -0,0 +1,63 @@ +From 50c5564fc569e31f1fb8d9823142cc62c2735123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 21:55:35 +0200 +Subject: ACPICA: Apply ACPI_NONSTRING + +From: Ahmed Salem + +[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ] + +Add ACPI_NONSTRING for destination char arrays without a terminating NUL +character. + +This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") +where a few more destination arrays were missed. + +Link: https://github.com/acpica/acpica/commit/f359e5ed +Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") +Signed-off-by: Ahmed Salem +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/acpi/actbl.h | 2 +- + tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h +index 243097a3da636..8a67d4ea6e3fe 100644 +--- a/include/acpi/actbl.h ++++ b/include/acpi/actbl.h +@@ -73,7 +73,7 @@ struct acpi_table_header { + char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM identification */ + char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM table identification */ + u32 oem_revision; /* OEM revision number */ +- char asl_compiler_id[ACPI_NAMESEG_SIZE]; /* ASCII ASL compiler vendor ID */ ++ char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; /* ASCII ASL compiler vendor ID */ + u32 asl_compiler_revision; /* ASL compiler version */ + }; + +diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c +index 9741e7503591c..de93067a5da32 100644 +--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c ++++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c +@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory) + { + void *table_dir; + u32 instance; +- char temp_name[ACPI_NAMESEG_SIZE]; ++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; + char *filename; + acpi_status status = AE_OK; + +@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname, + { + void *table_dir; + u32 current_instance = 0; +- char temp_name[ACPI_NAMESEG_SIZE]; ++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; + char table_filename[PATH_MAX]; + char *filename; + acpi_status status; +-- +2.51.0 + diff --git a/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch b/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch new file mode 100644 index 0000000000..a25697d734 --- /dev/null +++ b/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch @@ -0,0 +1,42 @@ +From 9c0b93aed4ff35ccbbd2ac767cbd5f8b441f0d10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 22:03:16 +0200 +Subject: ACPICA: Fix largest possible resource descriptor index + +From: Dmitry Antipov + +[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ] + +ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually +used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). + +Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be +clamped incorrectly and resulting value may issue an out-of-bounds +access for 'acpi_gbl_resource_types' array. Compile tested only. + +Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") +Link: https://github.com/acpica/acpica/commit/cf00116c +Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 +Signed-off-by: Dmitry Antipov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/aclocal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 0c41f0097e8d7..f98640086f4ef 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -1141,7 +1141,7 @@ struct acpi_port_info { + #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 + #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 + #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 +-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 ++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 + + /***************************************************************************** + * +-- +2.51.0 + diff --git a/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..8e2f22bb6f --- /dev/null +++ b/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From 9872975a5204d7aeb1e0be40a8ac443a35c2d5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index 9d95ecb299aed..a99acd1125e74 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch b/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch new file mode 100644 index 0000000000..4c8c2d3d48 --- /dev/null +++ b/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch @@ -0,0 +1,80 @@ +From 73ebac0788971cc0080e32739a37dd478d986cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 17:28:51 +0200 +Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on + PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ] + +snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts +via spin_lock_irq(). This also implicitly disables the handling of +softirqs such as TIMER_SOFTIRQ. +On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not +disable them. That means a timer can be invoked during spin_lock_irq() +on the same CPU. Due to synchronisations reasons local_bh_disable() has +a per-CPU lock named softirq_ctrl.lock which synchronizes individual +softirq against each other. +syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is +acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This +is a possible deadlock. + +The softirq_ctrl.lock can not be made part of spin_lock_irq() as this +would lead to too much synchronisation against individual threads on the +system. To avoid the possible deadlock, softirqs must be manually +disabled before the lock is acquired. + +Disable softirqs before the lock is acquired on PREEMPT_RT. + +Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com +Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_native.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index ecb71bf1859d4..1a9abf0342c20 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group) + } + + /* define group lock helpers */ +-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \ ++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \ + static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \ + { \ +- if (nonatomic) \ ++ if (nonatomic) { \ + mutex_ ## mutex_action(&group->mutex); \ +- else \ +- spin_ ## action(&group->lock); \ +-} +- +-DEFINE_PCM_GROUP_LOCK(lock, lock); +-DEFINE_PCM_GROUP_LOCK(unlock, unlock); +-DEFINE_PCM_GROUP_LOCK(lock_irq, lock); +-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock); ++ } else { \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \ ++ local_bh_disable(); \ ++ spin_ ## action(&group->lock); \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \ ++ local_bh_enable(); \ ++ } \ ++} ++ ++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock); ++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock); + + /** + * snd_pcm_stream_lock - Lock the PCM stream +-- +2.51.0 + diff --git a/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch b/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch new file mode 100644 index 0000000000..6c77a1cff9 --- /dev/null +++ b/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch @@ -0,0 +1,413 @@ +From fcec9ea33d8777bdb31fa36bd718219d782e685c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 15:09:52 +0200 +Subject: arch: copy_thread: pass clone_flags as u64 + +From: Simon Schuster + +[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ] + +With the introduction of clone3 in commit 7f192e3cd316 ("fork: add +clone3") the effective bit width of clone_flags on all architectures was +increased from 32-bit to 64-bit, with a new type of u64 for the flags. +However, for most consumers of clone_flags the interface was not +changed from the previous type of unsigned long. + +While this works fine as long as none of the new 64-bit flag bits +(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still +undesirable in terms of the principle of least surprise. + +Thus, this commit fixes all relevant interfaces of the copy_thread +function that is called from copy_process to consistently pass +clone_flags as u64, so that no truncation to 32-bit integers occurs on +32-bit architectures. + +Signed-off-by: Simon Schuster +Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com +Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread") +Acked-by: Guo Ren (Alibaba Damo Academy) +Acked-by: Andreas Larsson # sparc +Acked-by: David Hildenbrand +Acked-by: Geert Uytterhoeven # m68k +Reviewed-by: Arnd Bergmann +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/process.c | 2 +- + arch/arc/kernel/process.c | 2 +- + arch/arm/kernel/process.c | 2 +- + arch/arm64/kernel/process.c | 2 +- + arch/csky/kernel/process.c | 2 +- + arch/hexagon/kernel/process.c | 2 +- + arch/loongarch/kernel/process.c | 2 +- + arch/m68k/kernel/process.c | 2 +- + arch/microblaze/kernel/process.c | 2 +- + arch/mips/kernel/process.c | 2 +- + arch/nios2/kernel/process.c | 2 +- + arch/openrisc/kernel/process.c | 2 +- + arch/parisc/kernel/process.c | 2 +- + arch/powerpc/kernel/process.c | 2 +- + arch/riscv/kernel/process.c | 2 +- + arch/s390/kernel/process.c | 2 +- + arch/sh/kernel/process_32.c | 2 +- + arch/sparc/kernel/process_32.c | 2 +- + arch/sparc/kernel/process_64.c | 2 +- + arch/um/kernel/process.c | 2 +- + arch/x86/include/asm/fpu/sched.h | 2 +- + arch/x86/include/asm/shstk.h | 4 ++-- + arch/x86/kernel/fpu/core.c | 2 +- + arch/x86/kernel/process.c | 2 +- + arch/x86/kernel/shstk.c | 2 +- + arch/xtensa/kernel/process.c | 2 +- + 26 files changed, 27 insertions(+), 27 deletions(-) + +diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c +index 582d96548385d..06522451f018f 100644 +--- a/arch/alpha/kernel/process.c ++++ b/arch/alpha/kernel/process.c +@@ -231,7 +231,7 @@ flush_thread(void) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + extern void ret_from_fork(void); +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index 186ceab661eb0..8166d09087130 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void); + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *c_regs; /* child's pt_regs */ +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index e16ed102960cb..d7aa95225c70b 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long stack_start = args->stack; + unsigned long tls = args->tls; + struct thread_info *thread = task_thread_info(p); +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 3e1baff5e88d9..01a20fb96b8c4 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -410,7 +410,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork"); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long stack_start = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c +index 0c6e4b17fe00f..a7a90340042a5 100644 +--- a/arch/csky/kernel/process.c ++++ b/arch/csky/kernel/process.c +@@ -32,7 +32,7 @@ void flush_thread(void){} + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct switch_stack *childstack; +diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c +index 2a77bfd756945..15b4992bfa298 100644 +--- a/arch/hexagon/kernel/process.c ++++ b/arch/hexagon/kernel/process.c +@@ -52,7 +52,7 @@ void arch_cpu_idle(void) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c +index 3582f591bab28..efd9edf65603c 100644 +--- a/arch/loongarch/kernel/process.c ++++ b/arch/loongarch/kernel/process.c +@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + unsigned long childksp; + unsigned long tls = args->tls; + unsigned long usp = args->stack; +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + struct pt_regs *childregs, *regs = current_pt_regs(); + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE; +diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c +index fda7eac23f872..f5a07a70e9385 100644 +--- a/arch/m68k/kernel/process.c ++++ b/arch/m68k/kernel/process.c +@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct fork_frame { +diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c +index 56342e11442d2..6cbf642d7b801 100644 +--- a/arch/microblaze/kernel/process.c ++++ b/arch/microblaze/kernel/process.c +@@ -54,7 +54,7 @@ void flush_thread(void) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 02aa6a04a21da..29191fa1801e2 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c +index f84021303f6a8..151404139085c 100644 +--- a/arch/nios2/kernel/process.c ++++ b/arch/nios2/kernel/process.c +@@ -101,7 +101,7 @@ void flush_thread(void) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index eef99fee2110c..73ffb9fa3118b 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void); + int + copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *userregs; +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ed93bd8c15453..e64ab5d2a40d6 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init); + int + copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *cregs = &(p->thread.regs); +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 855e098865032..eb23966ac0a9f 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + f = ret_from_kernel_user_thread; + } else { + struct pt_regs *regs = current_pt_regs(); +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + + /* Copy registers */ +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index a0a40889d79a5..31a392993cb45 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c +index 9637aee43c401..76a97283daaf7 100644 +--- a/arch/s390/kernel/process.c ++++ b/arch/s390/kernel/process.c +@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long new_stackp = args->stack; + unsigned long tls = args->tls; + struct fake_frame +diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c +index 92b6649d49295..62f753a85b89c 100644 +--- a/arch/sh/kernel/process_32.c ++++ b/arch/sh/kernel/process_32.c +@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c +index 9c7c662cb5659..5a28c0e91bf15 100644 +--- a/arch/sparc/kernel/process_32.c ++++ b/arch/sparc/kernel/process_32.c +@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c +index 529adfecd58ca..25781923788a0 100644 +--- a/arch/sparc/kernel/process_64.c ++++ b/arch/sparc/kernel/process_64.c +@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct thread_info *t = task_thread_info(p); +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 1be644de9e41e..9c9c66dc45f05 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -143,7 +143,7 @@ static void fork_handler(void) + + int copy_thread(struct task_struct * p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + void (*handler)(void); +diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h +index c060549c6c940..89004f4ca208d 100644 +--- a/arch/x86/include/asm/fpu/sched.h ++++ b/arch/x86/include/asm/fpu/sched.h +@@ -11,7 +11,7 @@ + + extern void save_fpregs_to_fpstate(struct fpu *fpu); + extern void fpu__drop(struct task_struct *tsk); +-extern int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal, ++extern int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal, + unsigned long shstk_addr); + extern void fpu_flush_thread(void); + +diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h +index ba6f2fe438488..0f50e01259430 100644 +--- a/arch/x86/include/asm/shstk.h ++++ b/arch/x86/include/asm/shstk.h +@@ -16,7 +16,7 @@ struct thread_shstk { + + long shstk_prctl(struct task_struct *task, int option, unsigned long arg2); + void reset_thread_features(void); +-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags, ++unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags, + unsigned long stack_size); + void shstk_free(struct task_struct *p); + int setup_signal_shadow_stack(struct ksignal *ksig); +@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option, + unsigned long arg2) { return -EINVAL; } + static inline void reset_thread_features(void) {} + static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p, +- unsigned long clone_flags, ++ u64 clone_flags, + unsigned long stack_size) { return 0; } + static inline void shstk_free(struct task_struct *p) {} + static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; } +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index ea138583dd92a..a8ff319408363 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -606,7 +606,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp) + } + + /* Clone current's FPU state on fork */ +-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal, ++int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal, + unsigned long ssp) + { + /* +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index a838be04f8749..1e57bcc795f31 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs, + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct inactive_task_frame *frame; +diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c +index 2ddf23387c7ef..5eba6c5a67757 100644 +--- a/arch/x86/kernel/shstk.c ++++ b/arch/x86/kernel/shstk.c +@@ -191,7 +191,7 @@ void reset_thread_features(void) + current->thread.features_locked = 0; + } + +-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags, ++unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags, + unsigned long stack_size) + { + struct thread_shstk *shstk = &tsk->thread.shstk; +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index 7bd66677f7b6d..94d43f44be131 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp_thread_fn = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +-- +2.51.0 + diff --git a/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..aa534be2b3 --- /dev/null +++ b/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 713193dffe656106e3efccf99432db2fa327b49a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e23b868340965..7e6c94f8edeef 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -904,7 +904,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCKx settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -980,7 +980,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch b/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch new file mode 100644 index 0000000000..2858af0aa5 --- /dev/null +++ b/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch @@ -0,0 +1,43 @@ +From a1b118129010ffc3dd36fefe58fb3dbfdf568723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 23:59:57 +0200 +Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer + property + +From: Jihed Chaibi + +[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ] + +The dtbs_check validation for am335x-cm-t335.dtb flags an error +for an unevaluated 'num-serializer' property in the mcasp0 node. + +This property is obsolete; it is not defined in the davinci-mcasp-audio +schema and is not used by the corresponding (or any) driver. + +Remove this unused property to fix the schema validation warning. + +Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +index 06767ea164b59..ece7f7854f6aa 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +@@ -483,8 +483,6 @@ &mcasp1 { + + op-mode = <0>; /* MCASP_IIS_MODE */ + tdm-slots = <2>; +- /* 16 serializers */ +- num-serializer = <16>; + serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ + 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 + >; +-- +2.51.0 + diff --git a/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch b/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch new file mode 100644 index 0000000000..6fcd286a5c --- /dev/null +++ b/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch @@ -0,0 +1,36 @@ +From b87e7dda63bcf374ff1f41fc20fcbdef9134e267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 15:49:48 +0200 +Subject: ARM: dts: renesas: porter: Fix CAN pin group + +From: Geert Uytterhoeven + +[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ] + +According to the schematics, the CAN transceiver is connected to pins +GP7_3 and GP7_4, which correspond to CAN0 data group B. + +Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index f518eadd8b9cd..81b3c5d74e9b3 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -289,7 +289,7 @@ vin0_pins: vin0 { + }; + + can0_pins: can0 { +- groups = "can0_data"; ++ groups = "can0_data_b"; + function = "can0"; + }; + +-- +2.51.0 + diff --git a/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch b/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch new file mode 100644 index 0000000000..fc161707b7 --- /dev/null +++ b/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch @@ -0,0 +1,42 @@ +From d5a9bae0afe2562dd032cc1e4cdcb807cddc4591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 00:51:15 +0200 +Subject: ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property + +From: Jihed Chaibi + +[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ] + +The stm32-i2s binding inherits from the standard audio-graph-port +schema for its 'port' subnode, audio-graph-port requires the use +of the 'dai-format' property. The stm32mp151c-plyaqm dts file was +using the non-standard name 'format'. + +Correct the property name to 'dai-format' to fix the dtbs_check +validation error. + +Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts +index 39a3211c61337..55fe916740d7c 100644 +--- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts ++++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts +@@ -239,7 +239,7 @@ &i2s1 { + + i2s1_port: port { + i2s1_endpoint: endpoint { +- format = "i2s"; ++ dai-format = "i2s"; + mclk-fs = <256>; + remote-endpoint = <&codec_endpoint>; + }; +-- +2.51.0 + diff --git a/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch b/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch new file mode 100644 index 0000000000..6987c8e0b0 --- /dev/null +++ b/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch @@ -0,0 +1,42 @@ +From 439e7f6e087bc271e8c561f4b9755f48c44b8d43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:25:30 +0200 +Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in + DTS to use correct boolean syntax + +From: Jihed Chaibi + +[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ] + +The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree +schema, was incorrectly assigned a value (<1>) in the DTS file, causing +a validation error: "size (4) error for type flag". The driver uses +of_property_read_bool(), expecting a boolean. Remove the value to fix +the dtbs_check error. + +Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/ +Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +index ae2e8dffbe049..ea47f9960c356 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +@@ -269,7 +269,7 @@ &tps { + vcc7-supply = <&vbat>; + vccio-supply = <&vbat>; + +- ti,en-ck32k-xtal = <1>; ++ ti,en-ck32k-xtal; + + regulators { + vrtc_reg: regulator@0 { +-- +2.51.0 + diff --git a/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch b/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch new file mode 100644 index 0000000000..d5553fe957 --- /dev/null +++ b/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch @@ -0,0 +1,41 @@ +From b4394cdf3be82232ebfc7b101ff0cd984acf7101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:50:52 +0200 +Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on + property to use correct boolean syntax in DTS + +From: Jihed Chaibi + +[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ] + +The ti,keep-vref-on property, defined as a boolean flag in the Device +Tree schema, was incorrectly assigned a value (<1>) in the DTS file, +causing a validation error: "size (4) error for type flag". Remove +the value to match the schema and ensure compatibility with the driver +using device_property_read_bool(). This fixes the dtbs_check error. + +Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +index a7f99ae0c1fe9..78c657429f641 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +@@ -65,7 +65,7 @@ ads7846@0 { + ti,debounce-max = /bits/ 16 <10>; + ti,debounce-tol = /bits/ 16 <5>; + ti,debounce-rep = /bits/ 16 <1>; +- ti,keep-vref-on = <1>; ++ ti,keep-vref-on; + ti,settle-delay-usec = /bits/ 16 <150>; + + wakeup-source; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch b/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch new file mode 100644 index 0000000000..3f026eb489 --- /dev/null +++ b/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch @@ -0,0 +1,41 @@ +From 409135b8398390f3d558d801f9049f66b35c2a14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 02:10:55 +0800 +Subject: arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset + setting + +From: Chen-Yu Tsai + +[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ] + +The external Ethernet PHY has a reset pin that is connected to the SoC. +It is missing from the original submission. + +Add it to complete the description. + +Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +index 8bc0f2c72a247..c57ecc420aed4 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +@@ -70,6 +70,9 @@ &mdio0 { + ext_rgmii_phy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; ++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */ ++ reset-assert-us = <10000>; ++ reset-deassert-us = <150000>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch new file mode 100644 index 0000000000..2926d9fa02 --- /dev/null +++ b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch @@ -0,0 +1,41 @@ +From ada242ed6c76fecfd00ed4dc0b6a4b997d0243eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 02:10:57 +0800 +Subject: arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset + setting + +From: Chen-Yu Tsai + +[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ] + +The external Ethernet PHY has a reset pin that is connected to the SoC. +It is missing from the original submission. + +Add it to complete the description. + +Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +index 142177c1f737f..9a2f29201d3ce 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +@@ -80,6 +80,9 @@ &mdio0 { + ext_rgmii_phy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; ++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */ ++ reset-assert-us = <10000>; ++ reset-deassert-us = <150000>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch new file mode 100644 index 0000000000..97a7af9101 --- /dev/null +++ b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch @@ -0,0 +1,48 @@ +From 8ec63d7a907fa4f81d8ba7466ad2a5cf6ea0f55d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:24:49 +0800 +Subject: arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal + +From: Chen-Yu Tsai + +[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ] + +When the board was added, its external 32.768 KHz crystal was described +but not hooked up correctly. This meant the device had to fall back to +the SoC's internal oscillator or divide a 32 KHz clock from the main +oscillator, neither of which are accurate for the RTC. As a result the +RTC clock will drift badly. + +Hook the crystal up to the RTC block and request the correct clock rate. + +Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +index 9a2f29201d3ce..6a07281e11007 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +@@ -304,6 +304,14 @@ &r_pio { + vcc-pm-supply = <®_aldo3>; + }; + ++&rtc { ++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>, ++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>; ++ clock-names = "bus", "hosc", "ahb", "ext-osc32k"; ++ assigned-clocks = <&rtc CLK_OSC32K>; ++ assigned-clock-rates = <32768>; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pb_pins>; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch b/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch new file mode 100644 index 0000000000..f30740e0e1 --- /dev/null +++ b/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch @@ -0,0 +1,65 @@ +From 73ce2d8475b06e998da3378f029d072c4ed49a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:44 +0200 +Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map + +From: Janne Grunau + +[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ] + +PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused +and disabled. Linux' PCI subsystem assigns the ethernet nic from +`port02` to bus 02. This results into assigning `pcie0_dart_1` from the +disabled port as iommu. The `pcie0_dart_1` instance is disabled and +probably fused off (it is on the M2 Pro Mac mini which has a disabled +PCIe port as well). +Without iommu the ethernet nic is not expected work. +Adjusts the "bus-range" and the PCIe devices "reg" property to PCI +subsystem's bus number. + +Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 152f95fd49a21..7089ccf3ce556 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -21,6 +21,14 @@ aliases { + }; + }; + ++/* ++ * Adjust pcie0's iommu-map to account for the disabled port01. ++ */ ++&pcie0 { ++ iommu-map = <0x100 &pcie0_dart_0 1 1>, ++ <0x200 &pcie0_dart_2 1 1>; ++}; ++ + &bluetooth0 { + brcm,board-type = "apple,santorini"; + }; +@@ -36,10 +44,10 @@ &wifi0 { + */ + + &port02 { +- bus-range = <3 3>; ++ bus-range = <2 2>; + status = "okay"; + ethernet0: ethernet@0,0 { +- reg = <0x30000 0x0 0x0 0x0 0x0>; ++ reg = <0x20000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch b/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch new file mode 100644 index 0000000000..6464ac88de --- /dev/null +++ b/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch @@ -0,0 +1,50 @@ +From 45e2b0f1d8c36150f7a80f25fd9f6054753be443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:45 +0200 +Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator + +From: Annette Kobou + +[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ] + +The regulator uses the wrong GPIO. Fix this. + +Signed-off-by: Annette Kobou +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 89e97c604bd3e..9a9e5d0daf3ba 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -33,7 +33,9 @@ pwm-beeper { + + reg_vcc_panel: regulator-vcc-panel { + compatible = "regulator-fixed"; +- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_reg_vcc_panel>; ++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <3300000>; +@@ -161,3 +163,11 @@ &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; + }; ++ ++&iomuxc { ++ pinctrl_reg_vcc_panel: regvccpanelgrp { ++ fsl,pins = < ++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */ ++ >; ++ }; ++}; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch b/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch new file mode 100644 index 0000000000..9c4a769155 --- /dev/null +++ b/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch @@ -0,0 +1,62 @@ +From e211c5924bc8b621566e228ea9ebab8e376cf139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:46 +0200 +Subject: arm64: dts: imx93-kontron: Fix USB port assignment + +From: Frieder Schrempf + +[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ] + +The assignment of the USB ports is wrong and needs to be swapped. +The OTG (USB-C) port is on the first port and the host port with +the onboard hub is on the second port. + +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 9a9e5d0daf3ba..c3d2ddd887fdf 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -137,6 +137,16 @@ &tpm6 { + }; + + &usbotg1 { ++ adp-disable; ++ hnp-disable; ++ srp-disable; ++ disable-over-current; ++ dr_mode = "otg"; ++ usb-role-switch; ++ status = "okay"; ++}; ++ ++&usbotg2 { + #address-cells = <1>; + #size-cells = <0>; + disable-over-current; +@@ -149,16 +159,6 @@ usb1@1 { + }; + }; + +-&usbotg2 { +- adp-disable; +- hnp-disable; +- srp-disable; +- disable-over-current; +- dr_mode = "otg"; +- usb-role-switch; +- status = "okay"; +-}; +- + &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch b/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch new file mode 100644 index 0000000000..7b46e3c5e3 --- /dev/null +++ b/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch @@ -0,0 +1,47 @@ +From 9b163d2edac907b65ee89f39c0b25410692ba28d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 09:25:31 +0800 +Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid + +From: Joy Zou + +[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ] + +According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87, +and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them. + +Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes") +Signed-off-by: Joy Zou +Signed-off-by: Peng Fan +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi +index 5aecdd9b62ff6..29227e80facc1 100644 +--- a/arch/arm64/boot/dts/freescale/imx95.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi +@@ -913,7 +913,7 @@ lpuart7: serial@42690000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART7>; + clock-names = "ipg"; +- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>; ++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART8>; + clock-names = "ipg"; +- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>; ++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch b/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch new file mode 100644 index 0000000000..0c661303d9 --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch @@ -0,0 +1,68 @@ +From 0d4fe1c0d62f0f84da2f8ccebeed59dfc7233f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:52 +0200 +Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node + names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ] + +The node names for "pmic", "regulators", "rtc", and "keys" are +dictated by the PMIC MFD binding: change those to adhere to it. + +Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +index d89858c73ab1b..243afbffa21fd 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +@@ -6,12 +6,12 @@ + #include + + &pwrap { +- pmic: mt6331 { ++ pmic: pmic { + compatible = "mediatek,mt6331"; + interrupt-controller; + #interrupt-cells = <2>; + +- mt6331regulator: mt6331regulator { ++ mt6331regulator: regulators { + compatible = "mediatek,mt6331-regulator"; + + mt6331_vdvfs11_reg: buck-vdvfs11 { +@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { + }; + + mt6331_vdig18_reg: ldo-vdig18 { +- regulator-name = "dvdd18_dig"; ++ regulator-name = "vdig18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-ramp-delay = <0>; +@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { + }; + }; + +- mt6331rtc: mt6331rtc { ++ mt6331rtc: rtc { + compatible = "mediatek,mt6331-rtc"; + }; + +- mt6331keys: mt6331keys { ++ mt6331keys: keys { + compatible = "mediatek,mt6331-keys"; + power { + linux,keycodes = ; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch b/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch new file mode 100644 index 0000000000..343029977d --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch @@ -0,0 +1,40 @@ +From 9e10cc85ce75034ac61dfa2abc20de39e909ce61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:56 +0200 +Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value + +From: AngeloGioacchino Del Regno + +[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ] + +Change the latch-ck value from 0x14 to 4: as only bits [0-3] are +actually used, the final value that gets written to the register +field for DAT_LATCH_CK_SEL is just 0x4. + +This also fixes dtbs_check warnings. + +Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +index 91de920c22457..03cc48321a3f4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts ++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +@@ -212,7 +212,7 @@ proximity@48 { + + &mmc0 { + /* eMMC controller */ +- mediatek,latch-ck = <0x14>; /* hs400 */ ++ mediatek,latch-ck = <4>; /* hs400 */ + mediatek,hs200-cmd-int-delay = <1>; + mediatek,hs400-cmd-int-delay = <1>; + mediatek,hs400-ds-dly3 = <0x1a>; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch b/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch new file mode 100644 index 0000000000..6f48f14286 --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch @@ -0,0 +1,70 @@ +From db21125995c3fae8a0790a700688274fe2015e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 17:01:34 +0800 +Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model + +From: Chen-Yu Tsai + +[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ] + +The touchscreen controller used with the original Krabby design is the +Elan eKTH6918, which is in the same family as eKTH6915, but supporting +a larger screen size with more sense lines. + +OTOH, the touchscreen controller that actually shipped on the Tentacruel +devices is the Elan eKTH6A12NAY. A compatible string was added for it +specifically because it has different power sequencing timings. + +Fix up the touchscreen nodes for both these. This also includes adding +a previously missing reset line. Also add "no-reset-on-power-off" since +the power is always on, and putting it in reset would consume more +power. + +Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++---- + .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +index 7c971198fa956..72a2a2bff0a93 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +@@ -71,14 +71,14 @@ &i2c1 { + i2c-scl-internal-delay-ns = <10000>; + + touchscreen: touchscreen@10 { +- compatible = "hid-over-i2c"; ++ compatible = "elan,ekth6915"; + reg = <0x10>; + interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&touchscreen_pins>; +- post-power-on-delay-ms = <10>; +- hid-descr-addr = <0x0001>; +- vdd-supply = <&pp3300_s3>; ++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>; ++ vcc33-supply = <&pp3300_s3>; ++ no-reset-on-power-off; + }; + }; + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +index 26d3451a5e47c..24d9ede63eaa2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP) + CROS_STD_MAIN_KEYMAP + >; + }; ++ ++&touchscreen { ++ compatible = "elan,ekth6a12nay"; ++}; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch new file mode 100644 index 0000000000..8426d8205c --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch @@ -0,0 +1,50 @@ +From 88245d7ba267411e7e5f44596c25eafdb902b76c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 17:59:59 +0800 +Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from + pcie0 + +From: Guoqing Jiang + +[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ] + +When test suspend resume with 6.8 based kernel, system can't resume +and I got below error which can be also reproduced with 6.16 rc6+ +kernel. + +mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) +mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110 +mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110 + +After investigation, looks pcie0 has the same problem as pcie1 as +decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195: +Remove suspend-breaking reset from pcie1"). + +Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") +Signed-off-by: Guoqing Jiang +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Macpaul Lin +Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index dd065b1bf94a3..50cf014522082 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 { + + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc0 0>, +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch b/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch new file mode 100644 index 0000000000..c9cffedf92 --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch @@ -0,0 +1,105 @@ +From 3e23a8c1a505430a587e8c65ce880771ba02b8ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:13 +0200 +Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator + nodes + +From: AngeloGioacchino Del Regno + +[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ] + +All of the MT6360 regulator nodes were wrong and would not probe +because the regulator names are supposed to be lower case, but +they are upper case in this devicetree. + +Change all nodes to be lower case to get working regulators. + +Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +index 4985b65925a9e..d16f545cbbb27 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +@@ -352,7 +352,7 @@ regulator { + LDO_VIN2-supply = <&vsys>; + LDO_VIN3-supply = <&vsys>; + +- mt6360_buck1: BUCK1 { ++ mt6360_buck1: buck1 { + regulator-name = "emi_vdd2"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <1800000>; +@@ -362,7 +362,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_buck2: BUCK2 { ++ mt6360_buck2: buck2 { + regulator-name = "emi_vddq"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1300000>; +@@ -372,7 +372,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_ldo1: LDO1 { ++ mt6360_ldo1: ldo1 { + regulator-name = "mt6360_ldo1"; /* Test point */ + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo2: LDO2 { ++ mt6360_ldo2: ldo2 { + regulator-name = "panel1_p1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo3: LDO3 { ++ mt6360_ldo3: ldo3 { + regulator-name = "vmc_pmu"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo5: LDO5 { ++ mt6360_ldo5: ldo5 { + regulator-name = "vmch_pmu"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo6: LDO6 { ++ mt6360_ldo6: ldo6 { + regulator-name = "mt6360_ldo6"; /* Test point */ + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <2100000>; +@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo7: LDO7 { ++ mt6360_ldo7: ldo7 { + regulator-name = "emi_vmddr_en"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..a66ea6c0ed --- /dev/null +++ b/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From f77c47b71ab518444fca7af6af670e178592635c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch new file mode 100644 index 0000000000..b50ff847d0 --- /dev/null +++ b/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch @@ -0,0 +1,43 @@ +From 6df49391425ae1c653b69a8ac2c27a1f7f52d759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 13:19:53 +0100 +Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 + +From: Biju Das + +[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ] + +On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we +are deleting a wrong and nonexistent node. Fixing the wrong node would +invoke a dtb warning message, as channel0 is a required property. +Disable CAN-FD channel0 instead of deleting the node. + +Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 345b779e4f601..f3d7eff0d2f2a 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -48,7 +48,10 @@ sound_card { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch b/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch new file mode 100644 index 0000000000..9ebf69b9dd --- /dev/null +++ b/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch @@ -0,0 +1,42 @@ +From f2a628c26e02df0a853317a596dcacb55b501630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 01:58:11 +0200 +Subject: arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on + EVTB1 + +From: Marek Vasut + +[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ] + +Invert the polarity of microSD voltage selector on Retronix R-Car V4H +Sparrow Hawk board. The voltage selector was not populated on prototype +EVTA1 boards, and is implemented slightly different on EVTB1 boards. As +the EVTA1 boards are from a limited run and generally not available, +update the DT to make it compatible with EVTB1 microSD voltage selector. + +Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") +Signed-off-by: Marek Vasut +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +index 6955eafd8d6ab..3155a201ecd1a 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +@@ -178,7 +178,7 @@ vcc_sdhi: regulator-vcc-sdhi { + regulator-max-microvolt = <3300000>; + gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>; + gpios-states = <1>; +- states = <3300000 0>, <1800000 1>; ++ states = <1800000 0>, <3300000 1>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch b/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch new file mode 100644 index 0000000000..cf24844852 --- /dev/null +++ b/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch @@ -0,0 +1,45 @@ +From a2ce048af8aa4234cf005b232d9fc3dafe0d48b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 21:28:04 +0200 +Subject: arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1 + +From: Marek Vasut + +[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ] + +The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply +for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the +change in IO voltage. Since the VDDQ18_25_AVB power rail is shared, +all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to +be configured the same way. As the EVTA1 boards are from a limited run +and generally not available, update the DT to make it compatible with +EVTB1 IO voltage settings. + +Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") +Signed-off-by: Marek Vasut +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +index 3155a201ecd1a..05ddd1c62ccdf 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +@@ -529,6 +529,10 @@ pins-mii { + drive-strength = <21>; + }; + ++ pins-vddq18-25-avb { ++ pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0"; ++ power-source = <1800>; ++ }; + }; + + /* Page 28 / CANFD_IF */ +-- +2.51.0 + diff --git a/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch b/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch new file mode 100644 index 0000000000..527fa74c22 --- /dev/null +++ b/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch @@ -0,0 +1,65 @@ +From c409787664eaf2381435bd89691329bc7b7e7432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 22:01:11 +0530 +Subject: arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU + R5F cores + +From: Beleswar Padhi + +[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ] + +The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi +for its MCU domain, but it does not override the firmware-name property +for its R5F cores. This causes the wrong firmware binaries to be +referenced. + +Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the +firmware-name property with correct names for J742s2. + +Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family") +Signed-off-by: Beleswar Padhi +Reviewed-by: Udit Kumar +Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++ + arch/arm64/boot/dts/ti/k3-j742s2.dtsi | 1 + + 2 files changed, 18 insertions(+) + create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi + +diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi +new file mode 100644 +index 0000000000000..61db2348d6a47 +--- /dev/null ++++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi +@@ -0,0 +1,17 @@ ++// SPDX-License-Identifier: GPL-2.0-only OR MIT ++/* ++ * Device Tree Source for J742S2 SoC Family ++ * ++ * TRM: https://www.ti.com/lit/pdf/spruje3 ++ * ++ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/ ++ * ++ */ ++ ++&mcu_r5fss0_core0 { ++ firmware-name = "j742s2-mcu-r5f0_0-fw"; ++}; ++ ++&mcu_r5fss0_core1 { ++ firmware-name = "j742s2-mcu-r5f0_1-fw"; ++}; +diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi +index 7a72f82f56d68..d265df1abade1 100644 +--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi +@@ -96,3 +96,4 @@ cpu3: cpu@3 { + }; + + #include "k3-j742s2-main.dtsi" ++#include "k3-j742s2-mcu-wakeup.dtsi" +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..e78cf66657 --- /dev/null +++ b/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From b6d08893f4f9341435e236f7894290c7604dfc8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 62594e7966ab0..b384d38654e65 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -47,7 +47,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..6a891e908a --- /dev/null +++ b/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From 8099c9b9dfde84bb6dd9f447e2ae9efd807666b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 0f3b8f44e7011..bc846558480e4 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..5c154cadc1 --- /dev/null +++ b/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From bda62e0d060f8f3c97e00538742371d6216b03a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 67c62844ca2a9..604a35d380e9a 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch b/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch new file mode 100644 index 0000000000..69463a989a --- /dev/null +++ b/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch @@ -0,0 +1,42 @@ +From c7d12eaf58b306956e0c6a5104c93560f5fba63c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 10:48:53 +0800 +Subject: ASoC: Intel: hda-sdw-bpt: set persistent_buffer false +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ] + +The persistent_buffer agreement is false when hda_cl_prepare() is +called. We should use the same value when hda_cl_cleanup() is called. + +Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA") +Signed-off-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-sdw-bpt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c +index 1327f1cad0bcd..ff5abccf0d88b 100644 +--- a/sound/soc/sof/intel/hda-sdw-bpt.c ++++ b/sound/soc/sof/intel/hda-sdw-bpt.c +@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream + u32 mask; + int ret; + +- ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream); ++ ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream); + if (ret < 0) { + dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n", + __func__); +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch b/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch new file mode 100644 index 0000000000..4ce0551403 --- /dev/null +++ b/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch @@ -0,0 +1,41 @@ +From a94ee84af9a9fe6549598105f70fc2025a1870a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:02:35 +0100 +Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback + +From: Richard Fitzgerald + +[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ] + +In create_sdw_dailink() check that sof_end->codec_info->add_sidecar +is not NULL before calling it. + +The original code assumed that if include_sidecar is true, the codec +on that link has an add_sidecar callback. But there could be other +codecs on the same link that do not have an add_sidecar callback. + +Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices") +Signed-off-by: Richard Fitzgerald +Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index c576ec5527f91..aed05b19ef5ae 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card, + (*codec_conf)++; + } + +- if (sof_end->include_sidecar) { ++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) { + ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..725a7964c3 --- /dev/null +++ b/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From 92f87fb1c59c5e9add3f6cd4f8e8a603371f0817 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 24656980f4431..5c399ac562eae 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch b/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch new file mode 100644 index 0000000000..b2a0a4f750 --- /dev/null +++ b/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch @@ -0,0 +1,171 @@ +From b2d6bf4581c666580a27b909f7728d46606fb3da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 18:24:11 +0800 +Subject: blk-throttle: fix access race during throttle policy activation + +From: Han Guangjiang + +[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ] + +On repeated cold boots we occasionally hit a NULL pointer crash in +blk_should_throtl() when throttling is consulted before the throttle +policy is fully enabled for the queue. Checking only q->td != NULL is +insufficient during early initialization, so blkg_to_pd() for the +throttle policy can still return NULL and blkg_to_tg() becomes NULL, +which later gets dereferenced. + + Unable to handle kernel NULL pointer dereference + at virtual address 0000000000000156 + ... + pc : submit_bio_noacct+0x14c/0x4c8 + lr : submit_bio_noacct+0x48/0x4c8 + sp : ffff800087f0b690 + x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 + x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 + x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 + x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff + x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff + x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c + x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 + x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 + x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 + x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a + Call trace: + submit_bio_noacct+0x14c/0x4c8 + verity_map+0x178/0x2c8 + __map_bio+0x228/0x250 + dm_submit_bio+0x1c4/0x678 + __submit_bio+0x170/0x230 + submit_bio_noacct_nocheck+0x16c/0x388 + submit_bio_noacct+0x16c/0x4c8 + submit_bio+0xb4/0x210 + f2fs_submit_read_bio+0x4c/0xf0 + f2fs_mpage_readpages+0x3b0/0x5f0 + f2fs_readahead+0x90/0xe8 + +Tighten blk_throtl_activated() to also require that the throttle policy +bit is set on the queue: + + return q->td != NULL && + test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); + +This prevents blk_should_throtl() from accessing throttle group state +until policy data has been attached to blkgs. + +Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration") +Co-developed-by: Liang Jie +Signed-off-by: Liang Jie +Signed-off-by: Han Guangjiang +Reviewed-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 6 ------ + block/blk-cgroup.h | 6 ++++++ + block/blk-throttle.c | 6 +----- + block/blk-throttle.h | 18 +++++++++++------- + 4 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 5936db7f8475b..754fdfcdfb4ff 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void) + return task_css(current, io_cgrp_id); + } + +-static bool blkcg_policy_enabled(struct request_queue *q, +- const struct blkcg_policy *pol) +-{ +- return pol && test_bit(pol->plid, q->blkcg_pols); +-} +- + static void blkg_free_workfn(struct work_struct *work) + { + struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 81868ad86330c..83367086cb6ae 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) + bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); + } + ++static inline bool blkcg_policy_enabled(struct request_queue *q, ++ const struct blkcg_policy *pol) ++{ ++ return pol && test_bit(pol->plid, q->blkcg_pols); ++} ++ + void blk_cgroup_bio_start(struct bio *bio); + void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta); + #else /* CONFIG_BLK_CGROUP */ +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 397b6a410f9e5..cfa1cd60d2c5f 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk) + INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn); + throtl_service_queue_init(&td->service_queue); + +- /* +- * Freeze queue before activating policy, to synchronize with IO path, +- * which is protected by 'q_usage_counter'. +- */ + memflags = blk_mq_freeze_queue(disk->queue); + blk_mq_quiesce_queue(disk->queue); + + q->td = td; + td->queue = q; + +- /* activate policy */ ++ /* activate policy, blk_throtl_activated() will return true */ + ret = blkcg_activate_policy(disk, &blkcg_policy_throtl); + if (ret) { + q->td = NULL; +diff --git a/block/blk-throttle.h b/block/blk-throttle.h +index 3b27755bfbff1..9d7a42c039a15 100644 +--- a/block/blk-throttle.h ++++ b/block/blk-throttle.h +@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk); + + static inline bool blk_throtl_activated(struct request_queue *q) + { +- return q->td != NULL; ++ /* ++ * q->td guarantees that the blk-throttle module is already loaded, ++ * and the plid of blk-throttle is assigned. ++ * blkcg_policy_enabled() guarantees that the policy is activated ++ * in the request_queue. ++ */ ++ return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl); + } + + static inline bool blk_should_throtl(struct bio *bio) +@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio) + struct throtl_grp *tg; + int rw = bio_data_dir(bio); + +- /* +- * This is called under bio_queue_enter(), and it's synchronized with +- * the activation of blk-throtl, which is protected by +- * blk_mq_freeze_queue(). +- */ + if (!blk_throtl_activated(bio->bi_bdev->bd_queue)) + return false; + +@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio) + + static inline bool blk_throtl_bio(struct bio *bio) + { +- ++ /* ++ * block throttling takes effect if the policy is activated ++ * in the bio's request_queue. ++ */ + if (!blk_should_throtl(bio)) + return false; + +-- +2.51.0 + diff --git a/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch b/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch new file mode 100644 index 0000000000..961dfde26e --- /dev/null +++ b/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch @@ -0,0 +1,62 @@ +From decb72d096d07d2d390b9dddc8e4af34b0cefc5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 15:55:39 +0800 +Subject: blk-throttle: fix throtl_data leak during disk release + +From: Yu Kuai + +[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ] + +Tightening the throttle activation check in blk_throtl_activated() to +require both q->td presence and policy bit set introduced a memory leak +during disk release: + +blkg_destroy_all() clears the policy bit first during queue deactivation, +causing subsequent blk_throtl_exit() to skip throtl_data cleanup when +blk_throtl_activated() fails policy check. + +Idealy we should avoid modifying blk_throtl_exit() activation check because +it's intuitive that blk-throtl start from blk_throtl_init() and end in +blk_throtl_exit(). However, call blk_throtl_exit() before +blkg_destroy_all() will make a long term deadlock problem easier to +trigger[1], hence fix this problem by checking if q->td is NULL from +blk_throtl_exit(), and remove policy deactivation as well since it's +useless. + +[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t + +Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation") +Reported-by: Yi Zhang +Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/ +Signed-off-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-throttle.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index cfa1cd60d2c5f..95bf175c2a135 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk) + { + struct request_queue *q = disk->queue; + +- if (!blk_throtl_activated(q)) ++ /* ++ * blkg_destroy_all() already deactivate throtl policy, just check and ++ * free throtl data. ++ */ ++ if (!q->td) + return; + + timer_delete_sync(&q->td->service_queue.pending_timer); + throtl_shutdown_wq(q); +- blkcg_deactivate_policy(disk, &blkcg_policy_throtl); + kfree(q->td); + } + +-- +2.51.0 + diff --git a/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..2354b4f128 --- /dev/null +++ b/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From 4e2f1a446647c50905372bc444c10d038a8f42e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 44dabc636a592..12648d7d37177 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -697,7 +697,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t, + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->features |= (b->features & BLK_FEAT_INHERIT_MASK); + +-- +2.51.0 + diff --git a/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch new file mode 100644 index 0000000000..5cf483c97f --- /dev/null +++ b/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch @@ -0,0 +1,57 @@ +From d3925c8fe8b3f1340871bbf4b4fa30f9a148c457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 12:30:05 -0400 +Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA + advertisements + +From: Luiz Augusto von Dentz + +[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ] + +When creating an advertisement for BIG the address shall not be +non-resolvable since in case of acting as BASS/Broadcast Assistant the +address must be the same as the connection in order to use the PAST +method and even when PAST/BASS are not in the picture a Periodic +Advertisement can still be synchronized thus the same argument as to +connectable advertisements still stand. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Luiz Augusto von Dentz +Reviewed-by: Paul Menzel +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 7ca544d7791f4..775a1bbdd0b15 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch new file mode 100644 index 0000000000..52e93c0e78 --- /dev/null +++ b/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch @@ -0,0 +1,38 @@ +From 944b744cf71891ba10b30a82e7b789b753759b43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:22 +0300 +Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX + +From: Pauli Virtanen + +[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ] + +For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the +skb is leaked. + +Free skb after copying its data. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 72060c087d1b8..d675ad9ad1581 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -2390,7 +2390,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +-- +2.51.0 + diff --git a/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch new file mode 100644 index 0000000000..2a5849978b --- /dev/null +++ b/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch @@ -0,0 +1,40 @@ +From 98fc8e02dc5edb3fcf38f26e51e06f02776966ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:27:51 -0400 +Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free + +From: Luiz Augusto von Dentz + +[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] + +This attempt to fix similar issue to sco_conn_free where if the +conn->sk is not set to NULL may lead to UAF on iso_conn_free. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index c21566e1494a9..361d89c0ff533 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +-- +2.51.0 + diff --git a/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch b/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch new file mode 100644 index 0000000000..8131ae2696 --- /dev/null +++ b/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch @@ -0,0 +1,35 @@ +From 6b76560cb85d0d1803917c9c7c3549ace2c99903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:21 +0300 +Subject: Bluetooth: ISO: free rx_skb if not consumed + +From: Pauli Virtanen + +[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ] + +If iso_conn is freed when RX is incomplete, free any leftover skb piece. + +Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 361d89c0ff533..72060c087d1b8 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref) + /* Ensure no more work items will run since hci_conn has been dropped */ + disable_delayed_work_sync(&conn->timeout_work); + ++ kfree_skb(conn->rx_skb); ++ + kfree(conn); + } + +-- +2.51.0 + diff --git a/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..81ab791798 --- /dev/null +++ b/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From b6c4dc492af39f83a7938361d30ddbc56a5d112c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 225140fcb3d6c..a3d16eece0d23 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +-- +2.51.0 + diff --git a/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch b/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch new file mode 100644 index 0000000000..f32a098367 --- /dev/null +++ b/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch @@ -0,0 +1,95 @@ +From a31a6286cf75b7409e4af3b739c0023617d32042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:33:03 +0000 +Subject: bonding: fix xfrm offload feature setup on active-backup mode + +From: Hangbin Liu + +[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ] + +The active-backup bonding mode supports XFRM ESP offload. However, when +a bond is added using command like `ip link add bond0 type bond mode 1 +miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is +disabled. This occurs because, in bond_newlink(), we change bond link +first and register bond device later. So the XFRM feature update in +bond_option_mode_set() is not called as the bond device is not yet +registered, leading to the offload feature not being set successfully. + +To resolve this issue, we can modify the code order in bond_newlink() to +ensure that the bond device is registered first before changing the bond +link parameters. This change will allow the XFRM ESP offload feature to be +correctly enabled. + +Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time") +Signed-off-by: Hangbin Liu +Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + drivers/net/bonding/bond_netlink.c | 16 +++++++++------- + include/net/bonding.h | 1 + + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index e23195dd74776..0f87aefcec297 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4394,7 +4394,7 @@ void bond_work_init_all(struct bonding *bond) + INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler); + } + +-static void bond_work_cancel_all(struct bonding *bond) ++void bond_work_cancel_all(struct bonding *bond) + { + cancel_delayed_work_sync(&bond->mii_work); + cancel_delayed_work_sync(&bond->arp_work); +diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c +index ac5e402c34bc6..5024bd58c4fdd 100644 +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -568,20 +568,22 @@ static int bond_newlink(struct net_device *bond_dev, + struct rtnl_newlink_params *params, + struct netlink_ext_ack *extack) + { ++ struct bonding *bond = netdev_priv(bond_dev); + struct nlattr **data = params->data; + struct nlattr **tb = params->tb; + int err; + +- err = bond_changelink(bond_dev, tb, data, extack); +- if (err < 0) ++ err = register_netdevice(bond_dev); ++ if (err) + return err; + +- err = register_netdevice(bond_dev); +- if (!err) { +- struct bonding *bond = netdev_priv(bond_dev); ++ netif_carrier_off(bond_dev); ++ bond_work_init_all(bond); + +- netif_carrier_off(bond_dev); +- bond_work_init_all(bond); ++ err = bond_changelink(bond_dev, tb, data, extack); ++ if (err) { ++ bond_work_cancel_all(bond); ++ unregister_netdevice(bond_dev); + } + + return err; +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 95f67b308c19a..e9b7b283b1953 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -708,6 +708,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev, + int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave); + void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay); + void bond_work_init_all(struct bonding *bond); ++void bond_work_cancel_all(struct bonding *bond); + + #ifdef CONFIG_PROC_FS + void bond_create_proc_entry(struct bonding *bond); +-- +2.51.0 + diff --git a/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch b/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch new file mode 100644 index 0000000000..1fceeaed17 --- /dev/null +++ b/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch @@ -0,0 +1,41 @@ +From aab4dfc575e7a3130d0c29d1fcbb7197b81136bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 23:26:53 +0000 +Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() + +From: Hengqi Chen + +[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ] + +The current implementation seems incorrect and does NOT match the +comment above, use bpf_jit_binary_pack_finalize() instead. + +Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") +Acked-by: Puranjay Mohan +Signed-off-by: Hengqi Chen +Acked-by: Song Liu +Acked-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 58f838b310bc5..2e01a7fdb3fa9 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -2936,8 +2936,7 @@ void bpf_jit_free(struct bpf_prog *prog) + * before freeing it. + */ + if (jit_data) { +- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size, +- sizeof(jit_data->header->size)); ++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kfree(jit_data); + } + hdr = bpf_jit_binary_pack_hdr(prog); +-- +2.51.0 + diff --git a/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch new file mode 100644 index 0000000000..c5d87558b4 --- /dev/null +++ b/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch @@ -0,0 +1,93 @@ +From c198a269c6821e71c40d17fb57db14eb25e2decc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 19:12:00 +0200 +Subject: bpf: Enforce expected_attach_type for tailcall compatibility + +From: Daniel Borkmann + +[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ] + +Yinhao et al. recently reported: + + Our fuzzer tool discovered an uninitialized pointer issue in the + bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. + This leads to a NULL pointer dereference when a BPF program attempts to + deference the txq member of struct xdp_buff object. + +The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the +entry point for bpf_prog_test_run_xdp() and its expected_attach_type can +neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot +of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP +to pass xdp_is_valid_access() validation. The program returns struct xdp_md's +egress_ifindex, and the latter is only allowed to be accessed under mentioned +expected_attach_type. progB is then inserted into the tailcall which progA +calls. + +The underlying issue goes beyond XDP though. Another example are programs +of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well +as sock_addr_func_proto() have different logic depending on the programs' +expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME +should not be allowed doing a tailcall into a program which calls bpf_bind() +out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. + +In short, specifying expected_attach_type allows to open up additional +functionality or restrictions beyond what the basic bpf_prog_type enables. +The use of tailcalls must not violate these constraints. Fix it by enforcing +expected_attach_type in __bpf_prog_map_compatible(). + +Note that we only enforce this for tailcall maps, but not for BPF devmaps or +cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and +cpu_map_bpf_prog_run*() which set up a new environment / context and therefore +these situations are not prone to this issue. + +Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") +Reported-by: Yinhao Hu +Reported-by: Kaiyan Mei +Reviewed-by: Dongliang Mu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 + + kernel/bpf/core.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index bcae876a2a603..e8f4a6efb053d 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -285,6 +285,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 17e5cf18da1ef..b9015a8322174 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2381,6 +2381,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2392,6 +2393,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +-- +2.51.0 + diff --git a/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..a997015a27 --- /dev/null +++ b/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 3280f8d03541448ad679b64418ad3513c67e74df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 2c3196dadd54a..11533ce08c6b3 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9275,13 +9275,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch b/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch new file mode 100644 index 0000000000..96760d798c --- /dev/null +++ b/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch @@ -0,0 +1,56 @@ +From 24ce4afc7cadceddbe59eab541996a3c39d23057 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 10:14:26 +0200 +Subject: bpf: Mark kfuncs as __noclone + +From: Andrea Righi + +[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ] + +Some distributions (e.g., CachyOS) support building the kernel with -O3, +but doing so may break kfuncs, resulting in their symbols not being +properly exported. + +In fact, with gcc -O3, some kfuncs may be optimized away despite being +annotated as noinline. This happens because gcc can still clone the +function during IPA optimizations, e.g., by duplicating or inlining it +into callers, and then dropping the standalone symbol. This breaks BTF +ID resolution since resolve_btfids relies on the presence of a global +symbol for each kfunc. + +Currently, this is not an issue for upstream, because we don't allow +building the kernel with -O3, but it may be safer to address it anyway, +to prevent potential issues in the future if compilers become more +aggressive with optimizations. + +Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never +cloned and remain distinct, globally visible symbols, regardless of +the optimization level. + +Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs") +Acked-by: David Vernet +Acked-by: Yonghong Song +Signed-off-by: Andrea Righi +Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/btf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/btf.h b/include/linux/btf.h +index b2983706292f7..de2bf13e71905 100644 +--- a/include/linux/btf.h ++++ b/include/linux/btf.h +@@ -86,7 +86,7 @@ + * as to avoid issues such as the compiler inlining or eliding either a static + * kfunc, or a global kfunc in an LTO build. + */ +-#define __bpf_kfunc __used __retain noinline ++#define __bpf_kfunc __used __retain __noclone noinline + + #define __bpf_kfunc_start_defs() \ + __diag_push(); \ +-- +2.51.0 + diff --git a/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch b/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch new file mode 100644 index 0000000000..d8ba7600b7 --- /dev/null +++ b/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch @@ -0,0 +1,61 @@ +From 020c75d1162488593fb2edcf6bc5180ff154c813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 23:04:33 +0800 +Subject: bpf: Reject negative offsets for ALU ops + +From: Yazhou Tang + +[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] + +When verifying BPF programs, the check_alu_op() function validates +instructions with ALU operations. The 'offset' field in these +instructions is a signed 16-bit integer. + +The existing check 'insn->off > 1' was intended to ensure the offset is +either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is +signed, this check incorrectly accepts all negative values (e.g., -1). + +This commit tightens the validation by changing the condition to +'(insn->off != 0 && insn->off != 1)'. This ensures that any value +other than the explicitly permitted 0 and 1 is rejected, hardening the +verifier against malformed BPF programs. + +Co-developed-by: Shenghao Yuan +Signed-off-by: Shenghao Yuan +Co-developed-by: Tianci Cao +Signed-off-by: Tianci Cao +Signed-off-by: Yazhou Tang +Acked-by: Yonghong Song +Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") +Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index a6338936085ae..48b3765456553 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15521,7 +15521,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } else { /* all other ALU ops: and, sub, xor, add, ... */ + + if (BPF_SRC(insn->code) == BPF_X) { +- if (insn->imm != 0 || insn->off > 1 || ++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +@@ -15531,7 +15531,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + if (err) + return err; + } else { +- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || ++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch new file mode 100644 index 0000000000..00ec0904b5 --- /dev/null +++ b/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch @@ -0,0 +1,59 @@ +From 3eec35b2d1cf2a0c978728246211201d5868f6b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:14:29 +0800 +Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run + +From: Tao Chen + +[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ] + +Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run +called all the way from graph tracer, which disables preemption in +function_graph_enter_regs, as Jiri and Yonghong suggested, there is no +need to use migrate_disable. As a result, some overhead may will be reduced. +And add cant_sleep check for __this_cpu_inc_return. + +Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 132c8be6f635c..60e89f56dec3f 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2703,20 +2703,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct pt_regs *regs; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + bpf_prog_inc_misses_counter(link->link.prog); + err = 1; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr()); + old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.51.0 + diff --git a/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch new file mode 100644 index 0000000000..9accc764c9 --- /dev/null +++ b/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch @@ -0,0 +1,139 @@ +From ef4d8037927f36260b36df8570f884e6cfffb5db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:12:14 +0000 +Subject: bpf/selftests: Fix test_tcpnotify_user + +From: Matt Bobrowski + +[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ] + +Based on a bisect, it appears that commit 7ee988770326 ("timers: +Implement the hierarchical pull model") has somehow inadvertently +broken BPF selftest test_tcpnotify_user. The error that is being +generated by this test is as follows: + + FAILED: Wrong stats Expected 10 calls, got 8 + +It looks like the change allows timer functions to be run on CPUs +different from the one they are armed on. The test had pinned itself +to CPU 0, and in the past the retransmit attempts also occurred on CPU +0. The test had set the max_entries attribute for +BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling +bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was +likely to be in range. With the change to allow timers to run on other +CPUs, the current CPU tasked with performing the retransmit might be +bumped and in turn fall out of range, as the event will be filtered +out via __bpf_perf_event_output() using: + + if (unlikely(index >= array->map.max_entries)) + return -E2BIG; + +A possible change would be to explicitly set the max_entries attribute +for perf_event_map in test_tcpnotify_kern.c to a value that's at least +as large as the number of CPUs. As it turns out however, if the field +is left unset, then the libbpf will determine the number of CPUs available +on the underlying system and update the max_entries attribute accordingly +in map_set_def_max_entries(). + +A further problem with the test is that it has a thread that continues +running up until the program exits. The main thread cleans up some +LIBBPF data structures, while the other thread continues to use them, +which inevitably will trigger a SIGSEGV. This can be dealt with by +telling the thread to run for as long as necessary and doing a +pthread_join on it before exiting the program. + +Finally, I don't think binding the process to CPU 0 is meaningful for +this test any more, so get rid of that. + +Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") +Signed-off-by: Matt Bobrowski +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 - + .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++---------- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85..ef00d38b0a8d2 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f..35b4893ccdf8a 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +-- +2.51.0 + diff --git a/queue-6.16/bpf-tidy-verifier-bug-message.patch b/queue-6.16/bpf-tidy-verifier-bug-message.patch new file mode 100644 index 0000000000..2c88648895 --- /dev/null +++ b/queue-6.16/bpf-tidy-verifier-bug-message.patch @@ -0,0 +1,60 @@ +From 9bf89434aae0c7b45b0f4383b635a0dde76200ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 20:58:20 +0200 +Subject: bpf: Tidy verifier bug message + +From: Paul Chaignon + +[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ] + +Yonghong noticed that error messages for potential verifier bugs often +have a '(1)' at the end. This is happening because verifier_bug_if(cond, +env, fmt, args...) prints "(" #cond ")\n" as part of the message and +verifier_bug() is defined as: + + #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args) + +Hence, verifier_bug() always ends up displaying '(1)'. This small patch +fixes it by having verifier_bug_if conditionally call verifier_bug +instead of the other way around. + +Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs") +Reported-by: Yonghong Song +Signed-off-by: Paul Chaignon +Signed-off-by: Andrii Nakryiko +Tested-by: Eduard Zingerman +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf_verifier.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index 256274acb1d86..e824d091ad2b0 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -846,13 +846,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env, + #define verifier_bug_if(cond, env, fmt, args...) \ + ({ \ + bool __cond = (cond); \ +- if (unlikely(__cond)) { \ +- BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args); \ +- bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args); \ +- } \ ++ if (unlikely(__cond)) \ ++ verifier_bug(env, fmt " (" #cond ")", ##args); \ + (__cond); \ + }) +-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args) ++#define verifier_bug(env, fmt, args...) \ ++ ({ \ ++ BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args); \ ++ bpf_log(&env->log, "verifier bug: " fmt "\n", ##args); \ ++ }) + + static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env) + { +-- +2.51.0 + diff --git a/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch b/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch new file mode 100644 index 0000000000..3f52b608d4 --- /dev/null +++ b/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch @@ -0,0 +1,70 @@ +From b671c0817fec5f7295f7ff928589f1014a266b46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 08:40:45 +0930 +Subject: btrfs: return any hit error from extent_writepage_io() + +From: Qu Wenruo + +[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ] + +Since the support of bs < ps support, extent_writepage_io() will submit +multiple blocks inside the folio. + +But if we hit error submitting one sector, but the next sector can still +be submitted successfully, the function extent_writepage_io() will still +return 0. + +This will make btrfs to silently ignore the error without setting error +flag for the filemap. + +Fix it by recording the first error hit, and always return that value. + +Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed") +Reviewed-by: Daniel Vacek +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index b843db855f402..40ec2e0a14c9f 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1622,7 +1622,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + struct btrfs_fs_info *fs_info = inode->root->fs_info; + unsigned long range_bitmap = 0; + bool submitted_io = false; +- bool error = false; ++ int found_error = 0; + const u64 folio_start = folio_pos(folio); + const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio); + u64 cur; +@@ -1682,7 +1682,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + */ + btrfs_mark_ordered_io_finished(inode, folio, cur, + fs_info->sectorsize, false); +- error = true; ++ if (!found_error) ++ found_error = ret; + continue; + } + submitted_io = true; +@@ -1699,11 +1700,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + * If we hit any error, the corresponding sector will have its dirty + * flag cleared and writeback finished, thus no need to handle the error case. + */ +- if (!submitted_io && !error) { ++ if (!submitted_io && !found_error) { + btrfs_folio_set_writeback(fs_info, folio, start, len); + btrfs_folio_clear_writeback(fs_info, folio, start, len); + } +- return ret; ++ return found_error; + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch b/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch new file mode 100644 index 0000000000..430f57d2c9 --- /dev/null +++ b/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch @@ -0,0 +1,47 @@ +From 264f0a08cec5552d555d96f524d1816f3469cce6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jun 2025 13:19:35 +0200 +Subject: clocksource/drivers/tegra186: Avoid 64-bit division + +From: Arnd Bergmann + +[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ] + +The newly added function causes a build failure on 32-bit targets with +older compiler version such as gcc-10: + +arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft': +timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod' + +The calculation can trivially be changed to avoid the division entirely, +as USEC_PER_SEC is a multiple of 5. Change both such calculation for +consistency, even though gcc apparently managed to optimize the other one +properly already. + +[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ] + +Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-tegra186.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c +index 7b506de654386..47bdb1e320af9 100644 +--- a/drivers/clocksource/timer-tegra186.c ++++ b/drivers/clocksource/timer-tegra186.c +@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt) + tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR); + + /* configure timer (system reset happens on the fifth expiration) */ +- value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) | ++ value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) | + TMRCR_PERIODIC | TMRCR_ENABLE; + tmr_writel(wdt->tmr, value, TMRCR); + +-- +2.51.0 + diff --git a/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch b/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch new file mode 100644 index 0000000000..4441eaa73e --- /dev/null +++ b/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch @@ -0,0 +1,47 @@ +From b7a4ae2f9ca2850f01bed1b1b4b6692f44e4253b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jun 2025 10:55:55 -0700 +Subject: clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation + +From: Guenter Roeck + +[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ] + +Building the driver on xtensa fails with + +tensa-linux-ld: drivers/clocksource/timer-tegra186.o: + in function `tegra186_timer_remove': +timer-tegra186.c:(.text+0x350): + undefined reference to `__udivdi3' + +Avoid the problem by rearranging the offending code to avoid the 64-bit +divide operation. + +Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") +Signed-off-by: Guenter Roeck +Signed-off-by: Daniel Lezcano +Reviewed-by: Jon Hunter +Cc: Pohsun Su +Cc: Robert Lin +Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-tegra186.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c +index e5394f98a02e6..7b506de654386 100644 +--- a/drivers/clocksource/timer-tegra186.c ++++ b/drivers/clocksource/timer-tegra186.c +@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd) + * counter value to the time of the counter expirations that + * remain. + */ +- timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration); ++ timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration); + + /* + * Convert the current counter value to seconds, +-- +2.51.0 + diff --git a/queue-6.16/coresight-appropriately-disable-programming-clocks.patch b/queue-6.16/coresight-appropriately-disable-programming-clocks.patch new file mode 100644 index 0000000000..a783fd3d79 --- /dev/null +++ b/queue-6.16/coresight-appropriately-disable-programming-clocks.patch @@ -0,0 +1,363 @@ +From f22c0c167019dec23469f07e06de773d99b073b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:40 +0100 +Subject: coresight: Appropriately disable programming clocks + +From: Leo Yan + +[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ] + +Some CoreSight components have programming clocks (pclk) and are enabled +using clk_get() and clk_prepare_enable(). However, in many cases, these +clocks are not disabled when modules exit and only released by clk_put(). + +To fix the issue, this commit refactors programming clock by replacing +clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled() +for enabling APB clock. If the "apb_pclk" clock is not found, a NULL +pointer is returned, and the function proceeds to attempt enabling the +"apb" clock. + +Since ACPI platforms rely on firmware to manage clocks, returning a NULL +pointer in this case leaves clock management to the firmware rather than +the driver. This effectively avoids a clock imbalance issue during +module removal - where the clock could be disabled twice: once during +the ACPI runtime suspend and again during the devm resource release. + +Callers are updated to reuse the returned error value. + +With the change, programming clocks are managed as resources in driver +model layer, allowing clock cleanup to be handled automatically. As a +result, manual cleanup operations are no longer needed and are removed +from the Coresight drivers. + +Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-catu.c | 9 ++------ + .../hwtracing/coresight/coresight-cpu-debug.c | 6 +---- + .../hwtracing/coresight/coresight-ctcu-core.c | 10 ++------- + .../coresight/coresight-etm4x-core.c | 9 ++------ + .../hwtracing/coresight/coresight-funnel.c | 6 +---- + .../coresight/coresight-replicator.c | 6 +---- + drivers/hwtracing/coresight/coresight-stm.c | 4 +--- + .../hwtracing/coresight/coresight-tmc-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-tpiu.c | 4 +--- + include/linux/coresight.h | 22 ++++++++----------- + 10 files changed, 21 insertions(+), 59 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index af2a55f0c907c..4c345ff2cff14 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + pm_runtime_get_noresume(&pdev->dev); + pm_runtime_set_active(&pdev->dev); +@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev) + dev_set_drvdata(&pdev->dev, drvdata); + ret = __catu_probe(&pdev->dev, res); + pm_runtime_put(&pdev->dev); +- if (ret) { ++ if (ret) + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); +- } + + return ret; + } +@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev) + + __catu_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index a871d997330b0..e39dfb886688e 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + dev_set_drvdata(&pdev->dev, drvdata); + pm_runtime_get_noresume(&pdev->dev); +@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev) + if (ret) { + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + return ret; + } +@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev) + + __debug_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c +index c6bafc96db963..de279efe34058 100644 +--- a/drivers/hwtracing/coresight/coresight-ctcu-core.c ++++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c +@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev) + + drvdata->apb_clk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->apb_clk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->apb_clk); + + cfgs = of_device_get_match_data(dev); + if (cfgs) { +@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev) + desc.access = CSDEV_ACCESS_IOMEM(base); + + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- if (!IS_ERR_OR_NULL(drvdata->apb_clk)) +- clk_put(drvdata->apb_clk); +- ++ if (IS_ERR(drvdata->csdev)) + return PTR_ERR(drvdata->csdev); +- } + + return 0; + } +@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev) + + ctcu_remove(pdev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->apb_clk)) +- clk_put(drvdata->apb_clk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 81f20a167e001..4b98a7bf4cb73 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + if (res) { + drvdata->base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(drvdata->base)) { +- clk_put(drvdata->pclk); ++ if (IS_ERR(drvdata->base)) + return PTR_ERR(drvdata->base); +- } + } + + dev_set_drvdata(&pdev->dev, drvdata); +@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev) + if (drvdata) + etm4_remove_dev(drvdata); + pm_runtime_disable(&pdev->dev); +- +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + static const struct amba_id etm4_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index b1922dbe9292b..36fc4e991458c 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + /* + * Map the device base for dynamic-funnel, which has been +@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res) + out_disable_clk: + if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) + clk_disable_unprepare(drvdata->atclk); +- if (ret && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); + return ret; + } + +@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev) + + funnel_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + static const struct of_device_id funnel_match[] = { +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index 06efd2b01a0f7..6dd24eb10a94b 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + /* + * Map the device base for dynamic-replicator, which has been +@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res) + out_disable_clk: + if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) + clk_disable_unprepare(drvdata->atclk); +- if (ret && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); + return ret; + } + +@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev) + + replicator_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index e45c6c7204b44..88ee453b28154 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + dev_set_drvdata(dev, drvdata); + + base = devm_ioremap_resource(dev, res); +@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev) + + __stm_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 0b5e7635a084d..e867198b03e82 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + dev_set_drvdata(&pdev->dev, drvdata); + pm_runtime_get_noresume(&pdev->dev); +@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev) + + __tmc_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 3e01592884280..b2559c6fac6d2 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + dev_set_drvdata(dev, drvdata); + + /* Validity for the resource is already checked by the AMBA core */ +@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev) + + __tpiu_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/include/linux/coresight.h b/include/linux/coresight.h +index 4ac65c68bbf44..1e652e1578419 100644 +--- a/include/linux/coresight.h ++++ b/include/linux/coresight.h +@@ -6,6 +6,7 @@ + #ifndef _LINUX_CORESIGHT_H + #define _LINUX_CORESIGHT_H + ++#include + #include + #include + #include +@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base) + * Returns: + * + * clk - Clock is found and enabled +- * NULL - clock is not found ++ * NULL - Clock is controlled by firmware (ACPI device only) + * ERROR - Clock is found but failed to enable + */ + static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev) + { + struct clk *pclk; +- int ret; + +- pclk = clk_get(dev, "apb_pclk"); +- if (IS_ERR(pclk)) { +- pclk = clk_get(dev, "apb"); +- if (IS_ERR(pclk)) +- return NULL; +- } ++ /* Firmware controls clocks for an ACPI device. */ ++ if (has_acpi_companion(dev)) ++ return NULL; ++ ++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); ++ if (!pclk) ++ pclk = devm_clk_get_optional_enabled(dev, "apb"); + +- ret = clk_prepare_enable(pclk); +- if (ret) { +- clk_put(pclk); +- return ERR_PTR(ret); +- } + return pclk; + } + +-- +2.51.0 + diff --git a/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch b/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch new file mode 100644 index 0000000000..57d3b9f2e6 --- /dev/null +++ b/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch @@ -0,0 +1,281 @@ +From 0dcd0ffe1b7392820aeca3c4c0d8c5b40faad624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:41 +0100 +Subject: coresight: Appropriately disable trace bus clocks + +From: Leo Yan + +[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ] + +Some CoreSight components have trace bus clocks 'atclk' and are enabled +using clk_prepare_enable(). These clocks are not disabled when modules +exit. + +As atclk is optional, use devm_clk_get_optional_enabled() to manage it. +The benefit is the driver model layer can automatically disable and +release clocks. + +Check the returned value with IS_ERR() to detect errors but leave the +NULL pointer case if the clock is not found. And remove the error +handling codes which are no longer needed. + +Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etb10.c | 10 +++--- + .../coresight/coresight-etm3x-core.c | 9 ++--- + .../hwtracing/coresight/coresight-funnel.c | 36 ++++++------------- + .../coresight/coresight-replicator.c | 34 ++++++------------ + drivers/hwtracing/coresight/coresight-stm.c | 9 ++--- + drivers/hwtracing/coresight/coresight-tpiu.c | 10 ++---- + 6 files changed, 34 insertions(+), 74 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c +index d5efb085b30d3..8e81b41eb2226 100644 +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + dev_set_drvdata(dev, drvdata); + + /* validity for the resource is already checked by the AMBA core */ +diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c +index 1c6204e144221..baba2245b1dfb 100644 +--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c +@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id) + + spin_lock_init(&drvdata->spinlock); + +- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->cpu = coresight_get_cpu(dev); + if (drvdata->cpu < 0) +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index 36fc4e991458c..b044a4125310b 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel); + + static int funnel_probe(struct device *dev, struct resource *res) + { +- int ret; + void __iomem *base; + struct coresight_platform_data *pdata = NULL; + struct funnel_drvdata *drvdata; +@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res) + */ + if (res) { + base = devm_ioremap_resource(dev, res); +- if (IS_ERR(base)) { +- ret = PTR_ERR(base); +- goto out_disable_clk; +- } ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + drvdata->base = base; + desc.groups = coresight_funnel_groups; + desc.access = CSDEV_ACCESS_IOMEM(base); +@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res) + dev_set_drvdata(dev, drvdata); + + pdata = coresight_get_platform_data(dev); +- if (IS_ERR(pdata)) { +- ret = PTR_ERR(pdata); +- goto out_disable_clk; +- } ++ if (IS_ERR(pdata)) ++ return PTR_ERR(pdata); ++ + dev->platform_data = pdata; + + raw_spin_lock_init(&drvdata->spinlock); +@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res) + desc.pdata = pdata; + desc.dev = dev; + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- ret = PTR_ERR(drvdata->csdev); +- goto out_disable_clk; +- } ++ if (IS_ERR(drvdata->csdev)) ++ return PTR_ERR(drvdata->csdev); + +- ret = 0; +- +-out_disable_clk: +- if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) +- clk_disable_unprepare(drvdata->atclk); +- return ret; ++ return 0; + } + + static int funnel_remove(struct device *dev) +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index 6dd24eb10a94b..9e8bd36e7a9a2 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = { + + static int replicator_probe(struct device *dev, struct resource *res) + { +- int ret = 0; + struct coresight_platform_data *pdata = NULL; + struct replicator_drvdata *drvdata; + struct coresight_desc desc = { 0 }; +@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res) + */ + if (res) { + base = devm_ioremap_resource(dev, res); +- if (IS_ERR(base)) { +- ret = PTR_ERR(base); +- goto out_disable_clk; +- } ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + drvdata->base = base; + desc.groups = replicator_groups; + desc.access = CSDEV_ACCESS_IOMEM(base); +@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res) + dev_set_drvdata(dev, drvdata); + + pdata = coresight_get_platform_data(dev); +- if (IS_ERR(pdata)) { +- ret = PTR_ERR(pdata); +- goto out_disable_clk; +- } ++ if (IS_ERR(pdata)) ++ return PTR_ERR(pdata); + dev->platform_data = pdata; + + raw_spin_lock_init(&drvdata->spinlock); +@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res) + desc.dev = dev; + + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- ret = PTR_ERR(drvdata->csdev); +- goto out_disable_clk; +- } ++ if (IS_ERR(drvdata->csdev)) ++ return PTR_ERR(drvdata->csdev); + + replicator_reset(drvdata); +- +-out_disable_clk: +- if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) +- clk_disable_unprepare(drvdata->atclk); +- return ret; ++ return 0; + } + + static int replicator_remove(struct device *dev) +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index 88ee453b28154..57fbe3ad0fb20 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index b2559c6fac6d2..8d6179c83e5d3 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = { + + static int __tpiu_probe(struct device *dev, struct resource *res) + { +- int ret; + void __iomem *base; + struct coresight_platform_data *pdata = NULL; + struct tpiu_drvdata *drvdata; +@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res) + + spin_lock_init(&drvdata->spinlock); + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +-- +2.51.0 + diff --git a/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch b/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch new file mode 100644 index 0000000000..5dcf9372db --- /dev/null +++ b/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch @@ -0,0 +1,65 @@ +From 20525270cadf81e404a6c3f6b872ed71abd6a2f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:42 +0100 +Subject: coresight: Avoid enable programming clock duplicately + +From: Leo Yan + +[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ] + +The programming clock is enabled by AMBA bus driver before a dynamic +probe. As a result, a CoreSight driver may redundantly enable the same +clock. + +To avoid this, add a check for device type and skip enabling the +programming clock for AMBA devices. The returned NULL pointer will be +tolerated by the drivers. + +Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + include/linux/coresight.h | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/include/linux/coresight.h b/include/linux/coresight.h +index 1e652e1578419..bb49080ec8f96 100644 +--- a/include/linux/coresight.h ++++ b/include/linux/coresight.h +@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base) + * Returns: + * + * clk - Clock is found and enabled +- * NULL - Clock is controlled by firmware (ACPI device only) ++ * NULL - Clock is controlled by firmware (ACPI device only) or when managed ++ * by the AMBA bus driver instead + * ERROR - Clock is found but failed to enable + */ + static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev) + { +- struct clk *pclk; ++ struct clk *pclk = NULL; + + /* Firmware controls clocks for an ACPI device. */ + if (has_acpi_companion(dev)) + return NULL; + +- pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); +- if (!pclk) +- pclk = devm_clk_get_optional_enabled(dev, "apb"); ++ if (!dev_is_amba(dev)) { ++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); ++ if (!pclk) ++ pclk = devm_clk_get_optional_enabled(dev, "apb"); ++ } + + return pclk; + } +-- +2.51.0 + diff --git a/queue-6.16/coresight-catu-support-atclk.patch b/queue-6.16/coresight-catu-support-atclk.patch new file mode 100644 index 0000000000..fc5a07d53d --- /dev/null +++ b/queue-6.16/coresight-catu-support-atclk.patch @@ -0,0 +1,93 @@ +From 08af03eaac810667dd2fdbfbc4da2b49469232f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:38 +0100 +Subject: coresight: catu: Support atclk + +From: Leo Yan + +[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ] + +The atclk is an optional clock for the CoreSight CATU, but the driver +misses to initialize it. + +This change enables atclk in probe of the CATU driver, and dynamically +control the clock during suspend and resume. + +The checks for driver data and clocks in suspend and resume are not +needed, remove them. Add error handling in the resume function. + +Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++----- + drivers/hwtracing/coresight/coresight-catu.h | 1 + + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index 5058432233da1..af2a55f0c907c 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res) + struct coresight_platform_data *pdata = NULL; + void __iomem *base; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + catu_desc.name = coresight_alloc_device_name(&catu_devs, dev); + if (!catu_desc.name) + return -ENOMEM; +@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int catu_runtime_resume(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h +index 755776cd19c5b..6e6b7aac206dc 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.h ++++ b/drivers/hwtracing/coresight/coresight-catu.h +@@ -62,6 +62,7 @@ + + struct catu_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + int irq; +-- +2.51.0 + diff --git a/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch new file mode 100644 index 0000000000..217f0b2d98 --- /dev/null +++ b/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch @@ -0,0 +1,91 @@ +From 67b7702cb9904b701acf991b4c442f39e61e5826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 01:24:45 -0700 +Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR + +From: Yuanfang Zhang + +[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ] + +The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. +To avoid invalid accesses, introduce a check on numextinsel +(derived from TRCIDR5[11:9]) before reading or writing to this register. + +Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") +Signed-off-by: Yuanfang Zhang +Reviewed-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++ + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index cbea200489c8f..b4f1834a1af1e 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index ac649515054d9..823914fefa90a 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -999,6 +1000,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +-- +2.51.0 + diff --git a/queue-6.16/coresight-etm4x-support-atclk.patch b/queue-6.16/coresight-etm4x-support-atclk.patch new file mode 100644 index 0000000000..1cdc7f2983 --- /dev/null +++ b/queue-6.16/coresight-etm4x-support-atclk.patch @@ -0,0 +1,106 @@ +From c530e16abcd268e0a2e10a44cb9bbb657da3d0c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:39 +0100 +Subject: coresight: etm4x: Support atclk + +From: Leo Yan + +[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ] + +The atclk is an optional clock for the CoreSight ETMv4, but the driver +misses to initialize it. + +This change enables atclk in probe of the ETMv4 driver, and dynamically +control the clock during suspend and resume. + +No need to check the driver data and clock pointer in the runtime +suspend and resume, so remove checks. And add error handling in the +resume function. + +Add a minor fix to the comment format when adding the atclk field. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++- + 2 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index b4f1834a1af1e..81f20a167e001 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev) + if (WARN_ON(!drvdata)) + return -ENOMEM; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) + pm_save_enable = coresight_loses_context_with_cpu(dev) ? + PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; +@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); + + return 0; + } +@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev) + static int etm4_runtime_resume(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); + +- return 0; ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 823914fefa90a..13ec9ecef46f5 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -920,7 +920,8 @@ struct etmv4_save_state { + + /** + * struct etm4_drvdata - specifics associated to an ETM component +- * @pclk APB clock if present, otherwise NULL ++ * @pclk: APB clock if present, otherwise NULL ++ * @atclk: Optional clock for the core parts of the ETMv4. + * @base: Memory mapped base address for this component. + * @csdev: Component vitals needed by the framework. + * @spinlock: Only one at a time pls. +@@ -989,6 +990,7 @@ struct etmv4_save_state { + */ + struct etmv4_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + raw_spinlock_t spinlock; +-- +2.51.0 + diff --git a/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch b/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch new file mode 100644 index 0000000000..d7753ea448 --- /dev/null +++ b/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch @@ -0,0 +1,39 @@ +From 8d2d40924113a0320fd0149fdf6abd56c71710b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 20:20:22 +0800 +Subject: coresight: Fix incorrect handling for return value of devm_kzalloc + +From: Lin Yujun + +[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ] + +The return value of devm_kzalloc could be an null pointer, +use "!desc.pdata" to fix incorrect handling return value +of devm_kzalloc. + +Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE") +Signed-off-by: Lin Yujun +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 3dd2e1b4809dc..43643d2c5bdd0 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp + * into the device for that purpose. + */ + desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL); +- if (IS_ERR(desc.pdata)) ++ if (!desc.pdata) + goto cpu_clear; + + desc.type = CORESIGHT_DEV_TYPE_SINK; +-- +2.51.0 + diff --git a/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch b/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch new file mode 100644 index 0000000000..c33cde0deb --- /dev/null +++ b/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch @@ -0,0 +1,40 @@ +From 9a7c9606be1ac38293b5eeaff6536957995da309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 11:30:25 +0100 +Subject: coresight: fix indentation error in + cscfg_remove_owned_csdev_configs() + +From: Yeoreum Yun + +[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ] + +Fix wrong indentation in cscfg_remove_owned_csdev_configs() + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/ +Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev") +Signed-off-by: Yeoreum Yun +Reviewed-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-syscfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c +index 83dad24e0116d..6836b05986e80 100644 +--- a/drivers/hwtracing/coresight/coresight-syscfg.c ++++ b/drivers/hwtracing/coresight/coresight-syscfg.c +@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi + if (list_empty(&csdev->config_csdev_list)) + return; + +- guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock); ++ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock); + + list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) { + if (config_csdev->config_desc->load_owner == load_owner) +-- +2.51.0 + diff --git a/queue-6.16/coresight-fix-missing-include-for-field_get.patch b/queue-6.16/coresight-fix-missing-include-for-field_get.patch new file mode 100644 index 0000000000..15841afa5a --- /dev/null +++ b/queue-6.16/coresight-fix-missing-include-for-field_get.patch @@ -0,0 +1,77 @@ +From 6c9a601db68ed3ea1c68a1706f5674b279574f7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jul 2025 10:55:27 +0100 +Subject: coresight: Fix missing include for FIELD_GET + +From: James Clark + +[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ] + +Include the header for FIELD_GET which is only sometimes transitively +included on some configs and kernel releases. + +Reported-by: Linux Kernel Functional Testing +Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/ +Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits") +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 1 + + drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 + + drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 + + drivers/hwtracing/coresight/ultrasoc-smb.h | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index fa758cc218275..c2db94f2ab237 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -3,6 +3,7 @@ + * Copyright (c) 2012, The Linux Foundation. All rights reserved. + */ + ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 42e5d37403add..cbea200489c8f 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index ab251865b893d..e9eeea6240d55 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -4,6 +4,7 @@ + * Author: Mathieu Poirier + */ + ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h +index c4c111275627b..323f0ccb6878c 100644 +--- a/drivers/hwtracing/coresight/ultrasoc-smb.h ++++ b/drivers/hwtracing/coresight/ultrasoc-smb.h +@@ -7,6 +7,7 @@ + #ifndef _ULTRASOC_SMB_H + #define _ULTRASOC_SMB_H + ++#include + #include + #include + +-- +2.51.0 + diff --git a/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch b/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch new file mode 100644 index 0000000000..862a2d0688 --- /dev/null +++ b/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch @@ -0,0 +1,45 @@ +From c12c33020f31d8fadb7e4cf5b217fa7eae4e15ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jun 2025 18:26:19 +0800 +Subject: coresight: Only register perf symlink for sinks with alloc_buffer + +From: Yuanfang Zhang + +[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ] + +Ensure that etm_perf_add_symlink_sink() is only called for devices +that implement the alloc_buffer operation. This prevents invalid +symlink creation for dummy sinks that do not implement alloc_buffer. + +Without this check, perf may attempt to use a dummy sink that lacks +alloc_buffer operationsu to initialise perf's ring buffer, leading +to runtime failures. + +Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver") +Signed-off-by: Yuanfang Zhang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index c2db94f2ab237..1accd7cbd54bf 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) + goto out_unlock; + } + +- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { ++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || ++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && ++ sink_ops(csdev)->alloc_buffer) { + ret = etm_perf_add_symlink_sink(csdev); + + if (ret) { +-- +2.51.0 + diff --git a/queue-6.16/coresight-tmc-support-atclk.patch b/queue-6.16/coresight-tmc-support-atclk.patch new file mode 100644 index 0000000000..2741f19ec8 --- /dev/null +++ b/queue-6.16/coresight-tmc-support-atclk.patch @@ -0,0 +1,111 @@ +From 47c03bf665153fdbe3a4a980ce63cbe0d3cf7b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:37 +0100 +Subject: coresight: tmc: Support atclk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ] + +The atclk is an optional clock for the CoreSight TMC, but the driver +misses to initialize it. In most cases, TMC shares the atclk clock with +other CoreSight components. Since these components enable the clock +before the TMC device is initialized, the TMC continues properly, +which is why we don’t observe any lockup issues. + +This change enables atclk in probe of the TMC driver. Given the clock +is optional, it is possible to return NULL if the clock does not exist. +IS_ERR() is tolerant for this case. + +Dynamically disable and enable atclk during suspend and resume. The +clock pointers will never be error values if the driver has successfully +probed, and the case of a NULL pointer case will be handled by the clock +core layer. The driver data is always valid after probe. Therefore, +remove the related checks. Also in the resume flow adds error handling. + +Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-tmc.h | 2 ++ + 2 files changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 88afb16bb6bec..0b5e7635a084d 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res) + struct coresight_desc desc = { 0 }; + struct coresight_dev_list *dev_list = NULL; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + ret = -ENOMEM; + + /* Validity for the resource is already checked by the AMBA core */ +@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int tmc_runtime_resume(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 6541a27a018e6..cbb4ba4391585 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -210,6 +210,7 @@ struct tmc_resrv_buf { + + /** + * struct tmc_drvdata - specifics associated to an TMC component ++ * @atclk: optional clock for the core parts of the TMC. + * @pclk: APB clock if present, otherwise NULL + * @base: memory mapped base address for this component. + * @csdev: component vitals needed by the framework. +@@ -244,6 +245,7 @@ struct tmc_resrv_buf { + * Used by ETR/ETF. + */ + struct tmc_drvdata { ++ struct clk *atclk; + struct clk *pclk; + void __iomem *base; + struct coresight_device *csdev; +-- +2.51.0 + diff --git a/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch b/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch new file mode 100644 index 0000000000..144e938cb5 --- /dev/null +++ b/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch @@ -0,0 +1,54 @@ +From 1a902c3b480ae7c5a3be856c3917001351cf3f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 07:53:04 +0800 +Subject: coresight: tpda: fix the logic to setup the element size + +From: Jie Gan + +[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ] + +Some TPDM devices support both CMB and DSB datasets, requiring +the system to enable the port with both corresponding element sizes. + +Currently, the logic treats tpdm_read_element_size as successful if +the CMB element size is retrieved correctly, regardless of whether +the DSB element size is obtained. This behavior causes issues +when parsing data from TPDM devices that depend on both element sizes. + +To address this, the function should explicitly fail if the DSB +element size cannot be read correctly. + +Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element") +Reviewed-by: James Clark +Signed-off-by: Jie Gan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tpda.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c +index 0633f04beb240..333b3cb236859 100644 +--- a/drivers/hwtracing/coresight/coresight-tpda.c ++++ b/drivers/hwtracing/coresight/coresight-tpda.c +@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata, + if (tpdm_data->dsb) { + rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent), + "qcom,dsb-element-bits", &drvdata->dsb_esize); ++ if (rc) ++ goto out; + } + + if (tpdm_data->cmb) { +@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata, + "qcom,cmb-element-bits", &drvdata->cmb_esize); + } + ++out: + if (rc) + dev_warn_once(&csdev->dev, + "Failed to read TPDM Element size: %d\n", rc); +-- +2.51.0 + diff --git a/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch b/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch new file mode 100644 index 0000000000..601103b495 --- /dev/null +++ b/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch @@ -0,0 +1,41 @@ +From 20743beaee4e3272a6bc17140cec9fdc53ba2df2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 11:19:05 +0100 +Subject: coresight: trbe: Add ISB after TRBLIMITR write + +From: James Clark + +[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ] + +DEN0154 states that hardware will be allowed to ignore writes to TRB* +registers while the trace buffer is enabled. Add an ISB to ensure that +it's disabled before clearing the other registers. + +This is purely defensive because it's expected that arm_trbe_disable() +would be called before teardown which has the required ISB. + +Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call") +Signed-off-by: James Clark +Reviewed-by: Yeoreum Yun +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 8f426f94e32a1..f78c9b9dc0087 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata) + static void trbe_reset_local(struct trbe_cpudata *cpudata) + { + write_sysreg_s(0, SYS_TRBLIMITR_EL1); ++ isb(); + trbe_drain_buffer(); + write_sysreg_s(0, SYS_TRBPTR_EL1); + write_sysreg_s(0, SYS_TRBBASER_EL1); +-- +2.51.0 + diff --git a/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..319dc31911 --- /dev/null +++ b/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 07309267ba1f574119a3a693871c940f5a951bcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 8267dd1a2130d..8f426f94e32a1 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -23,7 +23,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..c8963ed374 --- /dev/null +++ b/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From 6fb2315b34bfae66edc60821c18cedf626accec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index f78c9b9dc0087..3dd2e1b4809dc 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..03d825a57b --- /dev/null +++ b/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From 3afa6de133b3aa596de54a40cd775d317133a108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index ef078426bfd51..38c165d526d14 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch new file mode 100644 index 0000000000..c1847bed11 --- /dev/null +++ b/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch @@ -0,0 +1,58 @@ +From 3ec92c313a1d3fee4e397bb23e87c6771a2d0ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 17:22:12 +0200 +Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe + +From: Johan Hovold + +[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ] + +Make sure to drop the reference to the saw device taken by +of_find_device_by_node() after retrieving its driver data during +probe(). + +Also drop the reference to the CPU node sooner to avoid leaking it in +case there is no saw node or device. + +Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index 5f386761b1562..f60a4cf536423 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch b/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch new file mode 100644 index 0000000000..6d7f899714 --- /dev/null +++ b/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch @@ -0,0 +1,77 @@ +From 9a90f37fbf162324e12134e501e439b413f34cad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:12:26 +0000 +Subject: cpuset: fix failure to enable isolated partition when containing + isolcpus + +From: Chen Ridong + +[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ] + +The 'isolcpus' parameter specified at boot time can be assigned to an +isolated partition. While it is valid put the 'isolcpus' in an isolated +partition, attempting to change a member cpuset to an isolated partition +will fail if the cpuset contains any 'isolcpus'. + +For example, the system boots with 'isolcpus=9', and the following +configuration works correctly: + + # cd /sys/fs/cgroup/ + # mkdir test + # echo 1 > test/cpuset.cpus + # echo isolated > test/cpuset.cpus.partition + # cat test/cpuset.cpus.partition + isolated + # echo 9 > test/cpuset.cpus + # cat test/cpuset.cpus.partition + isolated + # cat test/cpuset.cpus + 9 + +However, the following steps to convert a member cpuset to an isolated +partition will fail: + + # cd /sys/fs/cgroup/ + # mkdir test + # echo 9 > test/cpuset.cpus + # echo isolated > test/cpuset.cpus.partition + # cat test/cpuset.cpus.partition + isolated invalid (partition config conflicts with housekeeping setup) + +The issue occurs because the new partition state (new_prs) is used for +validation against housekeeping constraints before it has been properly +updated. To resolve this, move the assignment of new_prs before the +housekeeping validation check when enabling a root partition. + +Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup") +Signed-off-by: Chen Ridong +Reviewed-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index f9d7799c5c947..9e1fc18549059 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd, + xcpus = tmp->delmask; + if (compute_effective_exclusive_cpumask(cs, xcpus, NULL)) + WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus)); ++ new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED; + + /* + * Enabling partition root is not allowed if its +@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd, + + deleting = true; + subparts_delta++; +- new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED; + } else if (cmd == partcmd_disable) { + /* + * May need to add cpus back to parent's effective_cpus +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch b/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch new file mode 100644 index 0000000000..e4abacf055 --- /dev/null +++ b/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch @@ -0,0 +1,366 @@ +From f91dbbd9af48c04447a7e984c5de77a16838601a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:06 +0800 +Subject: crypto: hisilicon - check the sva module status while enabling or + disabling address prefetch + +From: Weili Qian + +[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ] + +After enabling address prefetch, check the sva module status. If all +previous prefetch requests from the sva module are not completed, then +disable the address prefetch to ensure normal execution of new task +operations. After disabling address prefetch, check if all requests +from the sva module have been completed. + +Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching") +Signed-off-by: Weili Qian +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++---- + drivers/crypto/hisilicon/sec2/sec_main.c | 48 +++++++++++++- + drivers/crypto/hisilicon/zip/zip_main.c | 79 +++++++++++++++++++---- + 3 files changed, 164 insertions(+), 26 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index 34f84978180f0..7b60e89015bdf 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -78,6 +78,11 @@ + #define HPRE_PREFETCH_ENABLE (~(BIT(0) | BIT(30))) + #define HPRE_PREFETCH_DISABLE BIT(30) + #define HPRE_SVA_DISABLE_READY (BIT(4) | BIT(8)) ++#define HPRE_SVA_PREFTCH_DFX4 0x301144 ++#define HPRE_WAIT_SVA_READY 500000 ++#define HPRE_READ_SVA_STATUS_TIMES 3 ++#define HPRE_WAIT_US_MIN 10 ++#define HPRE_WAIT_US_MAX 20 + + /* clock gate */ + #define HPRE_CLKGATE_CTL 0x301a10 +@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type) + return NULL; + } + ++static int hpre_wait_sva_ready(struct hisi_qm *qm) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4); ++ if (val) ++ count = 0; ++ else if (++count == HPRE_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX); ++ } while (++try_times < HPRE_WAIT_SVA_READY); ++ ++ if (try_times == HPRE_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static void hpre_config_pasid(struct hisi_qm *qm) + { + u32 val1, val2; +@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm) + writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE); + } + +-static void hpre_open_sva_prefetch(struct hisi_qm *qm) ++static void hpre_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + +- /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG); +- val &= HPRE_PREFETCH_ENABLE; ++ val |= HPRE_PREFETCH_DISABLE; + writel(val, qm->io_base + HPRE_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG, +- val, !(val & HPRE_PREFETCH_DISABLE), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX, ++ val, !(val & HPRE_SVA_DISABLE_READY), + HPRE_REG_RD_INTVRL_US, + HPRE_REG_RD_TMOUT_US); + if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)hpre_wait_sva_ready(qm); + } + +-static void hpre_close_sva_prefetch(struct hisi_qm *qm) ++static void hpre_open_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + ++ /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG); +- val |= HPRE_PREFETCH_DISABLE; ++ val &= HPRE_PREFETCH_ENABLE; + writel(val, qm->io_base + HPRE_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX, +- val, !(val & HPRE_SVA_DISABLE_READY), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG, ++ val, !(val & HPRE_PREFETCH_DISABLE), + HPRE_REG_RD_INTVRL_US, + HPRE_REG_RD_TMOUT_US); ++ if (ret) { ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ hpre_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = hpre_wait_sva_ready(qm); + if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ hpre_close_sva_prefetch(qm); + } + + static void hpre_enable_clock_gate(struct hisi_qm *qm) +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index ddb20f380b546..348f1f52956dc 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -93,6 +93,16 @@ + #define SEC_PREFETCH_ENABLE (~(BIT(0) | BIT(1) | BIT(11))) + #define SEC_PREFETCH_DISABLE BIT(1) + #define SEC_SVA_DISABLE_READY (BIT(7) | BIT(11)) ++#define SEC_SVA_PREFETCH_INFO 0x301ED4 ++#define SEC_SVA_STALL_NUM GENMASK(23, 8) ++#define SEC_SVA_PREFETCH_NUM GENMASK(2, 0) ++#define SEC_WAIT_SVA_READY 500000 ++#define SEC_READ_SVA_STATUS_TIMES 3 ++#define SEC_WAIT_US_MIN 10 ++#define SEC_WAIT_US_MAX 20 ++#define SEC_WAIT_QP_US_MIN 1000 ++#define SEC_WAIT_QP_US_MAX 2000 ++#define SEC_MAX_WAIT_TIMES 2000 + + #define SEC_DELAY_10_US 10 + #define SEC_POLL_TIMEOUT_US 1000 +@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + offset); ++ if (val & mask) ++ count = 0; ++ else if (++count == SEC_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX); ++ } while (++try_times < SEC_WAIT_SVA_READY); ++ ++ if (try_times == SEC_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static void sec_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; +@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm) + SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); + if (ret) + pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM); + } + + static void sec_open_sva_prefetch(struct hisi_qm *qm) +@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm) + ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, + val, !(val & SEC_PREFETCH_DISABLE), + SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) ++ if (ret) { + pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ sec_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM); ++ if (ret) ++ sec_close_sva_prefetch(qm); + } + + static void sec_engine_sva_config(struct hisi_qm *qm) +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 480fa590664a8..341c4564e21aa 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -95,10 +95,16 @@ + #define HZIP_PREFETCH_ENABLE (~(BIT(26) | BIT(17) | BIT(0))) + #define HZIP_SVA_PREFETCH_DISABLE BIT(26) + #define HZIP_SVA_DISABLE_READY (BIT(26) | BIT(30)) ++#define HZIP_SVA_PREFETCH_NUM GENMASK(18, 16) ++#define HZIP_SVA_STALL_NUM GENMASK(15, 0) + #define HZIP_SHAPER_RATE_COMPRESS 750 + #define HZIP_SHAPER_RATE_DECOMPRESS 140 +-#define HZIP_DELAY_1_US 1 +-#define HZIP_POLL_TIMEOUT_US 1000 ++#define HZIP_DELAY_1_US 1 ++#define HZIP_POLL_TIMEOUT_US 1000 ++#define HZIP_WAIT_SVA_READY 500000 ++#define HZIP_READ_SVA_STATUS_TIMES 3 ++#define HZIP_WAIT_US_MIN 10 ++#define HZIP_WAIT_US_MAX 20 + + /* clock gating */ + #define HZIP_PEH_CFG_AUTO_GATE 0x3011A8 +@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm) + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); + } + +-static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) ++static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + offset); ++ if (val & mask) ++ count = 0; ++ else if (++count == HZIP_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX); ++ } while (++try_times < HZIP_WAIT_SVA_READY); ++ ++ if (try_times == HZIP_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ ++static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + +- /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG); +- val &= HZIP_PREFETCH_ENABLE; ++ val |= HZIP_SVA_PREFETCH_DISABLE; + writel(val, qm->io_base + HZIP_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG, +- val, !(val & HZIP_SVA_PREFETCH_DISABLE), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS, ++ val, !(val & HZIP_SVA_DISABLE_READY), + HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US); + if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM); + } + +-static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) ++static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + ++ /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG); +- val |= HZIP_SVA_PREFETCH_DISABLE; ++ val &= HZIP_PREFETCH_ENABLE; + writel(val, qm->io_base + HZIP_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS, +- val, !(val & HZIP_SVA_DISABLE_READY), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG, ++ val, !(val & HZIP_SVA_PREFETCH_DISABLE), + HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US); ++ if (ret) { ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ hisi_zip_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM); + if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ hisi_zip_close_sva_prefetch(qm); + } + + static void hisi_zip_enable_clock_gate(struct hisi_qm *qm) +@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + void __iomem *base = qm->io_base; + u32 dcomp_bm, comp_bm; + u32 zip_core_en; ++ int ret; + + /* qm user domain */ + writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1); +@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + +- return hisi_dae_set_user_domain(qm); ++ ret = hisi_dae_set_user_domain(qm); ++ if (ret) ++ goto close_sva_prefetch; ++ ++ return 0; ++ ++close_sva_prefetch: ++ hisi_zip_close_sva_prefetch(qm); ++ return ret; + } + + static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable) +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch b/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch new file mode 100644 index 0000000000..51fcdbc0b7 --- /dev/null +++ b/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch @@ -0,0 +1,42 @@ +From 34143e1dd1528ff8c990d72418999d44e9773070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:07 +0800 +Subject: crypto: hisilicon/qm - check whether the input function and PF are on + the same device + +From: Zhushuai Yin + +[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ] + +Function rate limiting is set through physical function driver. +Users configure by providing function information and rate limit values. +Before configuration, it is necessary to check whether the +provided function and PF belong to the same device. + +Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") +Signed-off-by: Zhushuai Yin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 2b7b4b2033de4..56d80fc943bee 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -3827,6 +3827,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, + } + + pdev = container_of(dev, struct pci_dev, dev); ++ if (pci_physfn(pdev) != qm->pdev) { ++ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); ++ return -EINVAL; ++ } + + *fun_index = pdev->devfn; + +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch b/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch new file mode 100644 index 0000000000..1a808220af --- /dev/null +++ b/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch @@ -0,0 +1,113 @@ +From 3be5fe6c71604a53996d8868964fdbf4a8227a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:08 +0800 +Subject: crypto: hisilicon/qm - request reserved interrupt for virtual + function + +From: Weili Qian + +[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ] + +The device interrupt vector 3 is an error interrupt for +physical function and a reserved interrupt for virtual function. +However, the driver has not registered the reserved interrupt for +virtual function. When allocating interrupts, the number of interrupts +is allocated based on powers of two, which includes this interrupt. +When the system enables GICv4 and the virtual function passthrough +to the virtual machine, releasing the interrupt in the driver +triggers a warning. + +The WARNING report is: +WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 + +Therefore, register a reserved interrupt for VF and set the +IRQF_NO_AUTOEN flag to avoid that warning. + +Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers") +Signed-off-by: Weili Qian +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------ + 1 file changed, 32 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 56d80fc943bee..4f97806f6241b 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4733,6 +4733,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev) + } + EXPORT_SYMBOL_GPL(hisi_qm_reset_done); + ++static irqreturn_t qm_rsvd_irq(int irq, void *data) ++{ ++ struct hisi_qm *qm = data; ++ ++ dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n"); ++ ++ return IRQ_HANDLED; ++} ++ + static irqreturn_t qm_abnormal_irq(int irq, void *data) + { + struct hisi_qm *qm = data; +@@ -5016,7 +5025,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm) + struct pci_dev *pdev = qm->pdev; + u32 irq_vector, val; + +- if (qm->fun_type == QM_HW_VF) ++ if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3) + return; + + val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val; +@@ -5033,17 +5042,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm) + u32 irq_vector, val; + int ret; + +- if (qm->fun_type == QM_HW_VF) +- return 0; +- + val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val; + if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) + return 0; +- + irq_vector = val & QM_IRQ_VECTOR_MASK; ++ ++ /* For VF, this is a reserved interrupt in V3 version. */ ++ if (qm->fun_type == QM_HW_VF) { ++ if (qm->ver < QM_HW_V3) ++ return 0; ++ ++ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq, ++ IRQF_NO_AUTOEN, qm->dev_name, qm); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret); ++ return ret; ++ } ++ return 0; ++ } ++ + ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm); + if (ret) +- dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret); ++ dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret); + + return ret; + } +@@ -5409,6 +5429,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm) + pci_set_master(pdev); + + num_vec = qm_get_irq_num(qm); ++ if (!num_vec) { ++ dev_err(dev, "Device irq num is zero!\n"); ++ ret = -EINVAL; ++ goto err_get_pci_res; ++ } ++ num_vec = roundup_pow_of_two(num_vec); + ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI); + if (ret < 0) { + dev_err(dev, "Failed to enable MSI vectors!\n"); +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch new file mode 100644 index 0000000000..e1cdbdc10c --- /dev/null +++ b/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch @@ -0,0 +1,38 @@ +From 8bf2673e9d899b8be6d9d60150277a840d1fdd35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:57:54 +0800 +Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs + +From: Chenghai Huang + +[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ] + +When the initialization of qm->debug.acc_diff_reg fails, +the probe process does not exit. However, after qm->debug.qm_diff_regs is +freed, it is not set to NULL. This can lead to a double free when the +remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs +should be set to NULL after it is freed. + +Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index 45e130b901eb5..17eb236e9ee4d 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch new file mode 100644 index 0000000000..2704114429 --- /dev/null +++ b/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch @@ -0,0 +1,200 @@ +From d491e8033750daf3b9bd6daa7b63703561385703 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:05 +0800 +Subject: crypto: hisilicon - re-enable address prefetch after device resuming + +From: Chenghai Huang + +[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ] + +When the device resumes from a suspended state, it will revert to its +initial state and requires re-enabling. Currently, the address prefetch +function is not re-enabled after device resuming. Move the address prefetch +enable to the initialization process. In this way, the address prefetch +can be enabled when the device resumes by calling the initialization +process. + +Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +- + drivers/crypto/hisilicon/qm.c | 3 - + drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------ + drivers/crypto/hisilicon/zip/zip_main.c | 5 +- + 4 files changed, 43 insertions(+), 48 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index f5b47e5ff48a4..34f84978180f0 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 7c41f9593d039..2b7b4b2033de4 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4448,9 +4448,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 72cf48d1f3ab8..ddb20f380b546 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index fb7b19927dd32..480fa590664a8 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + +@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return hisi_dae_set_user_domain(qm); +@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- hisi_zip_set_high_perf(qm); +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +-- +2.51.0 + diff --git a/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch new file mode 100644 index 0000000000..c34bfff201 --- /dev/null +++ b/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch @@ -0,0 +1,67 @@ +From b3e79420f39b4e5ae75ba5a09c79453aa7f895a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:04 +0800 +Subject: crypto: hisilicon/zip - remove unnecessary validation for + high-performance mode configurations + +From: Chenghai Huang + +[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ] + +When configuring the high-performance mode register, there is no +need to verify whether the register has been successfully +enabled, as there is no possibility of a write failure for this +register. + +Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index d8ba23b7cc7dd..fb7b19927dd32 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; ++ hisi_zip_set_high_perf(qm); + + hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); +-- +2.51.0 + diff --git a/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch b/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch new file mode 100644 index 0000000000..9119874460 --- /dev/null +++ b/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch @@ -0,0 +1,45 @@ +From 117e481df8d43017446133478cca12f38de23749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 14:03:30 +0200 +Subject: crypto: keembay - Add missing check after sg_nents_for_len() + +From: Thomas Fourier + +[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ] + +sg_nents_for_len() returns an int which is negative in case of error. + +Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +index 8f9e21ced0fe1..48281d8822603 100644 +--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c ++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + struct device *dev = rctx->hcu_dev->dev; + unsigned int remainder = 0; + unsigned int total; +- size_t nents; ++ int nents; + size_t count; + int rc; + int i; +@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + /* Determine the number of scatter gather list entries to process. */ + nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); + ++ if (nents < 0) ++ return nents; ++ + /* If there are entries to process, map them. */ + if (nents) { + rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, +-- +2.51.0 + diff --git a/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch b/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch new file mode 100644 index 0000000000..0bd5c3fe45 --- /dev/null +++ b/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch @@ -0,0 +1,42 @@ +From 09d4f409fd6d302971b34a3b54c0803ad76a28fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:24:57 +0200 +Subject: crypto: octeontx2 - Call strscpy() with correct size argument + +From: Thorsten Blum + +[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ] + +In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length +of the source string rather than the size of the destination buffer. + +This is fine as long as the destination buffer is larger than the source +string, but we should still use the destination buffer size instead to +call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer, +we can safely omit the size argument and let strscpy() infer it using +sizeof(). + +Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups") +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +index cc47e361089a0..ebdf4efa09d4d 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf, + return -EINVAL; + } + err_msg = "Invalid engine group format"; +- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1); ++ strscpy(tmp_buf, ctx->val.vstr); + start = tmp_buf; + + has_se = has_ie = has_ae = false; +-- +2.51.0 + diff --git a/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch b/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch new file mode 100644 index 0000000000..02974fa5b6 --- /dev/null +++ b/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch @@ -0,0 +1,51 @@ +From 30216dd0c690f0a837200ef09c9a7e62eb5ebe69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 23:22:38 +0300 +Subject: dm vdo: return error on corrupted metadata in start_restoring_volume + functions + +From: Ivan Abramov + +[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ] + +The return values of VDO_ASSERT calls that validate metadata are not acted +upon. + +Return UDS_CORRUPT_DATA in case of an error. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a4eb7e255517 ("dm vdo: implement the volume index") +Signed-off-by: Ivan Abramov +Reviewed-by: Matthew Sakai +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-vdo/indexer/volume-index.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c +index 12f954a0c5325..afb062e1f1fb4 100644 +--- a/drivers/md/dm-vdo/indexer/volume-index.c ++++ b/drivers/md/dm-vdo/indexer/volume-index.c +@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) { + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0) + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +-- +2.51.0 + diff --git a/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch b/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch new file mode 100644 index 0000000000..7c04fc738d --- /dev/null +++ b/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch @@ -0,0 +1,44 @@ +From 48a2afd08c53a727913eb18a8b6b004d094f7fd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 11:07:38 -0500 +Subject: dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation + +From: Nathan Lynch + +[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ] + +Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc +warnings") inserted new documentation for @desc_free in the middle of +@tx_submit's description. + +Put @tx_submit's description back together, matching the indentation +style of the rest of the documentation for dma_async_tx_descriptor. + +Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings") +Reviewed-by: Dave Jiang +Signed-off-by: Nathan Lynch +Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index bb146c5ac3e4c..51e1e357892a0 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops { + * @phys: physical address of the descriptor + * @chan: target channel for this operation + * @tx_submit: accept the descriptor, assign ordered cookie and mark the ++ * descriptor pending. To be pushed on .issue_pending() call + * @desc_free: driver's callback function to free a resusable descriptor + * after completion +- * descriptor pending. To be pushed on .issue_pending() call + * @callback: routine to call after this operation is complete + * @callback_result: error result from a DMA transaction + * @callback_param: general parameter to pass to the callback routine +-- +2.51.0 + diff --git a/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch b/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch new file mode 100644 index 0000000000..362c243817 --- /dev/null +++ b/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch @@ -0,0 +1,38 @@ +From a7c29bbbde01bab45b827b6cf5dde74136b73369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 16:44:23 +0200 +Subject: docs: iio: ad3552r: Fix malformed code-block directive + +From: Jorge Marques + +[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ] + +Missing required double dot and line break. + +Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver") +Signed-off-by: Jorge Marques +Reviewed-by: David Lechner +Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + Documentation/iio/ad3552r.rst | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst +index f5d59e4e86c7e..4274e35f503d9 100644 +--- a/Documentation/iio/ad3552r.rst ++++ b/Documentation/iio/ad3552r.rst +@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``. + Usage examples + -------------- + +-. code-block:: bash ++.. code-block:: bash ++ + root:/sys/bus/iio/devices/iio:device0# cat data_source + normal + root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source +-- +2.51.0 + diff --git a/queue-6.16/documentation-trace-historgram-design-separate-sched.patch b/queue-6.16/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..b320f6f301 --- /dev/null +++ b/queue-6.16/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 25222334ab4dd34266235a80c81aee8a3d663e45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 5765eb3e9efa7..a30f4bed11b4e 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..9c8653c4ca --- /dev/null +++ b/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From 8dca7cd8cf20f46eefacd2c95ece62025f497d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 340525155e993..715ae053dc8a1 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -892,7 +892,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..e6383e025c --- /dev/null +++ b/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 56bac4571fbabd311519e712a9de7a0f5baae56e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index c19094481630d..340525155e993 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -890,6 +890,11 @@ int __register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch b/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch new file mode 100644 index 0000000000..948aacafed --- /dev/null +++ b/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch @@ -0,0 +1,103 @@ +From cad1ff1c1b318cc181099adcac371e513b1f9cce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 12:14:01 +0530 +Subject: drm/amd/display: Add NULL pointer checks in dc_stream cursor + attribute functions + +From: Srinivasan Shanmugam + +[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ] + +The function dc_stream_set_cursor_attributes() currently dereferences +the `stream` pointer and nested members `stream->ctx->dc->current_state` +without checking for NULL. + +All callers of these functions, such as in +`dcn30_apply_idle_power_optimizations()` and +`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks +before calling these functions. + +Fixes below: +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() +error: we previously assumed 'stream' could be null (see line 334) + +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c + 327 bool dc_stream_program_cursor_attributes( + 328 struct dc_stream_state *stream, + 329 const struct dc_cursor_attributes *attributes) + 330 { + 331 struct dc *dc; + 332 bool reset_idle_optimizations = false; + 333 + 334 dc = stream ? stream->ctx->dc : NULL; + ^^^^^^ +The old code assumed stream could be NULL. + + 335 +--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) { + ^^^^^^ +The refactor added an unchecked dereference. + +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c + 313 bool dc_stream_set_cursor_attributes( + 314 struct dc_stream_state *stream, + 315 const struct dc_cursor_attributes *attributes) + 316 { + 317 bool result = false; + 318 + 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. +This function used to check for if stream as NULL and return false at +the start. Probably we should add that back. + +Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic") +Reported-by: Dan Carpenter +Cc: Alex Hung +Cc: Alvin Lee +Cc: Ray Wu +Cc: Dillon Varone +Cc: Aurabindo Pillai +Cc: Roman Li +Cc: ChiaHsuan Chung +Cc: Harry Wentland +Cc: Daniel Wheeler +Cc: Tom Chung +Cc: Wenjing Liu +Cc: Jun Lei +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Dillon Varone +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +index b883fb24fa127..2a68d470d093a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes( + { + bool result = false; + ++ if (!stream) ++ return false; ++ + if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { + stream->cursor_attributes = *attributes; + result = true; +@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes( + struct dc *dc; + bool reset_idle_optimizations = false; + +- dc = stream ? stream->ctx->dc : NULL; ++ if (!stream) ++ return false; ++ ++ dc = stream->ctx->dc; + + if (dc_stream_set_cursor_attributes(stream, attributes)) { + dc_z10_restore(dc); +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch new file mode 100644 index 0000000000..edce727f35 --- /dev/null +++ b/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch @@ -0,0 +1,34 @@ +From 110db373f83a4974b141fc49e439b04453006bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:50:14 +0800 +Subject: drm/amd/display: Remove redundant semicolons + +From: Liao Yuanhong + +[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ] + +Remove unnecessary semicolons. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Liao Yuanhong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4..6c75aa82327ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch new file mode 100644 index 0000000000..a658408b8d --- /dev/null +++ b/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch @@ -0,0 +1,57 @@ +From 1967bfbc817e3f91e0a88cff887ee88c595a3da7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:07 +0200 +Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ] + +Based on some comments in dm_pp_display_configuration +above the crtc_index and line_time fields, these values +are programmed to the SMC to work around an SMC hang +when it switches MCLK. + +According to Alex, the Windows driver programs them to: +mclk_change_block_cp_min = 200 / line_time +mclk_change_block_cp_max = 100 / line_time +Let's use the same for the sake of consistency. + +Previously we used the watermark values, but it seemed buggy +as the code was mixing up low/high and A/B watermarks, and +was not saving a low watermark value on DCE 6, so +mclk_change_block_cp_max would be always zero previously. + +Split this change off from the previous si_upload_smc_data +to make it easier to bisect, in case it causes any issues. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index a0cdf6e2d788e..223f59bbf49de 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + crtc_index = amdgpu_crtc->crtc_id; + + if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; + } + } + +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch new file mode 100644 index 0000000000..5db526eccf --- /dev/null +++ b/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch @@ -0,0 +1,48 @@ +From 5bf981e500519d78a5598495268a493d522c7729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:09 +0200 +Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ] + +According to pp_pm_compute_clocks the non-DC display code +has "issues with mclk switching with refresh rates over 120 hz". +The workaround is to disable MCLK switching in this case. + +Do the same for legacy DPM. + +Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c..2d2d2d5e67634 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch new file mode 100644 index 0000000000..46322d1220 --- /dev/null +++ b/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch @@ -0,0 +1,99 @@ +From 506b9151ac71caf81b1d00e241792beedd07fa84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:10 +0200 +Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks + (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ] + +Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk +switching on Oland when two 4K 60Hz monitors are connected") + +This is an ad-hoc DPM fix, necessary because we don't have +proper bandwidth calculation for DCE 6. + +We define "high pixelclock" for SI as higher than necessary +for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into +this category. + +When two high pixel clock displays are connected to Oland, +additionally disable shader clock switching, which results in +a higher voltage, thereby addressing some visible flickering. + +v2: +Add more comments. +v3: +Split into two commits for easier review. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index d70104bdaa998..80d79a7f8edf1 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch new file mode 100644 index 0000000000..47bf664c57 --- /dev/null +++ b/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch @@ -0,0 +1,53 @@ +From 933186d17d426895d9177d78936b0b391ccc3ac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:04 +0200 +Subject: drm/amd/pm: Disable ULV even if unsupported (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ] + +Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode +is unsupported, to make sure it is properly turned off. + +v3: +Simplify si_disable_ulv further. +Always check the return value of amdgpu_si_send_msg_to_smc. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 4c0e976004ba4..50da1eed8ddf0 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; ++ PPSMC_Result r; + +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; +- +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch new file mode 100644 index 0000000000..2a09d6ca39 --- /dev/null +++ b/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch @@ -0,0 +1,106 @@ +From d647b1605a6cfcfdf0a250fea64040517ca53578 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:06 +0200 +Subject: drm/amd/pm: Fix si_upload_smc_data (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ] + +The si_upload_smc_data function uses si_write_smc_soft_register +to set some register values in the SMC, and expects the result +to be PPSMC_Result_OK which is 1. + +The PPSMC_Result_OK / PPSMC_Result_Failed values are used for +checking the result of a command sent to the SMC. +However, the si_write_smc_soft_register actually doesn't send +any commands to the SMC and returns zero on success, +so this check was incorrect. + +Fix that by not checking the return value, just like other +calls to si_write_smc_soft_register. + +v3: +Additionally, when no display is plugged in, there is no need +to restrict MCLK switching, so program the registers to zero. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++---------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 50da1eed8ddf0..a0cdf6e2d788e 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch new file mode 100644 index 0000000000..af4b5b5996 --- /dev/null +++ b/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch @@ -0,0 +1,53 @@ +From 50121b0e4d99ea1c9aee11ba5af9833602536827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:08 +0200 +Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ] + +Some parts of the code base expect that MCLK switching is turned +off when the vblank time is set to zero. + +According to pp_pm_compute_clocks the non-DC code has issues +with MCLK switching with refresh rates over 120 Hz. + +v3: +Add code comment to explain this better. +Add an if statement instead of changing the switch_limit. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 223f59bbf49de..d70104bdaa998 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +-- +2.51.0 + diff --git a/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch b/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch new file mode 100644 index 0000000000..bd91e3b4d6 --- /dev/null +++ b/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch @@ -0,0 +1,100 @@ +From 90467f5e9879dde46570c7ff49599aa08fe6fe6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:49:35 +0200 +Subject: drm/amdgpu: Fix allocating extra dwords for rings (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ] + +Rename extra_dw to extra_bytes and document what it's for. + +The value is already used as if it were bytes in vcn_v4_0.c +and in amdgpu_ring_init. Just adjust the dword count in +jpeg_v1_0.c so that it becomes a byte count. + +v2: +Rename extra_dw to extra_bytes as discussed during review. + +Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring") +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++- + drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c | 2 +- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 2 +- + 4 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index a0b7ac7486dc5..5693830c0c364 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -335,7 +335,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring, + + /* Allocate ring buffer */ + if (ring->ring_obj == NULL) { +- r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE, ++ r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes, ++ PAGE_SIZE, + AMDGPU_GEM_DOMAIN_GTT, + &ring->ring_obj, + &ring->gpu_addr, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +index e1f25218943a4..0fc4a2ed88e26 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +@@ -202,7 +202,18 @@ struct amdgpu_ring_funcs { + bool support_64bit_ptrs; + bool no_user_fence; + bool secure_submission_supported; +- unsigned extra_dw; ++ ++ /** ++ * @extra_bytes: ++ * ++ * Optional extra space in bytes that is added to the ring size ++ * when allocating the BO that holds the contents of the ring. ++ * This space isn't used for command submission to the ring, ++ * but is just there to satisfy some hardware requirements or ++ * implement workarounds. It's up to the implementation of each ++ * specific ring to initialize this space. ++ */ ++ unsigned extra_bytes; + + /* ring read/write ptr handling */ + u64 (*get_rptr)(struct amdgpu_ring *ring); +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c +index 9e428e669ada6..b5bb7f4d607c1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c +@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = { + .nop = PACKET0(0x81ff, 0), + .support_64bit_ptrs = false, + .no_user_fence = true, +- .extra_dw = 64, ++ .extra_bytes = 256, + .get_rptr = jpeg_v1_0_decode_ring_get_rptr, + .get_wptr = jpeg_v1_0_decode_ring_get_wptr, + .set_wptr = jpeg_v1_0_decode_ring_set_wptr, +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +index e77f2df1beb77..c4e15ea1e66ed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = { + .type = AMDGPU_RING_TYPE_VCN_ENC, + .align_mask = 0x3f, + .nop = VCN_ENC_CMD_NO_OP, +- .extra_dw = sizeof(struct amdgpu_vcn_rb_metadata), ++ .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata), + .get_rptr = vcn_v4_0_unified_ring_get_rptr, + .get_wptr = vcn_v4_0_unified_ring_get_wptr, + .set_wptr = vcn_v4_0_unified_ring_set_wptr, +-- +2.51.0 + diff --git a/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch b/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch new file mode 100644 index 0000000000..673801dd1c --- /dev/null +++ b/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch @@ -0,0 +1,58 @@ +From 3779309fbe9017b6af7c6d191a315705c660bf40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:28:26 +0800 +Subject: drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest + +From: Xiang Liu + +[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ] + +Sriov guest side doesn't init ras feature hence the poison irq shouldn't +be put during hw fini. + +[25209.467154] Call Trace: +[25209.467156] +[25209.467158] ? srso_alias_return_thunk+0x5/0x7f +[25209.467162] ? show_trace_log_lvl+0x28e/0x2ea +[25209.467166] ? show_trace_log_lvl+0x28e/0x2ea +[25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] +[25209.467300] ? show_regs.part.0+0x23/0x29 +[25209.467303] ? show_regs.cold+0x8/0xd +[25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467403] ? __warn+0x8c/0x100 +[25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467503] ? report_bug+0xa4/0xd0 +[25209.467508] ? handle_bug+0x39/0x90 +[25209.467511] ? exc_invalid_op+0x19/0x70 +[25209.467513] ? asm_exc_invalid_op+0x1b/0x20 +[25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu] +[25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] +[25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] +[25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] + +Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq") +Signed-off-by: Xiang Liu +Reviewed-by: Stanley.Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +index 90d773dbe337c..21a35c83982e6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +@@ -446,7 +446,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block) + ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE); + } + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG)) ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev)) + amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0); + + return ret; +-- +2.51.0 + diff --git a/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch b/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch new file mode 100644 index 0000000000..8e26c8ea02 --- /dev/null +++ b/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch @@ -0,0 +1,57 @@ +From 4bd9c9b36ef11bad7193a0bd0123f69ff5553cde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:54:50 +0800 +Subject: drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest + +From: Xiang Liu + +[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ] + +Sriov guest side doesn't init ras feature hence the poison irq shouldn't +be put during hw fini. + +[25209.468816] Call Trace: +[25209.468817] +[25209.468818] ? srso_alias_return_thunk+0x5/0x7f +[25209.468820] ? show_trace_log_lvl+0x28e/0x2ea +[25209.468822] ? show_trace_log_lvl+0x28e/0x2ea +[25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] +[25209.468936] ? show_regs.part.0+0x23/0x29 +[25209.468939] ? show_regs.cold+0x8/0xd +[25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469038] ? __warn+0x8c/0x100 +[25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469135] ? report_bug+0xa4/0xd0 +[25209.469138] ? handle_bug+0x39/0x90 +[25209.469140] ? exc_invalid_op+0x19/0x70 +[25209.469142] ? asm_exc_invalid_op+0x1b/0x20 +[25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] +[25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] +[25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] + +Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq") +Signed-off-by: Xiang Liu +Reviewed-by: Stanley.Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +index faba11166efb6..802520d82a438 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block) + vinst->set_pg_state(vinst, AMD_PG_STATE_GATE); + } + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev)) + amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0); + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..946d318fad --- /dev/null +++ b/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From d7c0ed210a9cd930ac10e31a2295abdb78621167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 5dbaebb592b30..2e79a3afc7748 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @ip_block: Pointer to the amdgpu_ip_block for this hw instance. + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + { +@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..e411db9be7 --- /dev/null +++ b/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From a32ea2590f26b192121338a590d73551b281ed6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index a0f22ea6d15af..3d8b20828c068 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch b/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch new file mode 100644 index 0000000000..4c03c6e2d2 --- /dev/null +++ b/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch @@ -0,0 +1,48 @@ +From 03f158ba5f36cae43af37fb674de6eddc1b32101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 13:05:07 +0300 +Subject: drm/bridge: cdns-dsi: Fix the _atomic_check() + +From: Aradhya Bhatia + +[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ] + +Use the "adjusted_mode" for the dsi configuration check, as that is the +more appropriate display_mode for validation, and later bridge enable. + +Also, fix the mode_valid_check parameter from false to true, as the dsi +configuration check is taking place during the check-phase, and the +crtc_* mode values are not expected to be populated yet. + +Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()") +Signed-off-by: Aradhya Bhatia +Reviewed-by: Tomi Valkeinen +Tested-by: Jayesh Choudhary +Reviewed-by: Devarsh Thakkar +Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +index b022dd6e6b6e9..1c3fefce5fd28 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +@@ -989,10 +989,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge, + struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge); + struct cdns_dsi *dsi = input_to_dsi(input); + struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state); +- const struct drm_display_mode *mode = &crtc_state->mode; ++ const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode; + struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg; + +- return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false); ++ return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true); + } + + static struct drm_bridge_state * +-- +2.51.0 + diff --git a/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch b/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch new file mode 100644 index 0000000000..d8815946f0 --- /dev/null +++ b/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch @@ -0,0 +1,39 @@ +From 9da4b65a09d72475c416589e34f952cfc7cd1eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 16:58:25 -0700 +Subject: drm/bridge: it6505: select REGMAP_I2C + +From: Chia-I Wu + +[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ] + +Fix + + aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe': + ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c' + +Signed-off-by: Chia-I Wu +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reviewed-by: Chen-Yu Tsai +Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index b9e0ca85226a6..a6d6e62071a0e 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -122,6 +122,7 @@ config DRM_ITE_IT6505 + select EXTCON + select CRYPTO + select CRYPTO_HASH ++ select REGMAP_I2C + help + ITE IT6505 DisplayPort bridge chip driver. + +-- +2.51.0 + diff --git a/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch b/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch new file mode 100644 index 0000000000..92901827ab --- /dev/null +++ b/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch @@ -0,0 +1,106 @@ +From 778f97f903a8ee142d7d809edc72ddc8bbb4de03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 09:30:55 +0800 +Subject: drm/msm: Do not validate SSPP when it is not ready + +From: Jun Nie + +[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ] + +Current code will validate current plane and previous plane to +confirm they can share a SSPP with multi-rect mode. The SSPP +is already allocated for previous plane, while current plane +is not associated with any SSPP yet. Null pointer is referenced +when validating the SSPP of current plane. Skip SSPP validation +for current plane. + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +Mem abort info: + ESR = 0x0000000096000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault +Data abort info: + ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 +[0000000000000020] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +Modules linked in: +CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT +Tainted: [S]=CPU_OUT_OF_SPEC +Hardware name: SM8650 EV1 rev1 4slam 2et (DT) +pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) +pc : dpu_plane_is_multirect_capable+0x68/0x90 +lr : dpu_assign_plane_resources+0x288/0x410 +sp : ffff800093dcb770 +x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 +x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 +x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080 +x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff +x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200 +x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000 +x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950 +x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438 +x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000 +Call trace: + dpu_plane_is_multirect_capable+0x68/0x90 (P) + dpu_crtc_atomic_check+0x5bc/0x650 + drm_atomic_helper_check_planes+0x13c/0x220 + drm_atomic_helper_check+0x58/0xb8 + msm_atomic_check+0xd8/0xf0 + drm_atomic_check_only+0x4a8/0x968 + drm_atomic_commit+0x50/0xd8 + drm_atomic_helper_update_plane+0x140/0x188 + __setplane_atomic+0xfc/0x148 + drm_mode_setplane+0x164/0x378 + drm_ioctl_kernel+0xc0/0x140 + drm_ioctl+0x20c/0x500 + __arm64_sys_ioctl+0xbc/0xf8 + invoke_syscall+0x50/0x120 + el0_svc_common.constprop.0+0x48/0xf8 + do_el0_svc+0x28/0x40 + el0_svc+0x30/0xd0 + el0t_64_sync_handler+0x144/0x168 + el0t_64_sync+0x198/0x1a0 +Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1) +---[ end trace 0000000000000000 ]--- + +Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes") +Signed-off-by: Jun Nie +Patchwork: https://patchwork.freedesktop.org/patch/669224/ +Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index d059ed1e4b707..eba8adb660568 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -929,6 +929,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp, + if (MSM_FORMAT_IS_YUV(fmt)) + return false; + ++ if (!sspp) ++ return true; ++ + if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) && + !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features)) + return false; +@@ -1035,6 +1038,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate, + prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE) + return false; + ++ /* Do not validate SSPP of current plane when it is not ready */ + if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) || + !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt)) + return false; +-- +2.51.0 + diff --git a/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..7536465cfd --- /dev/null +++ b/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch @@ -0,0 +1,40 @@ +From 85425bcf101ba593e2b24ea0a02d2578ece4de65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:20:45 +0800 +Subject: drm/msm/dpu: fix incorrect type for ret + +From: Qianfeng Rong + +[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ] + +Change 'ret' from unsigned long to int, as storing negative error codes +in an unsigned long makes it never equal to -ETIMEDOUT, causing logical +errors. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Qianfeng Rong +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/671100/ +Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 849fea580a4ca..5ea7745f9c78e 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -448,7 +448,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +-- +2.51.0 + diff --git a/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch b/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch new file mode 100644 index 0000000000..5afe3719e0 --- /dev/null +++ b/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch @@ -0,0 +1,52 @@ +From 8bd2233663aeaf91b0cd09d9ef5c0183f0dc7282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 14:16:27 +0800 +Subject: drm/panel-edp: Add disable to 100ms for MNB601LS1-4 + +From: Langyan Ye + +[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ] + +For the MNB601LS1-4 panel, the T9+T10 timing does not meet the +requirements of the specification, so disable is set to 100ms. + +Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4") +Signed-off-by: Langyan Ye +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 90e8c154a9788..bfb09352a4acb 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = { + .powered_on_to_enable = 335, + }; + ++static const struct panel_delay delay_200_500_e50_d100 = { ++ .hpd_absent = 200, ++ .unprepare = 500, ++ .enable = 50, ++ .disable = 100, ++}; ++ + #define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \ + { \ + .ident = { \ +@@ -1979,7 +1986,7 @@ static const struct edp_panel_entry edp_panels[] = { + + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"), +- EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"), ++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"), + +-- +2.51.0 + diff --git a/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch new file mode 100644 index 0000000000..c6bd86a2a8 --- /dev/null +++ b/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch @@ -0,0 +1,42 @@ +From 90d4044b87619663945cdf4fc5acac4a00c098c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 21:23:41 -0600 +Subject: drm/panel: novatek-nt35560: Fix invalid return value + +From: Brigham Campbell + +[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ] + +Fix bug in nt35560_set_brightness() which causes the function to +erroneously report an error. mipi_dsi_dcs_write() returns either a +negative value when an error occurred or a positive number of bytes +written when no error occurred. The buggy code reports an error under +either condition. + +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Reviewed-by: Douglas Anderson +Reviewed-by: Neil Armstrong +Signed-off-by: Brigham Campbell +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index 5bbea734123bc..ee04c55175bb8 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..8baf238376 --- /dev/null +++ b/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From f8952adbd5442449721fb7b5bbec3d81928ac095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index ac77d1246b945..811265648a582 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch b/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch new file mode 100644 index 0000000000..f1d956d1a4 --- /dev/null +++ b/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch @@ -0,0 +1,71 @@ +From af2c1ae73dfa758c3e1b955aabee90a3b3a0e210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:28:49 +0200 +Subject: drm: re-allow no-op changes on non-primary planes in async flips +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xaver Hugl + +[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ] + +Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to +async flip") unintentionally disallowed no-op changes on non-primary +planes that the driver doesn't allow async flips on. This broke async +flips for compositors that disable the cursor plane in every async +atomic commit. To fix that, change drm_atomic_set_property to again +only run atomic_async_check if the plane would actually be changed by +the atomic commit. + +Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263 +Signed-off-by: Xaver Hugl +Reviewed-by: André Almeida +Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org +[andrealmeid: fix checkpatch warning] +Signed-off-by: André Almeida +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c +index c2726af6698e7..317303cf5b8c2 100644 +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -1077,19 +1077,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state, + } + + if (async_flip) { +- /* check if the prop does a nop change */ +- if ((prop != config->prop_fb_id && +- prop != config->prop_in_fence_fd && +- prop != config->prop_fb_damage_clips)) { +- ret = drm_atomic_plane_get_property(plane, plane_state, +- prop, &old_val); +- ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop); +- } ++ /* no-op changes are always allowed */ ++ ret = drm_atomic_plane_get_property(plane, plane_state, ++ prop, &old_val); ++ ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop); + +- /* ask the driver if this non-primary plane is supported */ +- if (plane->type != DRM_PLANE_TYPE_PRIMARY) { +- ret = -EINVAL; ++ /* fail everything that isn't no-op or a pure flip */ ++ if (ret && prop != config->prop_fb_id && ++ prop != config->prop_in_fence_fd && ++ prop != config->prop_fb_damage_clips) { ++ break; ++ } + ++ if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) { ++ /* ask the driver if this non-primary plane is supported */ + if (plane_funcs && plane_funcs->atomic_async_check) + ret = plane_funcs->atomic_async_check(plane, state, true); + +-- +2.51.0 + diff --git a/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch b/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch new file mode 100644 index 0000000000..71d097a670 --- /dev/null +++ b/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch @@ -0,0 +1,238 @@ +From dccdcf62edc6e5f33829730b9ee20668a843bcb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 17:21:33 -0500 +Subject: dt-bindings: vendor-prefixes: Add undocumented vendor prefixes + +From: Rob Herring (Arm) + +[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ] + +Add various vendor prefixes which are in use in compatible strings +already. These were found by modifying vendor-prefixes.yaml into a +schema to check compatible strings. + +The added prefixes doesn't include various duplicate prefixes in use +such as "lge". + +Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/vendor-prefixes.yaml | 50 +++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml +index 5d2a7a8d3ac6c..75ccab226182c 100644 +--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml ++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml +@@ -85,6 +85,8 @@ patternProperties: + description: Allegro DVT + "^allegromicro,.*": + description: Allegro MicroSystems, Inc. ++ "^alliedtelesis,.*": ++ description: Allied Telesis, Inc. + "^alliedvision,.*": + description: Allied Vision Technologies GmbH + "^allo,.*": +@@ -224,6 +226,8 @@ patternProperties: + description: Bitmain Technologies + "^blaize,.*": + description: Blaize, Inc. ++ "^bluegiga,.*": ++ description: Bluegiga Technologies Ltd. + "^blutek,.*": + description: BluTek Power + "^boe,.*": +@@ -242,6 +246,8 @@ patternProperties: + description: Bticino International + "^buffalo,.*": + description: Buffalo, Inc. ++ "^buglabs,.*": ++ description: Bug Labs, Inc. + "^bur,.*": + description: B&R Industrial Automation GmbH + "^bytedance,.*": +@@ -318,6 +324,8 @@ patternProperties: + description: Conexant Systems, Inc. + "^colorfly,.*": + description: Colorful GRP, Shenzhen Xueyushi Technology Ltd. ++ "^compal,.*": ++ description: Compal Electronics, Inc. + "^compulab,.*": + description: CompuLab Ltd. + "^comvetia,.*": +@@ -346,6 +354,8 @@ patternProperties: + description: Guangzhou China Star Optoelectronics Technology Co., Ltd + "^csq,.*": + description: Shenzen Chuangsiqi Technology Co.,Ltd. ++ "^csr,.*": ++ description: Cambridge Silicon Radio + "^ctera,.*": + description: CTERA Networks Intl. + "^ctu,.*": +@@ -446,6 +456,8 @@ patternProperties: + description: Emtop Embedded Solutions + "^eeti,.*": + description: eGalax_eMPIA Technology Inc ++ "^egnite,.*": ++ description: egnite GmbH + "^einfochips,.*": + description: Einfochips + "^eink,.*": +@@ -476,8 +488,12 @@ patternProperties: + description: Empire Electronix + "^emtrion,.*": + description: emtrion GmbH ++ "^enbw,.*": ++ description: Energie Baden-Württemberg AG + "^enclustra,.*": + description: Enclustra GmbH ++ "^endian,.*": ++ description: Endian SRL + "^endless,.*": + description: Endless Mobile, Inc. + "^ene,.*": +@@ -543,6 +559,8 @@ patternProperties: + description: FocalTech Systems Co.,Ltd + "^forlinx,.*": + description: Baoding Forlinx Embedded Technology Co., Ltd. ++ "^foxlink,.*": ++ description: Foxlink Group + "^freebox,.*": + description: Freebox SAS + "^freecom,.*": +@@ -631,6 +649,10 @@ patternProperties: + description: Haoyu Microelectronic Co. Ltd. + "^hardkernel,.*": + description: Hardkernel Co., Ltd ++ "^hce,.*": ++ description: HCE Engineering SRL ++ "^headacoustics,.*": ++ description: HEAD acoustics + "^hechuang,.*": + description: Shenzhen Hechuang Intelligent Co. + "^hideep,.*": +@@ -712,6 +734,8 @@ patternProperties: + description: Shenzhen INANBO Electronic Technology Co., Ltd. + "^incircuit,.*": + description: In-Circuit GmbH ++ "^incostartec,.*": ++ description: INCOstartec GmbH + "^indiedroid,.*": + description: Indiedroid + "^inet-tek,.*": +@@ -916,6 +940,8 @@ patternProperties: + description: Maxim Integrated Products + "^maxlinear,.*": + description: MaxLinear Inc. ++ "^maxtor,.*": ++ description: Maxtor Corporation + "^mbvl,.*": + description: Mobiveil Inc. + "^mcube,.*": +@@ -1077,6 +1103,8 @@ patternProperties: + description: Nordic Semiconductor + "^nothing,.*": + description: Nothing Technology Limited ++ "^novatech,.*": ++ description: NovaTech Automation + "^novatek,.*": + description: Novatek + "^novtech,.*": +@@ -1172,6 +1200,8 @@ patternProperties: + description: Pervasive Displays, Inc. + "^phicomm,.*": + description: PHICOMM Co., Ltd. ++ "^phontech,.*": ++ description: Phontech + "^phytec,.*": + description: PHYTEC Messtechnik GmbH + "^picochip,.*": +@@ -1256,6 +1286,8 @@ patternProperties: + description: Ramtron International + "^raspberrypi,.*": + description: Raspberry Pi Foundation ++ "^raumfeld,.*": ++ description: Raumfeld GmbH + "^raydium,.*": + description: Raydium Semiconductor Corp. + "^rda,.*": +@@ -1294,6 +1326,8 @@ patternProperties: + description: ROHM Semiconductor Co., Ltd + "^ronbo,.*": + description: Ronbo Electronics ++ "^ronetix,.*": ++ description: Ronetix GmbH + "^roofull,.*": + description: Shenzhen Roofull Technology Co, Ltd + "^roseapplepi,.*": +@@ -1318,8 +1352,12 @@ patternProperties: + description: Schindler + "^schneider,.*": + description: Schneider Electric ++ "^schulercontrol,.*": ++ description: Schuler Group + "^sciosense,.*": + description: ScioSense B.V. ++ "^sdmc,.*": ++ description: SDMC Technology Co., Ltd + "^seagate,.*": + description: Seagate Technology PLC + "^seeed,.*": +@@ -1358,6 +1396,8 @@ patternProperties: + description: Si-En Technology Ltd. + "^si-linux,.*": + description: Silicon Linux Corporation ++ "^sielaff,.*": ++ description: Sielaff GmbH & Co. + "^siemens,.*": + description: Siemens AG + "^sifive,.*": +@@ -1426,6 +1466,8 @@ patternProperties: + description: SolidRun + "^solomon,.*": + description: Solomon Systech Limited ++ "^somfy,.*": ++ description: Somfy Systems Inc. + "^sony,.*": + description: Sony Corporation + "^sophgo,.*": +@@ -1496,6 +1538,8 @@ patternProperties: + "^synopsys,.*": + description: Synopsys, Inc. (deprecated, use snps) + deprecated: true ++ "^taos,.*": ++ description: Texas Advanced Optoelectronic Solutions Inc. + "^tbs,.*": + description: TBS Technologies + "^tbs-biometrics,.*": +@@ -1526,6 +1570,8 @@ patternProperties: + description: Teltonika Networks + "^tempo,.*": + description: Tempo Semiconductor ++ "^tenda,.*": ++ description: Shenzhen Tenda Technology Co., Ltd. + "^terasic,.*": + description: Terasic Inc. + "^tesla,.*": +@@ -1629,6 +1675,8 @@ patternProperties: + description: V3 Semiconductor + "^vaisala,.*": + description: Vaisala ++ "^valve,.*": ++ description: Valve Corporation + "^vamrs,.*": + description: Vamrs Ltd. + "^variscite,.*": +@@ -1729,6 +1777,8 @@ patternProperties: + description: Extreme Engineering Solutions (X-ES) + "^xiaomi,.*": + description: Xiaomi Technology Co., Ltd. ++ "^xicor,.*": ++ description: Xicor Inc. + "^xillybus,.*": + description: Xillybus Ltd. + "^xingbangda,.*": +-- +2.51.0 + diff --git a/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch b/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch new file mode 100644 index 0000000000..814c323a4f --- /dev/null +++ b/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch @@ -0,0 +1,37 @@ +From 6559927821dc1cb64b8ce513fabf7675da621d92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 17:29:54 +0800 +Subject: dts: arm: amlogic: fix pwm node for c3 + +From: Xianwei Zhao + +[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ] + +Fix reg address for c3 pwm node. + +Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM") +Signed-off-by: Xianwei Zhao +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi +index cb9ea3ca6ee0f..71b2b3b547f7c 100644 +--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi ++++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi +@@ -792,7 +792,7 @@ spicc1: spi@52000 { + pwm_mn: pwm@54000 { + compatible = "amlogic,c3-pwm", + "amlogic,meson-s4-pwm"; +- reg = <0x0 54000 0x0 0x24>; ++ reg = <0x0 0x54000 0x0 0x24>; + clocks = <&clkc_periphs CLKID_PWM_M>, + <&clkc_periphs CLKID_PWM_N>; + #pwm-cells = <3>; +-- +2.51.0 + diff --git a/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch b/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch new file mode 100644 index 0000000000..8e58339f2f --- /dev/null +++ b/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch @@ -0,0 +1,78 @@ +From bbcf563699d6f39f8c2070d2e13f5c2d6cbca16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:57:07 +0800 +Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller + +From: Qiuxu Zhuo + +[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ] + +When loading the i10nm_edac driver on some Intel Granite Rapids servers, +a call trace may appear as follows: + + UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 + shift exponent -66 is negative + ... + __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 + skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] + i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] + skx_register_mci+0x159/0x220 [skx_edac_common] + i10nm_init+0xcb0/0x1ff0 [i10nm_edac] + ... + +This occurs because some BIOS may disable a memory controller if there +aren't any memory DIMMs populated on this memory controller. The DIMMMTR +register of this disabled memory controller contains the invalid value +~0, resulting in the call trace above. + +Fix this call trace by skipping DIMM enumeration on a disabled memory +controller. + +Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support") +Reported-by: Jose Jesus Ambriz Meza +Reported-by: Chia-Lin Kao (AceLan) +Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/ +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index a3fca2567752e..ac9afcf461d71 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -1047,6 +1047,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) + return !!GET_BITFIELD(mcmtr, 2, 2); + } + ++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) ++{ ++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); ++ ++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); ++ ++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); ++} ++ + static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + struct res_config *cfg) + { +@@ -1060,6 +1069,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + if (!imc->mbase) + continue; + ++ if (i10nm_channel_disabled(imc, i)) { ++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); ++ continue; ++ } ++ + ndimms = 0; + + if (res_cfg->type != GNR) +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch b/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch new file mode 100644 index 0000000000..46956d22f3 --- /dev/null +++ b/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch @@ -0,0 +1,45 @@ +From ba314a3864382b600d8e3ee0a16025d35d653b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:03:38 +0800 +Subject: f2fs: fix condition in __allow_reserved_blocks() + +From: Chao Yu + +[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ] + +If reserve_root mount option is not assigned, __allow_reserved_blocks() +will return false, it's not correct, fix it. + +Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index e084b96f11090..ec9a1d334ddaf 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2358,8 +2358,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, + { + if (!inode) + return true; +- if (!test_opt(sbi, RESERVE_ROOT)) +- return false; + if (IS_NOQUOTA(inode)) + return true; + if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) +@@ -2380,7 +2378,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode, cap)) ++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch b/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch new file mode 100644 index 0000000000..b51e0fbd64 --- /dev/null +++ b/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch @@ -0,0 +1,36 @@ +From 89acc9b33a6df06ccafce93da2b1374d3ddc216e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 14:29:10 +0800 +Subject: f2fs: fix to avoid overflow while left shift operation + +From: Chao Yu + +[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ] + +Should cast type of folio->index from pgoff_t to loff_t to avoid overflow +while left shift operation. + +Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 8cbb8038bc72f..e6ec77d6903be 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock) + + for (i = cluster_size - 1; i >= 0; i--) { + struct folio *folio = page_folio(rpages[i]); +- loff_t start = folio->index << PAGE_SHIFT; ++ loff_t start = (loff_t)folio->index << PAGE_SHIFT; + + if (from <= start) { + folio_zero_segment(folio, 0, folio_size(folio)); +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch b/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch new file mode 100644 index 0000000000..cc4a189897 --- /dev/null +++ b/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch @@ -0,0 +1,138 @@ +From b68ad98844ad0c05ea48f16d7d4b3ac4491c5ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 10:47:09 +0800 +Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() + +From: Chao Yu + +[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ] + +f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock +and page lookup, change as below to mitigate its overhead: +- check new_size before grabbing invalidate_lock +- lookup and invalidate pages only in range of [old_size, new_size] + +Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 39 +++++++++++++++++++-------------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 0b4868b2370d0..e203ec4d06ae2 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -35,15 +35,23 @@ + #include + #include + +-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) ++static void f2fs_zero_post_eof_page(struct inode *inode, ++ loff_t new_size, bool lock) + { + loff_t old_size = i_size_read(inode); + + if (old_size >= new_size) + return; + ++ if (mapping_empty(inode->i_mapping)) ++ return; ++ ++ if (lock) ++ filemap_invalidate_lock(inode->i_mapping); + /* zero or drop pages only in range of [old_size, new_size] */ +- truncate_pagecache(inode, old_size); ++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); ++ if (lock) ++ filemap_invalidate_unlock(inode->i_mapping); + } + + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) +@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) + + f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); + + file_update_time(vmf->vma->vm_file); + filemap_invalidate_lock_shared(inode->i_mapping); +@@ -1134,7 +1140,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + filemap_invalidate_lock(inode->i_mapping); + + if (attr->ia_size > old_size) +- f2fs_zero_post_eof_page(inode, attr->ia_size); ++ f2fs_zero_post_eof_page(inode, attr->ia_size, false); + truncate_setsize(inode, attr->ia_size); + + if (attr->ia_size <= old_size) +@@ -1253,9 +1259,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) + if (ret) + return ret; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1540,7 +1544,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + + f2fs_lock_op(sbi); + f2fs_drop_extent_tree(inode); +@@ -1663,9 +1667,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + return ret; + +- filemap_invalidate_lock(mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1799,7 +1801,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + truncate_pagecache(inode, offset); + + while (!ret && idx > pg_start) { +@@ -1857,9 +1859,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + f2fs_balance_fs(sbi, true); + +@@ -4903,9 +4903,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, ++ iocb->ki_pos + iov_iter_count(from), true); + return count; + } + +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch b/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch new file mode 100644 index 0000000000..738589e84e --- /dev/null +++ b/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch @@ -0,0 +1,83 @@ +From 570efeea38efa76180a0cd9c30e86b9af68ef45c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:40:24 +0800 +Subject: f2fs: fix to truncate first page in error path of f2fs_truncate() + +From: Chao Yu + +[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ] + +syzbot reports a bug as below: + +loop0: detected capacity change from 0 to 40427 +F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) +F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock +F2FS-fs (loop0): invalid crc value +F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. +------------[ cut here ]------------ +kernel BUG at fs/inode.c:753! +RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 +Call Trace: + + evict+0x504/0x9c0 fs/inode.c:810 + f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 + get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 + vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 + do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 + do_mount fs/namespace.c:4136 [inline] + __do_sys_mount fs/namespace.c:4347 [inline] + __se_sys_mount+0x317/0x410 fs/namespace.c:4324 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +During f2fs_evict_inode(), clear_inode() detects that we missed to truncate +all page cache before destorying inode, that is because in below path, we +will create page #0 in cache, but missed to drop it in error path, let's fix +it. + +- evict + - f2fs_evict_inode + - f2fs_truncate + - f2fs_convert_inline_inode + - f2fs_grab_cache_folio + : create page #0 in cache + - f2fs_convert_inline_folio + : sanity check failed, return -EFSCORRUPTED + - clear_inode detects that inode->i_data.nrpages is not zero + +Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large") +Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index bb3fd6a8416fd..0b4868b2370d0 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -900,8 +900,16 @@ int f2fs_truncate(struct inode *inode) + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +- if (err) ++ if (err) { ++ /* ++ * Always truncate page #0 to avoid page cache ++ * leak in evict() path. ++ */ ++ truncate_inode_pages_range(inode->i_mapping, ++ F2FS_BLK_TO_BYTES(0), ++ F2FS_BLK_END_BYTES(0)); + return err; ++ } + } + + err = f2fs_truncate_blocks(inode, i_size_read(inode), true); +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch b/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch new file mode 100644 index 0000000000..ca951c8db3 --- /dev/null +++ b/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch @@ -0,0 +1,56 @@ +From f336a37e1999cc5516e82e5e9d0ac82ccd0b3ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:12:50 +0800 +Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() + +From: Chao Yu + +[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ] + +Script to reproduce: +mkfs.f2fs -O extra_attr,compression /dev/vdb -f +mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache +cd /mnt/f2fs +f2fs_io write 1 0 1024 rand dsync testfile +xfs_io testfile -c "fsync" +f2fs_io write 1 0 512 rand dsync testfile +xfs_io testfile -c "fsync" +cd / +umount /mnt/f2fs +mount /dev/vdb /mnt/f2fs +f2fs_io precache_extents /mnt/f2fs/testfile +umount /mnt/f2fs + +Tracepoint output: +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0 + +During precache_extents, there is off-by-one issue, we should update +map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is +valid and not contiguous to previous extent. + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 53b64f4ff2d74..6ff650f425113 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1785,7 +1785,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + map->m_len - ofs); + } + if (map->m_next_extent) +- *map->m_next_extent = pgofs + 1; ++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; + } + f2fs_put_dnode(&dn); + unlock_out: +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch b/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch new file mode 100644 index 0000000000..bb784cbae2 --- /dev/null +++ b/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch @@ -0,0 +1,138 @@ +From 5b1b28ac280a6a29610c6561bffa9b94b3a3680f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:11:06 +0800 +Subject: f2fs: fix to zero data after EOF for compressed file correctly + +From: Chao Yu + +[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ] + +generic/091 may fail, then it bisects to the bad commit ba8dac350faf +("f2fs: fix to zero post-eof page"). + +What will cause generic/091 to fail is something like below Testcase #1: +1. write 16k as compressed blocks +2. truncate to 12k +3. truncate to 20k +4. verify data in range of [12k, 16k], however data is not zero as +expected + +Script of Testcase #1 +mkfs.f2fs -f -O extra_attr,compression /dev/vdb +mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs +dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 +dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc +sync +truncate -s $((12*1024)) /mnt/f2fs/file +truncate -s $((20*1024)) /mnt/f2fs/file +dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 +od /mnt/f2fs/data +umount /mnt/f2fs + +Analisys: +in step 2), we will redirty all data pages from #0 to #3 in compressed +cluster, and zero page #3, +in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop +all page cache post eof, includeing dirtied page #3, +in step 4) when we read data from page #3, it will decompressed cluster +and extra random data to page #3, finally, we hit the non-zeroed data +post eof. + +However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just +let the issue be reproduced easily, w/o the commit, it can reproduce this +bug w/ below Testcase #2: +1. write 16k as compressed blocks +2. truncate to 8k +3. truncate to 12k +4. truncate to 20k +5. verify data in range of [12k, 16k], however data is not zero as +expected + +Script of Testcase #2 +mkfs.f2fs -f -O extra_attr,compression /dev/vdb +mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs +dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 +dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc +sync +truncate -s $((8*1024)) /mnt/f2fs/file +truncate -s $((12*1024)) /mnt/f2fs/file +truncate -s $((20*1024)) /mnt/f2fs/file +echo 3 > /proc/sys/vm/drop_caches +dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 +od /mnt/f2fs/data +umount /mnt/f2fs + +Anlysis: +in step 2), we will redirty all data pages from #0 to #3 in compressed +cluster, and zero page #2 and #3, +in step 3), we will truncate page #3 in page cache, +in step 4), expand file size, +in step 5), hit random data post eof w/ the same reason in Testcase #1. + +Root Cause: +In f2fs_truncate_partial_cluster(), after we truncate partial data block +on compressed cluster, all pages in cluster including the one post eof +will be dirtied, after another tuncation, dirty page post eof will be +dropped, however on-disk compressed cluster is still valid, it may +include non-zero data post eof, result in exposing previous non-zero data +post eof while reading. + +Fix: +In f2fs_truncate_partial_cluster(), let change as below to fix: +- call filemap_write_and_wait_range() to flush dirty page +- call truncate_pagecache() to drop pages or zero partial page post eof +- call f2fs_do_truncate_blocks() to truncate non-compress cluster to + last valid block + +Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") +Reported-by: Jan Prusakowski +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index e6ec77d6903be..67cac17cc7dc7 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock) + for (i = cluster_size - 1; i >= 0; i--) { + struct folio *folio = page_folio(rpages[i]); + loff_t start = (loff_t)folio->index << PAGE_SHIFT; ++ loff_t offset = from > start ? from - start : 0; + +- if (from <= start) { +- folio_zero_segment(folio, 0, folio_size(folio)); +- } else { +- folio_zero_segment(folio, from - start, +- folio_size(folio)); ++ folio_zero_segment(folio, offset, folio_size(folio)); ++ ++ if (from >= start) + break; +- } + } + + f2fs_compress_write_end(inode, fsdata, start_idx, true); ++ ++ err = filemap_write_and_wait_range(inode->i_mapping, ++ round_down(from, cluster_size << PAGE_SHIFT), ++ LLONG_MAX); ++ if (err) ++ return err; ++ ++ truncate_pagecache(inode, from); ++ ++ err = f2fs_do_truncate_blocks(inode, ++ round_up(from, PAGE_SIZE), lock); + } +- return 0; ++ return err; + } + + static int f2fs_write_compressed_pages(struct compress_ctx *cc, +-- +2.51.0 + diff --git a/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch new file mode 100644 index 0000000000..3f2562ab6b --- /dev/null +++ b/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch @@ -0,0 +1,97 @@ +From 84f80526261c2b87aba8f431018320bed9a60933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:36:21 +0800 +Subject: f2fs: fix zero-sized extent for precache extents + +From: wangzijie + +[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ] + +Script to reproduce: +f2fs_io write 1 0 1881 rand dsync testfile +f2fs_io fallocate 0 7708672 4096 testfile +f2fs_io write 1 1881 1 rand buffered testfile +fsync testfile +umount +mount +f2fs_io precache_extents testfile + +When the data layout is something like this: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +During precache_extents, we map the last block(valid blkaddr) in dnode1: +map->m_flags |= F2FS_MAP_MAPPED; +map->m_pblk = blkaddr(valid blkaddr); +map->m_len = 1; +then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: +map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: + +map->m_len = 1 +ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 +ei.fofs = start_pgofs = 1882 +ei.len = map->m_len - ofs = 1 - 1 = 0 + +Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: +A,B,C is valid blkaddr +case1: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case2: +dnode1: dnode2: +[0] A [0] C (C!=B+1) +[1] A+1 [1] C+1 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case3: +dnode1: dnode2: +[0] A [0] C (C!=B+2) +[1] A+1 [1] C+1 +... .... +[1015] A+1015 +[1016] B (B!=A+1016) +[1017] B+1 [1017] 0x0 + +[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: wangzijie +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 6ff650f425113..9c35a0fb79e73 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1780,9 +1780,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) + *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; +-- +2.51.0 + diff --git a/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch b/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch new file mode 100644 index 0000000000..a933b9e2a2 --- /dev/null +++ b/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch @@ -0,0 +1,117 @@ +From 3418198bdcbee8bb983958e480194a35e62b2cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 16:09:13 +0200 +Subject: fanotify: Validate the return value of mnt_ns_from_dentry() before + dereferencing + +From: Anderson Nascimento + +[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ] + +The function do_fanotify_mark() does not validate if +mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns. +This causes a NULL pointer dereference in do_fanotify_mark() if the +path is not a mount namespace object. + +Fix this by checking mnt_ns_from_dentry()'s return value before +dereferencing it. + +Before the patch + +$ gcc fanotify_nullptr.c -o fanotify_nullptr +$ mkdir A +$ ./fanotify_nullptr +Fanotify fd: 3 +fanotify_mark: Operation not permitted +$ unshare -Urm +Fanotify fd: 3 +Killed + +int main(void){ + int ffd; + ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); + if(ffd < 0){ + perror("fanotify_init"); + exit(EXIT_FAILURE); + } + + printf("Fanotify fd: %d\n",ffd); + + if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, +FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){ + perror("fanotify_mark"); + exit(EXIT_FAILURE); + } + +return 0; +} + +After the patch + +$ gcc fanotify_nullptr.c -o fanotify_nullptr +$ mkdir A +$ ./fanotify_nullptr +Fanotify fd: 3 +fanotify_mark: Operation not permitted +$ unshare -Urm +Fanotify fd: 3 +fanotify_mark: Invalid argument + +[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 +[ 25.695006] #PF: supervisor read access in kernel mode +[ 25.695012] #PF: error_code(0x0000) - not-present page +[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 +[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI +[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not +tainted 6.17.0-rc4 #1 PREEMPT(lazy) +[ 25.695040] Hardware name: VMware, Inc. VMware Virtual +Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 +[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 +[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 +24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b +5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 +85 c9 +[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203 +[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 +[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 +[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000 +[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7 +[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 +[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) +knlGS:0000000000000000 +[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0 +[ 25.695201] Call Trace: +[ 25.695209] +[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30 +[ 25.695222] do_syscall_64+0x82/0x2c0 +... + +Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns") +Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com +Signed-off-by: Anderson Nascimento +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/notify/fanotify/fanotify_user.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index b192ee068a7ac..561339b4cf752 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, + user_ns = path.mnt->mnt_sb->s_user_ns; + obj = path.mnt->mnt_sb; + } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) { ++ ret = -EINVAL; + mntns = mnt_ns_from_dentry(path.dentry); ++ if (!mntns) ++ goto path_put_and_out; + user_ns = mntns->user_ns; + obj = mntns; + } +-- +2.51.0 + diff --git a/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..bf47c78b27 --- /dev/null +++ b/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From 3a3191e60fec286dc8cba60908adb968e3f67bfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index b8d1e00a7982c..2dfeb158e848a 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch b/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch new file mode 100644 index 0000000000..c1a2fd21b8 --- /dev/null +++ b/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch @@ -0,0 +1,64 @@ +From 64598ab1445d9666c76a8441c49e0ef463ea7183 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:53:43 +0800 +Subject: firmware: arm_scmi: Mark VirtIO ready before registering + scmi_virtio_driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Junnan Wu + +[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ] + +After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a +standalone driver”), the VirtIO transport probes independently. During +scmi_virtio_probe, scmi_probe() is called, which intune invokes +scmi_protocol_acquire() that sends a message over the virtqueue and +waits for a reply. + +Previously, DRIVER_OK was only set after scmi_vio_probe, in the core +virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device +Initialization): + | The driver MUST NOT send any buffer available notifications to the + | device before setting DRIVER_OK. + +Some type-1 hypervisors block available-buffer notifications until the +driver is marked OK. In such cases, scmi_vio_probe stalls in +scmi_wait_for_reply(), and the probe never completes. + +Resolve this by setting DRIVER_OK immediately after the device-specific +setup, so scmi_probe() can safely send notifications. + +Note after splitting the transports into modules, the probe sequence +changed a bit. We can no longer rely on virtio_device_ready() being +called by the core in virtio_dev_probe(), because scmi_vio_probe() +doesn’t complete until the core SCMI stack runs scmi_probe(), which +immediately issues the initial BASE protocol exchanges. + +Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver") +Signed-off-by: Junnan Wu +Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/transports/virtio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c +index cb934db9b2b4a..326c4a93e44b9 100644 +--- a/drivers/firmware/arm_scmi/transports/virtio.c ++++ b/drivers/firmware/arm_scmi/transports/virtio.c +@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev) + /* Ensure initialized scmi_vdev is visible */ + smp_store_mb(scmi_vdev, vdev); + ++ /* Set device ready */ ++ virtio_device_ready(vdev); ++ + ret = platform_driver_register(&scmi_virtio_driver); + if (ret) { + vdev->priv = NULL; +-- +2.51.0 + diff --git a/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..629fa6c73e --- /dev/null +++ b/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From e20a7cc336cba44d9db1ff738ea2f7e87eb08ac2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..5a3a335007 --- /dev/null +++ b/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,87 @@ +From d787afb975964a61469676b00948ad6e6416af83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 6e86d66197ef2..88550085f7457 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else { + /* The size of 'dlcn' can't be > 8. */ + return -EINVAL; + } + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch b/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch new file mode 100644 index 0000000000..67367267bc --- /dev/null +++ b/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch @@ -0,0 +1,58 @@ +From dde216c045efb536e31eca4e4e478163b14c3eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 10:40:16 -0700 +Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks + exist + +From: Moon Hee Lee + +[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ] + +Index allocation requires at least one bit in the $BITMAP attribute to +track usage of index entries. If the bitmap is empty while index blocks +are already present, this reflects on-disk corruption. + +syzbot triggered this condition using a malformed NTFS image. During a +rename() operation involving a long filename (which spans multiple +index entries), the empty bitmap allowed the name to be added without +valid tracking. Subsequent deletion of the original entry failed with +-ENOENT, due to unexpected index state. + +Reject such cases by verifying that the bitmap is not empty when index +blocks exist. + +Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64 +Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") +Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Signed-off-by: Moon Hee Lee +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 1bf2a6593dec6..6d1bf890929d9 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); + } + ++ /* ++ * Index blocks exist, but $BITMAP has zero valid bits. ++ * This implies an on-disk corruption and must be rejected. ++ */ ++ if (in->name == I30_NAME && ++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { ++ err = -EINVAL; ++ goto out1; ++ } ++ + bit = bmp_size << 3; + } + +-- +2.51.0 + diff --git a/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch b/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch new file mode 100644 index 0000000000..998e330f54 --- /dev/null +++ b/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch @@ -0,0 +1,45 @@ +From f1df31eec09bd93f6d2cabf0188d98a8066b80fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 11:49:54 +0530 +Subject: fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() + +From: Akhilesh Patil + +[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ] + +Use kvfree() to free memory allocated by kvzalloc() instead of kfree(). +Avoid potential memory management issue considering kvzalloc() can +internally choose to use either kmalloc() or vmalloc() based on memory +request and current system memory state. Hence, use more appropriate +kvfree() which automatically determines correct free method to avoid +potential hard to debug memory issues. Fix this issue discovered by +running spatch static analysis tool using coccinelle script - +scripts/coccinelle/api/kfree_mismatch.cocci + +Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw") +Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in +Signed-off-by: Akhilesh Patil +Reviewed-by: Dave Jiang +Reviewed-by: Alison Schofield +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/fwctl/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c +index f93aa0cecdb97..4b379f695eb73 100644 +--- a/drivers/fwctl/mlx5/main.c ++++ b/drivers/fwctl/mlx5/main.c +@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, + */ + if (ret && ret != -EREMOTEIO) { + if (rpc_out != rpc_in) +- kfree(rpc_out); ++ kvfree(rpc_out); + return ERR_PTR(ret); + } + return rpc_out; +-- +2.51.0 + diff --git a/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch b/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch new file mode 100644 index 0000000000..dc55e24425 --- /dev/null +++ b/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch @@ -0,0 +1,37 @@ +From 947e194027abac7ed01c82a5f44301721032db21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 23:57:24 +0200 +Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote + +From: Andreas Gruenbacher + +[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ] + +Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS +flag a second time after it has already been cleared. Fix that. + +Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index ea96113edbe31..5f44486479d69 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -807,8 +807,6 @@ __acquires(&gl->gl_lockref.lock) + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); + return; +- } else { +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +-- +2.51.0 + diff --git a/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch b/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch new file mode 100644 index 0000000000..2665d3c361 --- /dev/null +++ b/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch @@ -0,0 +1,310 @@ +From 82ff4e2791518d34de1a79975daa41dbcf74efc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 18:58:51 +0200 +Subject: HID: hidraw: tighten ioctl command parsing + +From: Benjamin Tissoires + +[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ] + +The handling for variable-length ioctl commands in hidraw_ioctl() is +rather complex and the check for the data direction is incomplete. + +Simplify this code by factoring out the various ioctls grouped by dir +and size, and using a switch() statement with the size masked out, to +ensure the rest of the command is correctly matched. + +Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw") +Reported-by: Arnd Bergmann +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hidraw.c | 224 ++++++++++++++++++++---------------- + include/uapi/linux/hidraw.h | 2 + + 2 files changed, 124 insertions(+), 102 deletions(-) + +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index c887f48756f4b..bbd6f23bce789 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list) + return 0; + } + +-static long hidraw_ioctl(struct file *file, unsigned int cmd, +- unsigned long arg) ++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *arg) + { +- struct inode *inode = file_inode(file); +- unsigned int minor = iminor(inode); +- long ret = 0; +- struct hidraw *dev; +- struct hidraw_list *list = file->private_data; +- void __user *user_arg = (void __user*) arg; +- +- down_read(&minors_rwsem); +- dev = hidraw_table[minor]; +- if (!dev || !dev->exist || hidraw_is_revoked(list)) { +- ret = -ENODEV; +- goto out; +- } ++ struct hid_device *hid = dev->hid; + + switch (cmd) { + case HIDIOCGRDESCSIZE: +- if (put_user(dev->hid->rsize, (int __user *)arg)) +- ret = -EFAULT; ++ if (put_user(hid->rsize, (int __user *)arg)) ++ return -EFAULT; + break; + + case HIDIOCGRDESC: +@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, + __u32 len; + + if (get_user(len, (int __user *)arg)) +- ret = -EFAULT; +- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1) +- ret = -EINVAL; +- else if (copy_to_user(user_arg + offsetof( +- struct hidraw_report_descriptor, +- value[0]), +- dev->hid->rdesc, +- min(dev->hid->rsize, len))) +- ret = -EFAULT; ++ return -EFAULT; ++ ++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1) ++ return -EINVAL; ++ ++ if (copy_to_user(arg + offsetof( ++ struct hidraw_report_descriptor, ++ value[0]), ++ hid->rdesc, ++ min(hid->rsize, len))) ++ return -EFAULT; ++ + break; + } + case HIDIOCGRAWINFO: + { + struct hidraw_devinfo dinfo; + +- dinfo.bustype = dev->hid->bus; +- dinfo.vendor = dev->hid->vendor; +- dinfo.product = dev->hid->product; +- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo))) +- ret = -EFAULT; ++ dinfo.bustype = hid->bus; ++ dinfo.vendor = hid->vendor; ++ dinfo.product = hid->product; ++ if (copy_to_user(arg, &dinfo, sizeof(dinfo))) ++ return -EFAULT; + break; + } + case HIDIOCREVOKE: + { +- if (user_arg) +- ret = -EINVAL; +- else +- ret = hidraw_revoke(list); +- break; ++ struct hidraw_list *list = file->private_data; ++ ++ if (arg) ++ return -EINVAL; ++ ++ return hidraw_revoke(list); + } + default: +- { +- struct hid_device *hid = dev->hid; +- if (_IOC_TYPE(cmd) != 'H') { +- ret = -EINVAL; +- break; +- } ++ /* ++ * None of the above ioctls can return -EAGAIN, so ++ * use it as a marker that we need to check variable ++ * length ioctls. ++ */ ++ return -EAGAIN; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } ++ return 0; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } ++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ int len = _IOC_SIZE(cmd); ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCSFEATURE(0): ++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCGFEATURE(0): ++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCSINPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCGINPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCSOUTPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ case HIDIOCGOUTPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } ++ return -EINVAL; ++} + +- /* Begin Read-only ioctls. */ +- if (_IOC_DIR(cmd) != _IOC_READ) { +- ret = -EINVAL; +- break; +- } ++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ struct hid_device *hid = dev->hid; ++ int len = _IOC_SIZE(cmd); ++ int field_len; ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCGRAWNAME(0): ++ field_len = strlen(hid->name) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len; ++ case HIDIOCGRAWPHYS(0): ++ field_len = strlen(hid->phys) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len; ++ case HIDIOCGRAWUNIQ(0): ++ field_len = strlen(hid->uniq) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) { +- int len = strlen(hid->name) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->name, len) ? +- -EFAULT : len; +- break; +- } ++ return -EINVAL; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) { +- int len = strlen(hid->phys) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->phys, len) ? +- -EFAULT : len; +- break; +- } ++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ struct inode *inode = file_inode(file); ++ unsigned int minor = iminor(inode); ++ struct hidraw *dev; ++ struct hidraw_list *list = file->private_data; ++ void __user *user_arg = (void __user *)arg; ++ int ret; + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) { +- int len = strlen(hid->uniq) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->uniq, len) ? +- -EFAULT : len; +- break; +- } +- } ++ down_read(&minors_rwsem); ++ dev = hidraw_table[minor]; ++ if (!dev || !dev->exist || hidraw_is_revoked(list)) { ++ ret = -ENODEV; ++ goto out; ++ } ++ ++ if (_IOC_TYPE(cmd) != 'H') { ++ ret = -EINVAL; ++ goto out; ++ } + ++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) { + ret = -ENOTTY; ++ goto out; + } ++ ++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg); ++ if (ret != -EAGAIN) ++ goto out; ++ ++ switch (_IOC_DIR(cmd)) { ++ case (_IOC_READ | _IOC_WRITE): ++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ case _IOC_READ: ++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ default: ++ /* Any other IOC_DIR is wrong */ ++ ret = -EINVAL; ++ } ++ + out: + up_read(&minors_rwsem); + return ret; +diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h +index d5ee269864e07..ebd701b3c18d9 100644 +--- a/include/uapi/linux/hidraw.h ++++ b/include/uapi/linux/hidraw.h +@@ -48,6 +48,8 @@ struct hidraw_devinfo { + #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len) + #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */ + ++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE) ++ + #define HIDRAW_FIRST_MINOR 0 + #define HIDRAW_MAX_DEVICES 64 + /* number of reports to buffer */ +-- +2.51.0 + diff --git a/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch b/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch new file mode 100644 index 0000000000..aaca240c76 --- /dev/null +++ b/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch @@ -0,0 +1,47 @@ +From 6fa21740fb65709ab70f5825dca70f1acdd56a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:27:35 +0200 +Subject: HID: steelseries: Fix STEELSERIES_SRWS1 handling in + steelseries_remove() + +From: Jiri Kosina + +[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ] + +srws1_remove label can be only reached only if LEDS subsystem is enabled. To +avoid putting horryfing ifdef second time around the label, just perform +the cleanup and exit immediately directly. + +Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/ +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-steelseries.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c +index 8af98d67959e0..f98435631aa18 100644 +--- a/drivers/hid/hid-steelseries.c ++++ b/drivers/hid/hid-steelseries.c +@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev) + if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) +- goto srws1_remove; ++ hid_hw_stop(hdev); + #endif + return; + } +@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev) + cancel_delayed_work_sync(&sd->battery_work); + + hid_hw_close(hdev); +-srws1_remove: + hid_hw_stop(hdev); + } + +-- +2.51.0 + diff --git a/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch b/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch new file mode 100644 index 0000000000..7e673bd5a4 --- /dev/null +++ b/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch @@ -0,0 +1,322 @@ +From 64bbc2de738bea00929848c08339da34531af790 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 20:26:43 +0900 +Subject: HID: steelseries: refactor probe() and remove() + +From: Jeongjun Park + +[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ] + +steelseries_srws1_probe() still does not use devm_kzalloc() and +devm_led_classdev_register(), so there is a lot of code to safely manage +heap, which reduces readability and may cause memory leaks due to minor +patch mistakes in the future. + +Therefore, it should be changed to use devm_kzalloc() and +devm_led_classdev_register() to easily and safely manage heap. + +Also, the current steelseries driver mainly checks sd->quriks to determine +which product a specific HID device is, which is not the correct way. + +remove(), unlike probe(), does not receive struct hid_device_id as an +argument, so it must check hdev unconditionally to know which product +it is. + +However, since struct steelseries_device and struct steelseries_srws1_data +have different structures, if SRWS1 is removed in remove(), converts +hdev->dev, which is initialized to struct steelseries_srws1_data, +to struct steelseries_device and uses it. This causes various +memory-related bugs as completely unexpected values exist in member +variables of the structure. + +Therefore, in order to modify probe() and remove() to work properly, +Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be +modified to check hdev->product when determining HID device product. + +Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox") +Signed-off-by: Jeongjun Park +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 + + drivers/hid/hid-quirks.c | 2 + + drivers/hid/hid-steelseries.c | 109 ++++++++++++---------------------- + 3 files changed, 43 insertions(+), 70 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index a752c667fbcaa..dde20386def17 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1293,6 +1293,8 @@ + + #define USB_VENDOR_ID_STEELSERIES 0x1038 + #define USB_DEVICE_ID_STEELSERIES_SRWS1 0x1410 ++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1 0x12b6 ++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9 0x12c2 + + #define USB_VENDOR_ID_SUN 0x0430 + #define USB_DEVICE_ID_RARITAN_KVM_DONGLE 0xcdab +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 416160cfde77b..ccffd08cd8840 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -694,6 +694,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #endif + #if IS_ENABLED(CONFIG_HID_STEELSERIES) + { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) }, + #endif + #if IS_ENABLED(CONFIG_HID_SUNPLUS) + { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) }, +diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c +index d4bd7848b8c66..8af98d67959e0 100644 +--- a/drivers/hid/hid-steelseries.c ++++ b/drivers/hid/hid-steelseries.c +@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + { + int ret, i; + struct led_classdev *led; ++ struct steelseries_srws1_data *drv_data; + size_t name_sz; + char *name; + +- struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL); +- ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); + if (drv_data == NULL) { + hid_err(hdev, "can't alloc SRW-S1 memory\n"); + return -ENOMEM; +@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); +- goto err_free; ++ goto err; + } + + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) { + ret = -ENODEV; +- goto err_free; ++ goto err; + } + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); + if (ret) { + hid_err(hdev, "hw start failed\n"); +- goto err_free; ++ goto err; + } + + /* register led subsystem */ +@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + name_sz = strlen(hdev->uniq) + 16; + + /* 'ALL', for setting all LEDs simultaneously */ +- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL); ++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL); + if (!led) { + hid_err(hdev, "can't allocate memory for LED ALL\n"); +- goto err_led; ++ goto out; + } + + name = (void *)(&led[1]); +@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + led->brightness_set = steelseries_srws1_led_all_set_brightness; + + drv_data->led[SRWS1_NUMBER_LEDS] = led; +- ret = led_classdev_register(&hdev->dev, led); +- if (ret) +- goto err_led; ++ ret = devm_led_classdev_register(&hdev->dev, led); ++ if (ret) { ++ hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS); ++ goto out; /* let the driver continue without LEDs */ ++ } + + /* Each individual LED */ + for (i = 0; i < SRWS1_NUMBER_LEDS; i++) { +- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL); ++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL); + if (!led) { + hid_err(hdev, "can't allocate memory for LED %d\n", i); +- goto err_led; ++ break; + } + + name = (void *)(&led[1]); +@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + led->brightness_set = steelseries_srws1_led_set_brightness; + + drv_data->led[i] = led; +- ret = led_classdev_register(&hdev->dev, led); ++ ret = devm_led_classdev_register(&hdev->dev, led); + + if (ret) { + hid_err(hdev, "failed to register LED %d. Aborting.\n", i); +-err_led: +- /* Deregister all LEDs (if any) */ +- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) { +- led = drv_data->led[i]; +- drv_data->led[i] = NULL; +- if (!led) +- continue; +- led_classdev_unregister(led); +- kfree(led); +- } +- goto out; /* but let the driver continue without LEDs */ ++ break; /* but let the driver continue without LEDs */ + } + } + out: + return 0; +-err_free: +- kfree(drv_data); ++err: + return ret; + } +- +-static void steelseries_srws1_remove(struct hid_device *hdev) +-{ +- int i; +- struct led_classdev *led; +- +- struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev); +- +- if (drv_data) { +- /* Deregister LEDs (if any) */ +- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) { +- led = drv_data->led[i]; +- drv_data->led[i] = NULL; +- if (!led) +- continue; +- led_classdev_unregister(led); +- kfree(led); +- } +- +- } +- +- hid_hw_stop(hdev); +- kfree(drv_data); +-} + #endif + + #define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS 3000 +@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev, + + static void steelseries_headset_fetch_battery(struct hid_device *hdev) + { +- struct steelseries_device *sd = hid_get_drvdata(hdev); + int ret = 0; + +- if (sd->quirks & STEELSERIES_ARCTIS_1) ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) + ret = steelseries_headset_request_battery(hdev, + arctis_1_battery_request, sizeof(arctis_1_battery_request)); +- else if (sd->quirks & STEELSERIES_ARCTIS_9) ++ else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) + ret = steelseries_headset_request_battery(hdev, + arctis_9_battery_request, sizeof(arctis_9_battery_request)); + +@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + struct steelseries_device *sd; + int ret; + +- sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL); +- if (!sd) +- return -ENOMEM; +- hid_set_drvdata(hdev, sd); +- sd->hdev = hdev; +- sd->quirks = id->driver_data; +- +- if (sd->quirks & STEELSERIES_SRWS1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) + return steelseries_srws1_probe(hdev, id); +@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + #endif + } + ++ sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL); ++ if (!sd) ++ return -ENOMEM; ++ hid_set_drvdata(hdev, sd); ++ sd->hdev = hdev; ++ sd->quirks = id->driver_data; ++ + ret = hid_parse(hdev); + if (ret) + return ret; +@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + + static void steelseries_remove(struct hid_device *hdev) + { +- struct steelseries_device *sd = hid_get_drvdata(hdev); ++ struct steelseries_device *sd; + unsigned long flags; + +- if (sd->quirks & STEELSERIES_SRWS1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) +- steelseries_srws1_remove(hdev); ++ goto srws1_remove; + #endif + return; + } + ++ sd = hid_get_drvdata(hdev); ++ + spin_lock_irqsave(&sd->lock, flags); + sd->removed = true; + spin_unlock_irqrestore(&sd->lock, flags); +@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev) + cancel_delayed_work_sync(&sd->battery_work); + + hid_hw_close(hdev); ++srws1_remove: + hid_hw_stop(hdev); + } + +@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev, + unsigned long flags; + + /* Not a headset */ +- if (sd->quirks & STEELSERIES_SRWS1) ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) + return 0; + +- if (sd->quirks & STEELSERIES_ARCTIS_1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) { + hid_dbg(sd->hdev, + "Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf); + if (size < ARCTIS_1_BATTERY_RESPONSE_LEN || +@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev, + } + } + +- if (sd->quirks & STEELSERIES_ARCTIS_9) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) { + hid_dbg(sd->hdev, + "Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf); + if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) { +@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = { + .driver_data = STEELSERIES_SRWS1 }, + + { /* SteelSeries Arctis 1 Wireless for XBox */ +- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6), +- .driver_data = STEELSERIES_ARCTIS_1 }, ++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1), ++ .driver_data = STEELSERIES_ARCTIS_1 }, + + { /* SteelSeries Arctis 9 Wireless for XBox */ +- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2), ++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9), + .driver_data = STEELSERIES_ARCTIS_9 }, + + { } +-- +2.51.0 + diff --git a/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch new file mode 100644 index 0000000000..ceb7e1a88a --- /dev/null +++ b/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch @@ -0,0 +1,81 @@ +From 978c5aafad2b54f34a9626b261e8f2d09f68e43d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:02:54 +0530 +Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Deepanshu Kartikey + +[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] + +hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate +operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: +use new vma_lock for pmd sharing synchronization"), if the trylock fails +or the VMA has no lock, it should skip that VMA. Any remaining mapped +pages are handled by remove_inode_hugepages() which is called after +hugetlb_vmdelete_list() and uses proper lock ordering to guarantee +unmapping success. + +Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs +without shareable locks, the code proceeds to call unmap_hugepage_range(). +This causes assertion failures in huge_pmd_unshare() → +hugetlb_vma_assert_locked() because no lock is actually held: + + WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted + Call Trace: + hugetlb_vma_assert_locked+0x1dd/0x250 + huge_pmd_unshare+0x2c8/0x540 + __unmap_hugepage_range+0x6e3/0x1aa0 + unmap_hugepage_range+0x32e/0x410 + hugetlb_vmdelete_list+0x189/0x1f0 + +Fix by using goto to ensure locks acquired by trylock are always released, +even when skipping VMAs without shareable locks. + +Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com +Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") +Signed-off-by: Deepanshu Kartikey +Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 +Suggested-by: Andrew Morton +Cc: David Hildenbrand +Cc: Muchun Song +Cc: Oscar Salvador +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hugetlbfs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 6040e54082777..f56155a2969ee 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -493,6 +493,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + if (!hugetlb_vma_trylock_write(vma)) + continue; + ++ /* ++ * Skip VMAs without shareable locks. Per the design in commit ++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() ++ * called after this function with proper locking. ++ */ ++ if (!__vma_shareable_lock(vma)) ++ goto skip; ++ + v_start = vma_offset_start(vma, start); + v_end = vma_offset_end(vma, end); + +@@ -503,6 +511,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + * vmas. Therefore, lock is not held when calling + * unmap_hugepage_range for private vmas. + */ ++skip: + hugetlb_vma_unlock_write(vma); + } + } +-- +2.51.0 + diff --git a/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch new file mode 100644 index 0000000000..e5a54765fc --- /dev/null +++ b/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch @@ -0,0 +1,102 @@ +From e2861afcbbfd5af8679e5b4b2441810eb5e08192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:48:58 +0200 +Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from + different subsystems + +From: Vadim Pasternak + +[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ] + +Distinct between fan speed setting request coming for hwmon and +thermal subsystems. + +There are fields 'last_hwmon_state' and 'last_thermal_state' in the +structure 'mlxreg_fan_pwm', which respectively store the cooling state +set by the 'hwmon' and 'thermal' subsystem. +The purpose is to make arbitration of fan speed setting. For example, if +fan speed required to be not lower than some limit, such setting is to +be performed through 'hwmon' subsystem, thus 'thermal' subsystem will +not set fan below this limit. + +Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing +cooling state to never be set to a lower value. + +Eliminate update of 'last_thermal_state', when request is coming from +'hwmon' subsystem. + +Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index c25a54d5b39ad..0ba9195c9d713 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +-- +2.51.0 + diff --git a/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..7c40ec01c3 --- /dev/null +++ b/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 7f67106eeee0b7e6bdef1d75498548ba91b2ca33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index d8fd8a3544828..9e408144a10c1 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + if (IS_ERR(ks_sa_rng->regmap_cfg)) + return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n"); + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch new file mode 100644 index 0000000000..920684591c --- /dev/null +++ b/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch @@ -0,0 +1,44 @@ +From 164ec5d0472e3efd858fe3dea0599d5aa1176a4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 17:28:00 +0200 +Subject: hwrng: nomadik - add ARM_AMBA dependency + +From: Arnd Bergmann + +[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ] + +Compile-testing this driver is only possible when the AMBA bus driver is +available in the kernel: + +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': +nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': +nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' +x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' + +The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be +specified for the COMPILE_TEST case. + +Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index c858278434475..7826fd7c4603f 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.51.0 + diff --git a/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..3fe3194e32 --- /dev/null +++ b/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From 88d3fbdfb59e0800ed8af87ee5741752f5adcef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 128b8cd7924e0..006c312cf7c82 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch b/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch new file mode 100644 index 0000000000..db2332d472 --- /dev/null +++ b/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch @@ -0,0 +1,68 @@ +From 693a57b0d4c8d101304732bb3760f9c8e44f5e23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:10 +0900 +Subject: i2c: designware: Fix clock issue when PM is disabled + +From: Kunihiko Hayashi + +[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ] + +When the driver is removed, the clocks are first enabled by +calling pm_runtime_get_sync(), and then disabled with +pm_runtime_put_sync(). + +If CONFIG_PM=y, clocks for this controller are disabled when it's in +the idle state. So the clocks are properly disabled when the driver +exits. + +Othewise, the clocks are always enabled and the PM functions have +no effect. Therefore, the driver exits without disabling the clocks. + + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 18 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + +To ensure that the clocks can be disabled correctly even without +CONFIG_PM=y, should add the following fixes: + +- Replace with pm_runtime_put_noidle(), which only decrements the runtime + PM usage count. +- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Tested-by: Jarkko Nikula +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index c1262df02cdb2..128b8cd7924e0 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) + i2c_dw_disable(dev); + + pm_runtime_dont_use_autosuspend(device); +- pm_runtime_put_sync(device); ++ pm_runtime_put_noidle(device); + dw_i2c_plat_pm_cleanup(dev); + ++ i2c_dw_prepare_clk(dev, false); ++ + i2c_dw_remove_lock_support(dev); + + reset_control_assert(dev->rst); +-- +2.51.0 + diff --git a/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..c6a311b9d2 --- /dev/null +++ b/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From 3f32f73b19ff00212c2625b2fe4d9a2d0de1bc1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index ab456c3717db1..dee40704825cb 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch b/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch new file mode 100644 index 0000000000..89dd7b91bf --- /dev/null +++ b/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch @@ -0,0 +1,48 @@ +From 241cdb6ca57e9cdd5d4f171d96f16c6082455bcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:28 +0800 +Subject: i2c: spacemit: check SDA instead of SCL after bus reset + +From: Troy Mitchell + +[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ] + +After calling spacemit_i2c_conditionally_reset_bus(), +the controller should ensure that the SDA line is release +before proceeding. + +Previously, the driver checked the SCL line instead, +which does not guarantee that the bus is truly idle. + +This patch changes the check to verify SDA. This ensures +proper bus recovery and avoids potential communication errors +after a conditional reset. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 9bf9f01aa68bd..848dfaf634f63 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + spacemit_i2c_reset(i2c); + usleep_range(10, 20); + +- /* check scl status again */ ++ /* check sda again here */ + status = readl(i2c->base + SPACEMIT_IBMR); +- if (!(status & SPACEMIT_BMR_SCL)) ++ if (!(status & SPACEMIT_BMR_SDA)) + dev_warn_ratelimited(i2c->dev, "unit reset failed\n"); + } + +-- +2.51.0 + diff --git a/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch b/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch new file mode 100644 index 0000000000..65b93a6291 --- /dev/null +++ b/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch @@ -0,0 +1,72 @@ +From 6434cd9a09d8122d00e969815d7bdb779bb11435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:27 +0800 +Subject: i2c: spacemit: disable SDA glitch fix to avoid restart delay + +From: Troy Mitchell + +[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ] + +The K1 I2C controller has an SDA glitch fix that introduces a small +delay on restart signals. While this feature can suppress glitches +on SDA when SCL = 0, it also delays the restart signal, which may +cause unexpected behavior in some transfers. + +The glitch itself does not affect normal I2C operation, because +the I2C specification allows SDA to change while SCL is low. + +To ensure correct transmission for every message, we disable the +SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during +initialization. + +This guarantees that restarts are issued promptly without +unintended delays. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 84f132d0504dc..9bf9f01aa68bd 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -14,6 +14,7 @@ + #define SPACEMIT_ICR 0x0 /* Control register */ + #define SPACEMIT_ISR 0x4 /* Status register */ + #define SPACEMIT_IDBR 0xc /* Data buffer register */ ++#define SPACEMIT_IRCR 0x18 /* Reset cycle counter */ + #define SPACEMIT_IBMR 0x1c /* Bus monitor register */ + + /* SPACEMIT_ICR register fields */ +@@ -76,6 +77,8 @@ + SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \ + SPACEMIT_SR_ALD) + ++#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */ ++ + /* SPACEMIT_IBMR register fields */ + #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */ + #define SPACEMIT_BMR_SCL BIT(1) /* SCL line level */ +@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c) + val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE; + + writel(val, i2c->base + SPACEMIT_ICR); ++ ++ /* ++ * The glitch fix in the K1 I2C controller introduces a delay ++ * on restart signals, so we disable the fix here. ++ */ ++ val = readl(i2c->base + SPACEMIT_IRCR); ++ val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX; ++ writel(val, i2c->base + SPACEMIT_IRCR); + } + + static inline void +-- +2.51.0 + diff --git a/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch b/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch new file mode 100644 index 0000000000..34474dd0ae --- /dev/null +++ b/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch @@ -0,0 +1,53 @@ +From a9504ddff65b28092759f2ceef747fb1aa8a8124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:25 +0800 +Subject: i2c: spacemit: ensure bus release check runs when wait_bus_idle() + fails + +From: Troy Mitchell + +[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ] + +spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative +error code on failure. + +Since 'ret' can never be positive, the final 'else' branch was +unreachable, and spacemit_i2c_check_bus_release() was never called. + +This commit guarantees we attempt to release the bus whenever waiting for +an idle bus fails. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index b68a21fff0b56..ee08811f4087c 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in + spacemit_i2c_enable(i2c); + + ret = spacemit_i2c_wait_bus_idle(i2c); +- if (!ret) ++ if (!ret) { + ret = spacemit_i2c_xfer_msg(i2c); +- else if (ret < 0) +- dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret); +- else ++ if (ret < 0) ++ dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret); ++ } else { + spacemit_i2c_check_bus_release(i2c); ++ } + + spacemit_i2c_disable(i2c); + +-- +2.51.0 + diff --git a/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch b/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch new file mode 100644 index 0000000000..c40646f91b --- /dev/null +++ b/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch @@ -0,0 +1,101 @@ +From 8019d189f37ebe3667b9f9850603a007c6f07c99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:29 +0800 +Subject: i2c: spacemit: ensure SDA is released after bus reset + +From: Troy Mitchell + +[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ] + +After performing a conditional bus reset, the controller must ensure +that the SDA line is actually released. + +Previously, the reset routine only performed a single check, +which could leave the bus in a locked state in some situations. + +This patch introduces a loop that toggles the reset cycle and issues +a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking +SDA after each attempt. If SDA is released before the maximum count, +the function returns early. Otherwise, a warning is emitted. + +This change improves bus recovery reliability. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Signed-off-by: Troy Mitchell +Reviewed-by: Aurelien Jarno +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 848dfaf634f63..6b918770e612e 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2024-2025 Troy Mitchell + */ + ++#include + #include + #include + #include +@@ -26,7 +27,8 @@ + #define SPACEMIT_CR_MODE_FAST BIT(8) /* bus mode (master operation) */ + /* Bit 9 is reserved */ + #define SPACEMIT_CR_UR BIT(10) /* unit reset */ +-/* Bits 11-12 are reserved */ ++#define SPACEMIT_CR_RSTREQ BIT(11) /* i2c bus reset request */ ++/* Bit 12 is reserved */ + #define SPACEMIT_CR_SCLE BIT(13) /* master clock enable */ + #define SPACEMIT_CR_IUE BIT(14) /* unit enable */ + /* Bits 15-17 are reserved */ +@@ -78,6 +80,8 @@ + SPACEMIT_SR_ALD) + + #define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */ ++/* the cycles of SCL during bus reset */ ++#define SPACEMIT_RCR_FIELD_RST_CYC GENMASK(3, 0) + + /* SPACEMIT_IBMR register fields */ + #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */ +@@ -91,6 +95,8 @@ + + #define SPACEMIT_SR_ERR (SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD) + ++#define SPACEMIT_BUS_RESET_CLK_CNT_MAX 9 ++ + enum spacemit_i2c_state { + SPACEMIT_STATE_IDLE, + SPACEMIT_STATE_START, +@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c) + static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + { + u32 status; ++ u8 clk_cnt; + + /* if bus is locked, reset unit. 0: locked */ + status = readl(i2c->base + SPACEMIT_IBMR); +@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + spacemit_i2c_reset(i2c); + usleep_range(10, 20); + ++ for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) { ++ status = readl(i2c->base + SPACEMIT_IBMR); ++ if (status & SPACEMIT_BMR_SDA) ++ return; ++ ++ /* There's nothing left to save here, we are about to exit */ ++ writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1), ++ i2c->base + SPACEMIT_IRCR); ++ writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR); ++ usleep_range(20, 30); ++ } ++ + /* check sda again here */ + status = readl(i2c->base + SPACEMIT_IBMR); + if (!(status & SPACEMIT_BMR_SDA)) +-- +2.51.0 + diff --git a/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch b/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch new file mode 100644 index 0000000000..6022943432 --- /dev/null +++ b/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch @@ -0,0 +1,87 @@ +From 87a63dc5dd845d27ff9c8ae26bfc475ed787b433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:26 +0800 +Subject: i2c: spacemit: remove stop function to avoid bus error + +From: Troy Mitchell + +[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ] + +Previously, STOP handling was split into two separate steps: + 1) clear TB/STOP/START/ACK bits + 2) issue STOP by calling spacemit_i2c_stop() + +This left a small window where the control register was updated +twice, which can confuse the controller. While this race has not +been observed with interrupt-driven transfers, it reliably causes +bus errors in PIO mode. + +Inline the STOP sequence into the IRQ handler and ensure that +control register bits are updated atomically in a single writel(). + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Signed-off-by: Troy Mitchell +Reviewed-by: Aurelien Jarno +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index ee08811f4087c..84f132d0504dc 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c) + writel(val, i2c->base + SPACEMIT_ICR); + } + +-static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c) +-{ +- u32 val; +- +- val = readl(i2c->base + SPACEMIT_ICR); +- val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB; +- +- if (i2c->read) +- val |= SPACEMIT_CR_ACKNAK; +- +- writel(val, i2c->base + SPACEMIT_ICR); +-} +- + static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c) + { + unsigned long time_left; +@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid) + + val = readl(i2c->base + SPACEMIT_ICR); + val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START); +- writel(val, i2c->base + SPACEMIT_ICR); + + switch (i2c->state) { + case SPACEMIT_STATE_START: +@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid) + } + + if (i2c->state != SPACEMIT_STATE_IDLE) { ++ val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE; ++ + if (spacemit_i2c_is_last_msg(i2c)) { + /* trigger next byte with stop */ +- spacemit_i2c_stop(i2c); +- } else { +- /* trigger next byte */ +- val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB; +- writel(val, i2c->base + SPACEMIT_ICR); ++ val |= SPACEMIT_CR_STOP; ++ ++ if (i2c->read) ++ val |= SPACEMIT_CR_ACKNAK; + } ++ writel(val, i2c->base + SPACEMIT_ICR); + } + + err_out: +-- +2.51.0 + diff --git a/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..c6a1332360 --- /dev/null +++ b/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From be9f96bf6241871e935e5b34c0bfaa7e000a09ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index fc2829c22c647..93632194ffcca 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch new file mode 100644 index 0000000000..f3276899a6 --- /dev/null +++ b/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch @@ -0,0 +1,96 @@ +From b1390fdad74d203413ce6dd3d74b464b163a241c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:08 +0800 +Subject: i3c: master: svc: Use manual response for IBI events + +From: Stanley Chu + +[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ] + +Driver wants to nack the IBI request when the target is not in the +known address list. In below code, svc_i3c_master_nack_ibi() will +cause undefined behavior when using AUTOIBI with auto response rule, +because hw always auto ack the IBI request. + + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); + if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) + svc_i3c_master_nack_ibi(master); + ... + break; + +AutoIBI has another issue that the controller doesn't quit AutoIBI state +after IBIWON polling timeout when there is a SDA glitch(high->low->high). +1. SDA high->low: raising an interrupt to execute IBI ISR +2. SDA low->high +3. Driver writes an AutoIBI request +4. AutoIBI process does not start because SDA is not low +5. IBIWON polling times out +6. Controller reamins in AutoIBI state and doesn't accept EmitStop request + +Emitting broadcast address with IBIRESP_MANUAL avoids both issues. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index ece5633538958..fc2829c22c647 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +-- +2.51.0 + diff --git a/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..7e721fd74e --- /dev/null +++ b/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From bc5e60e82100d53012c436e22305a2d7e893357c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 53571e6b3162c..66df5bed6a562 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch b/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch new file mode 100644 index 0000000000..62b52a6daa --- /dev/null +++ b/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch @@ -0,0 +1,50 @@ +From 415421efc94989ec55ffb0c61535fdbf6c9b8e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 11:02:10 -0700 +Subject: idpf: fix mismatched free function for dma_alloc_coherent + +From: Alok Tiwari + +[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ] + +The mailbox receive path allocates coherent DMA memory with +dma_alloc_coherent(), but frees it with dmam_free_coherent(). +This is incorrect since dmam_free_coherent() is only valid for +buffers allocated with dmam_alloc_coherent(). + +Fix the mismatch by using dma_free_coherent() instead of +dmam_free_coherent + +Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg") +Signed-off-by: Alok Tiwari +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Jacob Keller +Reviewed-by: Madhu Chittim +Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +index cb9a27307670e..edec127fb52f4 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +@@ -701,9 +701,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter) + /* If post failed clear the only buffer we supplied */ + if (post_err) { + if (dma_mem) +- dmam_free_coherent(&adapter->pdev->dev, +- dma_mem->size, dma_mem->va, +- dma_mem->pa); ++ dma_free_coherent(&adapter->pdev->dev, ++ dma_mem->size, dma_mem->va, ++ dma_mem->pa); + break; + } + +-- +2.51.0 + diff --git a/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch b/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch new file mode 100644 index 0000000000..44025d1b70 --- /dev/null +++ b/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch @@ -0,0 +1,56 @@ +From 14eff6662965235168a680efb95e1eab2e678ac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:54:56 +0200 +Subject: idpf: fix Rx descriptor ready check barrier in splitq + +From: Alexander Lobakin + +[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ] + +No idea what the current barrier position was meant for. At that point, +nothing is read from the descriptor, only the pointer to the actual one +is fetched. +The correct barrier usage here is after the generation check, so that +only the first qword is read if the descriptor is not yet ready and we +need to stop polling. Debatable on coherent DMA as the Rx descriptor +size is <= cacheline size, but anyway, the current barrier position +only makes the codegen worse. + +Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") +Reviewed-by: Maciej Fijalkowski +Signed-off-by: Alexander Lobakin +Tested-by: Ramu R +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +index cd83243e7c765..6438e371f8bd8 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +@@ -3434,18 +3434,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget) + /* get the Rx desc from Rx queue based on 'next_to_clean' */ + rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb; + +- /* This memory barrier is needed to keep us from reading +- * any other fields out of the rx_desc +- */ +- dma_rmb(); +- + /* if the descriptor isn't done, no work yet to do */ + gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id, + VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M); +- + if (idpf_queue_has(GEN_CHK, rxq) != gen_id) + break; + ++ dma_rmb(); ++ + rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M, + rx_desc->rxdid_ucast); + if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) { +-- +2.51.0 + diff --git a/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch b/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch new file mode 100644 index 0000000000..42d0f6f22b --- /dev/null +++ b/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch @@ -0,0 +1,121 @@ +From 2bab812d73adaadacbddc8b75879a068114a2a16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:20 +0200 +Subject: iio: consumers: Fix handling of negative channel scale in + iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ] + +There is an issue with the handling of negative channel scales +in iio_convert_raw_to_processed_unlocked() when the channel-scale +is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type: + +Things work for channel-scale values > -1.0 and < 0.0 because of +the use of signed values in: + + *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); + +Things will break however for scale values < -1.0. Lets for example say +that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5. + +The result should then be 2 * 10 * -1.5 = -30. + +channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000, +now lets see what gets stored in processed: + +1. *processed = raw64 * scale_val * scale; +2. *processed += raw64 * scale_val2 * scale / 1000000LL; + +1. Sets processed to 2 * -1 * 10 = -20 +2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed + +And the end result is processed = -20 + 10 = -10, which is not correct. + +Fix this by always using the abs value of both scale_val and scale_val2 +and if either is negative multiply the end-result by -1. + +Note there seems to be an unwritten rule about negative +IIO_VAL_INT_PLUS_[MICRO|NANO] values that: + +i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx +ii. values <= -1.0 are written as val=-xxx val2=xxx + +But iio_format_value() will also correctly display a third option: + +iii. values <= -1.0 written as val=-xxx val2=-xxx + +Since iio_format_value() uses abs(val) when val2 < 0. + +This fix also makes iio_convert_raw_to_processed() properly handle +channel-scales using this third option. + +Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") +Cc: Matteo Martelli +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index c174ebb7d5e6d..d36a80a7b8a93 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + { + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; +- s64 raw64 = raw; ++ s64 denominator, raw64 = raw; + + offset_type = iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); +@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000LL); +- break; + case IIO_VAL_INT_PLUS_NANO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000000LL); ++ switch (scale_type) { ++ case IIO_VAL_INT_PLUS_MICRO: ++ denominator = MICRO; ++ break; ++ case IIO_VAL_INT_PLUS_NANO: ++ denominator = NANO; ++ break; ++ } ++ *processed = raw64 * scale * abs(scale_val); ++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); ++ if (scale_val < 0 || scale_val2 < 0) ++ *processed *= -1; + break; + case IIO_VAL_FRACTIONAL: + *processed = div_s64(raw64 * (s64)scale_val * scale, +-- +2.51.0 + diff --git a/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..4499098f82 --- /dev/null +++ b/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 985f54b97470e8a00b90250b5e04d207eaf3f59b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index d36a80a7b8a93..642beb4b3360d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch b/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch new file mode 100644 index 0000000000..b4a1f9c31b --- /dev/null +++ b/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch @@ -0,0 +1,83 @@ +From 6b3d207981bdb2b171b55456951e8bd13ab93b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:30:51 +0000 +Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup() + +From: Eric Dumazet + +[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ] + +We need to check socket netns before considering them in ping_get_port(). +Otherwise, one malicious netns could 'consume' all ports. + +Add corresponding check in ping_lookup(). + +Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Reviewed-by: Yue Haibing +Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ping.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 031df4c19fcc5..d2c3480df8f77 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, + + int ping_get_port(struct sock *sk, unsigned short ident) + { ++ struct net *net = sock_net(sk); + struct inet_sock *isk, *isk2; + struct hlist_head *hlist; + struct sock *sk2 = NULL; +@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + for (i = 0; i < (1L << 16); i++, result++) { + if (!result) + result++; /* avoid zero */ +- hlist = ping_hashslot(&ping_table, sock_net(sk), +- result); ++ hlist = ping_hashslot(&ping_table, net, result); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + if (isk2->inet_num == result) +@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + if (i >= (1L << 16)) + goto fail; + } else { +- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); ++ hlist = ping_hashslot(&ping_table, net, ident); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + /* BUG? Why is this reuse and not reuseaddr? ping.c +@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) + pr_debug("was not hashed\n"); + sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); +- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ sock_prot_inuse_add(net, sk->sk_prot, 1); + } + spin_unlock(&ping_table.lock); + return 0; +@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + } + + sk_for_each_rcu(sk, hslot) { ++ if (!net_eq(sock_net(sk), net)) ++ continue; + isk = inet_sk(sk); + + pr_debug("iterate\n"); +-- +2.51.0 + diff --git a/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch new file mode 100644 index 0000000000..f13fcb1177 --- /dev/null +++ b/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch @@ -0,0 +1,39 @@ +From 081a8b3ee79499a03c18b964be938268a33b9fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:11:05 +0200 +Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD + +From: Geert Uytterhoeven + +[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ] + +INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and +init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to +prevent asking the user about this feature when configuring a kernel +without initramfs support. + +Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Martin Wilck +Reviewed-by: David Disseldorp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 2e15b4a8478e8..32be83de9c699 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1472,6 +1472,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +-- +2.51.0 + diff --git a/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch b/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch new file mode 100644 index 0000000000..3b9e2451c1 --- /dev/null +++ b/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch @@ -0,0 +1,69 @@ +From d102fdda90f7be0a6f20317d96455f84793234fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:16:28 +0200 +Subject: iommu/selftest: prevent use of uninitialized variable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alessandro Zanni + +[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ] + +Fix to avoid the usage of the `res` variable uninitialized in the +following macro expansions. + +It solves the following warning: +In function ‘iommufd_viommu_vdevice_alloc’, + inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1: +../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized] + 760 | if (!(__exp _t __seen)) { \ + | ^ +../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’ + 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1) + | ^~~~~~~~ +iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’ + 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents)) + | ^~~~~~~~~ +iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’ + 2924 | test_cmd_trigger_vevents(dev_id, 3); + | ^~~~~~~~~~~~~~~~~~~~~~~~ + +The issue can be reproduced, building the tests, with the command: make -C +tools/testing/selftests TARGETS=iommu + +Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com +Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage") +Signed-off-by: Alessandro Zanni +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd_utils.h | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h +index 6e967b58acfd3..1d4936747db45 100644 +--- a/tools/testing/selftests/iommu/iommufd_utils.h ++++ b/tools/testing/selftests/iommu/iommufd_utils.h +@@ -995,15 +995,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents) + .dev_id = dev_id, + }, + }; +- int ret; + + while (nvevents--) { +- ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), +- &trigger_vevent_cmd); +- if (ret < 0) ++ if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), ++ &trigger_vevent_cmd)) + return -1; + } +- return ret; ++ return 0; + } + + #define test_cmd_trigger_vevents(dev_id, nvevents) \ +-- +2.51.0 + diff --git a/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch b/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch new file mode 100644 index 0000000000..89de29564e --- /dev/null +++ b/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch @@ -0,0 +1,79 @@ +From 570ef33688d26464eeda6d86e3c3b202d4020b12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 13:01:59 +0800 +Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic + +From: Vineeth Pillai (Google) + +[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ] + +In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR +maybe uninitialized or zero in that case and may cause oops like: + + Oops: general protection fault, probably for non-canonical address + 0xf00087d3f000f000: 0000 [#1] SMP NOPTI + CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 + RIP: 0010:pgtable_walk_level+0x98/0x150 + RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 + RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e + RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 + RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 + R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 + R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 + FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 + PKRU: 55555554 + Call Trace: + + pgtable_walk_level+0x88/0x150 + domain_translation_struct_show.isra.0+0x2d9/0x300 + dev_domain_translation_struct_show+0x20/0x40 + seq_read_iter+0x12d/0x490 +... + +Avoid walking the page table if TT is not 00b or 01b. + +Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") +Signed-off-by: Vineeth Pillai (Google) +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c +index affbf4a1558de..5aa7f46a420b5 100644 +--- a/drivers/iommu/intel/debugfs.c ++++ b/drivers/iommu/intel/debugfs.c +@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, + } + pgd &= VTD_PAGE_MASK; + } else { /* legacy mode */ +- pgd = context->lo & VTD_PAGE_MASK; +- agaw = context->hi & 7; ++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; ++ ++ /* ++ * According to Translation Type(TT), ++ * get the page table pointer(SSPTPTR). ++ */ ++ switch (tt) { ++ case CONTEXT_TT_MULTI_LEVEL: ++ case CONTEXT_TT_DEV_IOTLB: ++ pgd = context->lo & VTD_PAGE_MASK; ++ agaw = context->hi & 7; ++ break; ++ default: ++ goto iommu_unlock; ++ } + } + + seq_printf(m, "Device %04x:%02x:%02x.%x ", +-- +2.51.0 + diff --git a/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch b/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch new file mode 100644 index 0000000000..bc117c36bf --- /dev/null +++ b/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch @@ -0,0 +1,52 @@ +From 3190fbee1714c897596adeeddcc7303ef976d9a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 10:41:30 +0800 +Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk + +From: Lu Baolu + +[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ] + +Dirty page tracking relies on the IOMMU atomically updating the dirty bit +in the paging-structure entry. For this operation to succeed, the paging- +structure memory must be coherent between the IOMMU and the CPU. In +another word, if the iommu page walk is incoherent, dirty page tracking +doesn't work. + +The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: + +"Remapping hardware encountering the need to atomically update A/EA/D bits + in a paging-structure entry that is not snooped will result in a non- + recoverable fault." + +To prevent an IOMMU from being incorrectly configured for dirty page +tracking when it is operating in an incoherent mode, mark SSADS as +supported only when both ecap_slads and ecap_smpwc are supported. + +Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") +Signed-off-by: Lu Baolu +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h +index c699ed8810f23..ca39044978fb7 100644 +--- a/drivers/iommu/intel/iommu.h ++++ b/drivers/iommu/intel/iommu.h +@@ -541,7 +541,8 @@ enum { + #define pasid_supported(iommu) (sm_supported(iommu) && \ + ecap_pasid((iommu)->ecap)) + #define ssads_supported(iommu) (sm_supported(iommu) && \ +- ecap_slads((iommu)->ecap)) ++ ecap_slads((iommu)->ecap) && \ ++ ecap_smpwc(iommu->ecap)) + #define nested_supported(iommu) (sm_supported(iommu) && \ + ecap_nest((iommu)->ecap)) + +-- +2.51.0 + diff --git a/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch b/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch new file mode 100644 index 0000000000..8fcb2f609c --- /dev/null +++ b/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch @@ -0,0 +1,129 @@ +From 5ad0ad9ff782fa48839eb0e6a6699a362e448506 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 13:47:30 +0800 +Subject: iommufd: Register iommufd mock devices with fwspec + +From: Guixin Liu + +[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ] + +Since the bus ops were retired the iommu subsystem changed to using fwspec +to match the iommu driver to the iommu device. If a device has a NULL +fwspec then it is matched to the first iommu driver with a NULL fwspec, +effectively disabling support for systems with more than one non-fwspec +iommu driver. + +Thus, if the iommufd selfest are run in an x86 system that registers a +non-fwspec iommu driver they fail to bind their mock devices to the mock +iommu driver. + +Fix this by allocating a software fwnode for mock iommu driver's +iommu_device, and set it to the device which mock iommu driver created. + +This is done by adding a new helper iommu_mock_device_add() which abuses +the internals of the fwspec system to establish a fwspec before the device +is added and is careful not to leak it. A matching dummy fwspec is +automatically added to the mock iommu driver. + +Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests": +PASSED: 229 / 229 tests passed. + +In addition, this issue is also can be found on amd platform, and +also tested on a amd machine. + +Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com +Fixes: 17de3f5fdd35 ("iommu: Retire bus ops") +Signed-off-by: Guixin Liu +Reviewed-by: Lu Baolu +Tested-by: Qinyun Tan +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu-priv.h | 2 ++ + drivers/iommu/iommu.c | 26 ++++++++++++++++++++++++++ + drivers/iommu/iommufd/selftest.c | 2 +- + 3 files changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h +index e236b932e7668..c95394cd03a77 100644 +--- a/drivers/iommu/iommu-priv.h ++++ b/drivers/iommu/iommu-priv.h +@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu, + const struct bus_type *bus, + struct notifier_block *nb); + ++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu); ++ + struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group, + ioasid_t pasid, + unsigned int type); +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index a4b606c591da6..c9a8d19e2ab77 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu, + struct notifier_block *nb) + { + bus_unregister_notifier(bus, nb); ++ fwnode_remove_software_node(iommu->fwnode); + iommu_device_unregister(iommu); + } + EXPORT_SYMBOL_GPL(iommu_device_unregister_bus); +@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu, + if (err) + return err; + ++ iommu->fwnode = fwnode_create_software_node(NULL, NULL); ++ if (IS_ERR(iommu->fwnode)) { ++ bus_unregister_notifier(bus, nb); ++ return PTR_ERR(iommu->fwnode); ++ } ++ + spin_lock(&iommu_device_lock); + list_add_tail(&iommu->list, &iommu_device_list); + spin_unlock(&iommu_device_lock); +@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu, + iommu_device_unregister_bus(iommu, bus, nb); + return err; + } ++ WRITE_ONCE(iommu->ready, true); + return 0; + } + EXPORT_SYMBOL_GPL(iommu_device_register_bus); ++ ++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu) ++{ ++ int rc; ++ ++ mutex_lock(&iommu_probe_device_lock); ++ rc = iommu_fwspec_init(dev, iommu->fwnode); ++ mutex_unlock(&iommu_probe_device_lock); ++ ++ if (rc) ++ return rc; ++ ++ rc = device_add(dev); ++ if (rc) ++ iommu_fwspec_free(dev); ++ return rc; ++} ++EXPORT_SYMBOL_GPL(iommu_mock_device_add); + #endif + + static struct dev_iommu *dev_iommu_get(struct device *dev) +diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c +index c52bf037a2f01..4a558c4e6f882 100644 +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -981,7 +981,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags) + goto err_put; + } + +- rc = device_add(&mdev->dev); ++ rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev); + if (rc) + goto err_put; + return mdev; +-- +2.51.0 + diff --git a/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..7fbfdac655 --- /dev/null +++ b/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From d03fbfb0c928e2a0f068729804c5bdcb87250585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index d8a284999544b..206c6700e2006 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch b/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch new file mode 100644 index 0000000000..e0cbffdf4f --- /dev/null +++ b/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch @@ -0,0 +1,223 @@ +From d3ddab2680956d9d5eef0c17ade08d4edcee2d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 21:46:54 +0800 +Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable + +From: Zhang Tengfei + +[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ] + +KCSAN reported a data-race on the `ipvs->enable` flag, which is +written in the control path and read concurrently from many other +contexts. + +Following a suggestion by Julian, this patch fixes the race by +converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. +This lightweight approach ensures atomic access and acts as a +compiler barrier, preventing unsafe optimizations where the flag +is checked in loops (e.g., in ip_vs_est.c). + +Additionally, the `enable` checks in the fast-path hooks +(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are +removed. These are unnecessary since commit 857ca89711de +("ipvs: register hooks only with services"). The `enable=0` +condition they check for can only occur in two rare and non-fatal +scenarios: 1) after hooks are registered but before the flag is set, +and 2) after hooks are unregistered on cleanup_net. In the worst +case, a single packet might be mishandled (e.g., dropped), which +does not lead to a system crash or data corruption. Adding a check +in the performance-critical fast-path to handle this harmless +condition is not a worthwhile trade-off. + +Fixes: 857ca89711de ("ipvs: register hooks only with services") +Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 +Suggested-by: Julian Anastasov +Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ +Signed-off-by: Zhang Tengfei +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + net/netfilter/ipvs/ip_vs_core.c | 11 ++++------- + net/netfilter/ipvs/ip_vs_ctl.c | 6 +++--- + net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++-------- + 4 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 44b2ad695c153..35d1260dbff0d 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t) + * conntrack cleanup for the net. + */ + smp_rmb(); +- if (ipvs->enable) ++ if (READ_ONCE(ipvs->enable)) + ip_vs_conn_drop_conntrack(cp); + } + +@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) + cond_resched_rcu(); + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + break; + } + rcu_read_unlock(); +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index c7a8a08b73089..5ea7ab8bf4dcc 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat + if (unlikely(!skb_dst(skb))) + return NF_ACCEPT; + +- if (!ipvs->enable) +- return NF_ACCEPT; +- + ip_vs_fill_iph_skb(af, skb, false, &iph); + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state + return NF_ACCEPT; + } + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + ip_vs_fill_iph_skb(af, skb, false, &iph); +@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, + int r; + + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + if (state->pf == NFPROTO_IPV4) { +@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net) + return -ENOMEM; + + /* Hold the beast until a service is registered */ +- ipvs->enable = 0; ++ WRITE_ONCE(ipvs->enable, 0); + ipvs->net = net; + /* Counters used for creating unique names */ + ipvs->gen = atomic_read(&ipvs_netns_cnt); +@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) + ipvs = net_ipvs(net); + ip_vs_unregister_hooks(ipvs, AF_INET); + ip_vs_unregister_hooks(ipvs, AF_INET6); +- ipvs->enable = 0; /* Disable packet reception */ ++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 6a6fc44785337..4c8fa22be88ad 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) + struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock; + if (!kd) + continue; +@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + + *svc_p = svc; + +- if (!ipvs->enable) { ++ if (!READ_ONCE(ipvs->enable)) { + /* Now there is a service - full throttle */ +- ipvs->enable = 1; ++ WRITE_ONCE(ipvs->enable, 1); + + /* Start estimation for first time */ + ip_vs_est_reload_start(ipvs); +diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c +index 15049b8267327..93a925f1ed9b8 100644 +--- a/net/netfilter/ipvs/ip_vs_est.c ++++ b/net/netfilter/ipvs/ip_vs_est.c +@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data) + void ip_vs_est_reload_start(struct netns_ipvs *ipvs) + { + /* Ignore reloads before first service is added */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + return; + ip_vs_est_stopped_recalc(ipvs); + /* Bump the kthread configuration genid */ +@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + int i; + + if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && +- ipvs->enable && ipvs->est_max_threads) ++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) + return -EINVAL; + + mutex_lock(&ipvs->est_mutex); +@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + } + + /* Start kthread tasks only when services are present */ +- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { ++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { + ret = ip_vs_est_kthread_start(ipvs, kd); + if (ret < 0) + goto out; +@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) + struct ip_vs_estimator *est = &stats->est; + int ret; + +- if (!ipvs->est_max_threads && ipvs->enable) ++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) + ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); + + est->ktid = -1; +@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + /* Wait for cpufreq frequency transition */ + wait_event_idle_timeout(wq, kthread_should_stop(), + HZ / 50); +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + } + +@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + rcu_read_unlock(); + local_bh_enable(); + +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + cond_resched(); + +@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + mutex_lock(&ipvs->est_mutex); + for (id = 1; id < ipvs->est_kt_count; id++) { + /* netns clean up started, abort */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock2; + kd = ipvs->est_kt_arr[id]; + if (!kd) +@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + id = ipvs->est_kt_count; + + next_kt: +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto unlock; + id--; + if (id < 0) +-- +2.51.0 + diff --git a/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch b/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch new file mode 100644 index 0000000000..50b842447b --- /dev/null +++ b/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch @@ -0,0 +1,47 @@ +From d9466dd587fb08ffdc0a703486fc63ff3a6c12e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 15:26:39 -0500 +Subject: kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact + +From: Kienan Stewart + +[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ] + +In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b +("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts") +artifacts required for building out-of-tree kernel modules had +$(objtree) prepended to them to prepare for building in other +directories. + +When building external modules for powerpc, +arch/powerpc/lib/crtsavres.o is required for certain +configurations. This artifact is missing the prepended $(objtree). + +Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=") +Acked-by: Masahiro Yamada +Reviewed-by: Nicolas Schier +Tested-by: Nicolas Schier +Signed-off-by: Kienan Stewart +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index f3804103c56cc..9933b98df69d7 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy) + # There is a corresponding test in arch/powerpc/lib/Makefile + KBUILD_LDFLAGS_MODULE += --save-restore-funcs + else +-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o ++KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o + endif + + ifdef CONFIG_CPU_LITTLE_ENDIAN +-- +2.51.0 + diff --git a/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch b/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch new file mode 100644 index 0000000000..8da13d5bb6 --- /dev/null +++ b/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch @@ -0,0 +1,85 @@ +From 7919890fdfd8a83307a7ee1e33d6fc5d80563850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 21:15:50 +0000 +Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing + +From: Fan Wu + +[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ] + +Fix the X.509 Basic Constraints CA flag parsing to correctly handle +the ASN.1 DER encoded structure. The parser was incorrectly treating +the length field as the boolean value. + +Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. +According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: + +Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) + +The basicConstraints extension with CA:TRUE is encoded as: + + SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) + ^-- v[2] ^-- v[3] ^-- v[4] + +The parser was checking v[3] (the length field, always 0x01) instead +of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). + +Also handle the case where the extension is an empty SEQUENCE (30 00), +which is valid for CA:FALSE when the default value is omitted as +required by DER encoding rules (X.690 section 11.5). + +Per ITU-T X.690-0207: +- Section 11.5: Default values must be omitted in DER +- Section 11.1: DER requires TRUE to be encoded as 0xFF + +Link: https://datatracker.ietf.org/doc/html/rfc5280 +Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf +Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") +Signed-off-by: Fan Wu +Reviewed-by: Lukas Wunner +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 2ffe4ae90bea0..8df3fa60a44f8 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen, + /* + * Get hold of the basicConstraints + * v[1] is the encoding size +- * (Expect 0x2 or greater, making it 1 or more bytes) ++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or ++ * 0x03 or greater for non-empty SEQUENCE) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) +- * v[3] is the contents of the ASN1_BOOL +- * (Expect 1 if the CA is TRUE) ++ * v[3] is the length of the ASN1_BOOL ++ * (Expect 1 for a single byte boolean) ++ * v[4] is the contents of the ASN1_BOOL ++ * (Expect 0xFF if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) +@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen, + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; +- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) ++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ ++ if (v[1] == 0) ++ return 0; ++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; ++ else ++ return -EBADMSG; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch b/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch new file mode 100644 index 0000000000..31907dba3e --- /dev/null +++ b/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch @@ -0,0 +1,40 @@ +From b6a655b4310b5789d755f3aad55b35984a570d90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 17:13:02 +0200 +Subject: kselftest/arm64/gcs: Correctly check return value when disabling GCS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ] + +The return value was not assigned to 'ret', so the check afterwards +does not do anything. + +Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c +index 3fb9742342a34..a4462a00111e7 100644 +--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c ++++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c +@@ -347,7 +347,7 @@ int main(void) + } + + /* One last test: disable GCS, we can do this one time */ +- my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0); ++ ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0); + if (ret != 0) + ksft_print_msg("Failed to disable GCS: %d\n", ret); + +-- +2.51.0 + diff --git a/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch b/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch new file mode 100644 index 0000000000..229f78b836 --- /dev/null +++ b/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch @@ -0,0 +1,141 @@ +From ffdcf17c323eb43fe8de0b2008ed98dfb273502b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 12:51:22 +0800 +Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting + +From: Fenglin Wu + +[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ] + +There is a register to clamp the flash current per LED channel when +safety timer is disabled. It needs to be updated according to the +maximum torch LED current setting to ensure the torch current won't +be clamped unexpectedly. + +Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") +Signed-off-by: Fenglin Wu +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------ + 1 file changed, 36 insertions(+), 26 deletions(-) + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index 89cf5120f5d55..db7c2c743adc7 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -114,36 +114,39 @@ enum { + REG_THERM_THRSH1, + REG_THERM_THRSH2, + REG_THERM_THRSH3, ++ REG_TORCH_CLAMP, + REG_MAX_COUNT, + }; + + static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x08, 0, 7), /* status1 */ +- REG_FIELD(0x09, 0, 7), /* status2 */ +- REG_FIELD(0x0a, 0, 7), /* status3 */ +- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ +- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x47, 0, 5), /* iresolution */ +- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ +- REG_FIELD(0x4c, 0, 2), /* chan_en */ +- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ +- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ ++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), ++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), ++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), ++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), + }; + + static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x06, 0, 7), /* status1 */ +- REG_FIELD(0x07, 0, 6), /* status2 */ +- REG_FIELD(0x09, 0, 7), /* status3 */ +- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ +- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x49, 0, 3), /* iresolution */ +- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ +- REG_FIELD(0x4e, 0, 3), /* chan_en */ +- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ ++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), ++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), ++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), + }; + + struct qcom_flash_data { +@@ -156,6 +159,7 @@ struct qcom_flash_data { + u8 max_channels; + u8 chan_en_bits; + u8 revision; ++ u8 torch_clamp; + }; + + struct qcom_flash_led { +@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, + u32 current_ua, timeout_us; + u32 channels[4]; + int i, rc, count; ++ u8 torch_clamp; + + count = fwnode_property_count_u32(node, "led-sources"); + if (count <= 0) { +@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, + current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); + led->max_torch_current_ma = current_ua / UA_PER_MA; + ++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; ++ if (torch_clamp != 0) ++ torch_clamp--; ++ ++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); ++ + if (fwnode_property_present(node, "flash-max-microamp")) { + flash->led_cdev.flags |= LED_DEV_CAP_FLASH; + +@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) + flash_data->leds_count++; + } + +- return 0; +- ++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); + release: + while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) + v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]); +-- +2.51.0 + diff --git a/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch b/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch new file mode 100644 index 0000000000..9ff87d537a --- /dev/null +++ b/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch @@ -0,0 +1,64 @@ +From 9937712e653525e00cb903c685846b81e9fe4d82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:47:12 +0200 +Subject: leds: leds-lp55xx: Use correct address for memory programming + +From: Andrei Lalaev + +[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ] + +Memory programming doesn't work for devices without page support. +For example, LP5562 has 3 engines but doesn't support pages, +the start address is changed depending on engine number. +According to datasheet [1], the PROG MEM register addresses for each +engine are as follows: + + Engine 1: 0x10 + Engine 2: 0x30 + Engine 3: 0x50 + +However, the current implementation incorrectly calculates the address +of PROG MEM register using the engine index starting from 1: + + prog_mem_base = 0x10 + LP55xx_BYTES_PER_PAGE = 0x20 + + Engine 1: 0x10 + 0x20 * 1 = 0x30 + Engine 2: 0x10 + 0x20 * 2 = 0x50 + Engine 3: 0x10 + 0x20 * 3 = 0x70 + +This results in writing to the wrong engine memory, causing pattern +programming to fail. + +To correct it, the engine index should be decreased: + Engine 1: 0x10 + 0x20 * 0 = 0x10 + Engine 2: 0x10 + 0x20 * 1 = 0x30 + Engine 3: 0x10 + 0x20 * 2 = 0x50 + +1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf + +Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function") +Signed-off-by: Andrei Lalaev +Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp55xx-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c +index e71456a56ab8d..fd447eb7eb15e 100644 +--- a/drivers/leds/leds-lp55xx-common.c ++++ b/drivers/leds/leds-lp55xx-common.c +@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip, + * For LED chip that support page, PAGE is already set in load_engine. + */ + if (!cfg->pages_per_engine) +- start_addr += LP55xx_BYTES_PER_PAGE * idx; ++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1); + + for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) { + /* Write to the next page each 32 bytes (if supported) */ +-- +2.51.0 + diff --git a/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch b/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch new file mode 100644 index 0000000000..9bb6bde8e9 --- /dev/null +++ b/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch @@ -0,0 +1,40 @@ +From 716600ace6f68ca1ae087153ae8e82afebe69f10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jul 2025 07:56:45 +0000 +Subject: leds: max77705: Function return instead of variable assignment + +From: Len Bao + +[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ] + +Coverity noticed that assigning value -EINVAL to 'ret' in the if +statement is useless because 'ret' is overwritten a few lines later. +However, after inspect the code, this warning reveals that we need to +return -EINVAL instead of the variable assignment. So, fix it. + +Coverity-id: 1646104 +Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support") +Signed-off-by: Len Bao +Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-max77705.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c +index 933cb4f19be9b..b7403b3fcf5e7 100644 +--- a/drivers/leds/leds-max77705.c ++++ b/drivers/leds/leds-max77705.c +@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw + + ret = fwnode_property_read_u32(np, "reg", ®); + if (ret || reg >= MAX77705_LED_NUM_LEDS) +- ret = -EINVAL; ++ return -EINVAL; + + info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL); + if (!info) +-- +2.51.0 + diff --git a/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch b/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch new file mode 100644 index 0000000000..e425c81325 --- /dev/null +++ b/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch @@ -0,0 +1,38 @@ +From 5698e58cf942405c4f63e661244ce06064a395a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 22:51:19 +0100 +Subject: libbpf: Export bpf_object__prepare symbol + +From: Mykyta Yatsenko + +[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ] + +Add missing LIBBPF_API macro for bpf_object__prepare function to enable +its export. libbpf.map had bpf_object__prepare already listed. + +Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load") +Signed-off-by: Mykyta Yatsenko +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h +index 1137e7d2e1b5a..739ee60a780cd 100644 +--- a/tools/lib/bpf/libbpf.h ++++ b/tools/lib/bpf/libbpf.h +@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz, + * @return 0, on success; negative error code, otherwise, error code is + * stored in errno + */ +-int bpf_object__prepare(struct bpf_object *obj); ++LIBBPF_API int bpf_object__prepare(struct bpf_object *obj); + + /** + * @brief **bpf_object__load()** loads BPF object into kernel. +-- +2.51.0 + diff --git a/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch b/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch new file mode 100644 index 0000000000..5695f097d4 --- /dev/null +++ b/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch @@ -0,0 +1,121 @@ +From e3943caf5115fecd755b19c4f6eb9e9b61e698e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 15:17:51 +0800 +Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf + +From: D. Wythe + +[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ] + +When a module registers a struct_ops, the struct_ops type and its +corresponding map_value type ("bpf_struct_ops_") may reside in different +btf objects, here are four possible case: + ++--------+---------------+-------------+---------------------------------+ +| |bpf_struct_ops_| xxx_ops | | ++--------+---------------+-------------+---------------------------------+ +| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux | ++--------+---------------+-------------+---------------------------------+ +| case 1 | btf_vmlinux | mod_btf | INVALID | ++--------+---------------+-------------+---------------------------------+ +| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in | +| | | | vmlinux and mod. | ++--------+---------------+-------------+---------------------------------+ +| case 3 | mod_btf | mod_btf | be used and reg only in mod | ++--------+---------------+-------------+---------------------------------+ + +Currently we figure out the mod_btf by searching with the struct_ops type, +which makes it impossible to figure out the mod_btf when the struct_ops +type is in btf_vmlinux while it's corresponding map_value type is in +mod_btf (case 2). + +The fix is to use the corresponding map_value type ("bpf_struct_ops_") +as the lookup anchor instead of the struct_ops type to figure out the +`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate +the kern_type_id via btf__find_by_name_kind() with the `btf` we just +obtained from find_ksym_btf_id(). + +With this change the lookup obtains the correct btf and mod_btf for case 2, +preserves correct behavior for other valid cases, and still fails as +expected for the invalid scenario (case 1). + +Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") +Signed-off-by: D. Wythe +Signed-off-by: Andrii Nakryiko +Acked-by: Andrii Nakryiko +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 41c95b1220192..4abb9f4d245eb 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + const struct btf_member *kern_data_member; + struct btf *btf = NULL; + __s32 kern_vtype_id, kern_type_id; +- char tname[256]; ++ char tname[192], stname[256]; + __u32 i; + + snprintf(tname, sizeof(tname), "%.*s", + (int)bpf_core_essential_name_len(tname_raw), tname_raw); + +- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT, +- &btf, mod_btf); +- if (kern_type_id < 0) { +- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", +- tname); +- return kern_type_id; +- } +- kern_type = btf__type_by_id(btf, kern_type_id); ++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname); + +- /* Find the corresponding "map_value" type that will be used +- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example, +- * find "struct bpf_struct_ops_tcp_congestion_ops" from the +- * btf_vmlinux. ++ /* Look for the corresponding "map_value" type that will be used ++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf ++ * and the mod_btf. ++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops". + */ +- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX, +- tname, BTF_KIND_STRUCT); ++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf); + if (kern_vtype_id < 0) { +- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n", +- STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname); + return kern_vtype_id; + } + kern_vtype = btf__type_by_id(btf, kern_vtype_id); + ++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT); ++ if (kern_type_id < 0) { ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname); ++ return kern_type_id; ++ } ++ kern_type = btf__type_by_id(btf, kern_type_id); ++ + /* Find "struct tcp_congestion_ops" from + * struct bpf_struct_ops_tcp_congestion_ops { + * [ ... ] +@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + break; + } + if (i == btf_vlen(kern_vtype)) { +- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n", +- tname, STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n", ++ tname, stname); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.16/libbpf-fix-reuse-of-devmap.patch b/queue-6.16/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..f17b2e39d2 --- /dev/null +++ b/queue-6.16/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From eeb320d715472019bb5498f9d0b00abb6c750e1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 8fe427960eee4..41c95b1220192 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch b/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch new file mode 100644 index 0000000000..1f800744ec --- /dev/null +++ b/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch @@ -0,0 +1,39 @@ +From 429703d04a12c11d95d87ee4886212b12b9014b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 15:28:00 -0700 +Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY + +From: Randy Dunlap + +[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ] + +When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does +not need to be visible and settable since builtin_lsm_order is defined in +security.o, which is only built when CONFIG_SECURITY=y. + +So make CONFIG_LSM depend on CONFIG_SECURITY. + +Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM") +Signed-off-by: Randy Dunlap +[PM: subj tweak] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/Kconfig b/security/Kconfig +index 4816fc74f81eb..285f284dfcac4 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -269,6 +269,7 @@ endchoice + + config LSM + string "Ordered list of enabled LSMs" ++ depends on SECURITY + default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK + default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR + default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO +-- +2.51.0 + diff --git a/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch b/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch new file mode 100644 index 0000000000..521d9fde86 --- /dev/null +++ b/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch @@ -0,0 +1,39 @@ +From 355a58d16140256e1842fe40dcc0403453ff5123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 15:50:58 +0200 +Subject: media: i2c: vd55g1: Fix duster register address + +From: Benjamin Mugnier + +[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ] + +The duster register needs to be disabled on test patterns. While the +code is correctly doing so, the register address contained a typo, thus +not disabling the duster correctly. Fix the typo. + +Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor") + +Signed-off-by: Benjamin Mugnier +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/vd55g1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c +index dec6e3e231d54..37b83125bcc81 100644 +--- a/drivers/media/i2c/vd55g1.c ++++ b/drivers/media/i2c/vd55g1.c +@@ -66,7 +66,7 @@ + #define VD55G1_REG_READOUT_CTRL CCI_REG8(0x052e) + #define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL 0 + #define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2 1 +-#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ea) ++#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ae) + #define VD55G1_DUSTER_ENABLE BIT(0) + #define VD55G1_DUSTER_DISABLE 0 + #define VD55G1_DUSTER_DYN_ENABLE BIT(1) +-- +2.51.0 + diff --git a/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..4237d2dd29 --- /dev/null +++ b/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From 6b2e6197b49dad7c9a548381b72bc96b74f499f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index b7ca39f63dba8..6dfc912168510 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client) + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch new file mode 100644 index 0000000000..9a902e299e --- /dev/null +++ b/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch @@ -0,0 +1,92 @@ +From e7ddd940385ee9bfa1aafb1f5dff2793127c1d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 11:31:56 +0200 +Subject: media: st-delta: avoid excessive stack usage + +From: Arnd Bergmann + +[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ] + +Building with a reduced stack warning limit shows that delta_mjpeg_decode() +copies a giant structure to the stack each time but only uses three of +its members: + +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] + +Open-code the passing of the structure members that are actually used here. + +Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d24..a078f1107300e 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +-- +2.51.0 + diff --git a/queue-6.16/media-zoran-remove-zoran_fh-structure.patch b/queue-6.16/media-zoran-remove-zoran_fh-structure.patch new file mode 100644 index 0000000000..d95a04dc6f --- /dev/null +++ b/queue-6.16/media-zoran-remove-zoran_fh-structure.patch @@ -0,0 +1,63 @@ +From 21ca0b741168ad855e653f5036e0355e503ca702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 04:30:15 +0300 +Subject: media: zoran: Remove zoran_fh structure + +From: Jacopo Mondi + +[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ] + +The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been +mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), +but the structure stayed by mistake. It is now used in a single +location, assigned from a void pointer and then recast to a void +pointer, without being every accessed. Drop it. + +Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") +Signed-off-by: Jacopo Mondi +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/zoran/zoran.h | 6 ------ + drivers/media/pci/zoran/zoran_driver.c | 3 +-- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 1cd990468d3de..d05e222b39215 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index f42f596d3e629..ec7fc1da4cc02 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +-- +2.51.0 + diff --git a/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch b/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch new file mode 100644 index 0000000000..5e7dd3db20 --- /dev/null +++ b/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch @@ -0,0 +1,57 @@ +From 1107700191920d0f114098da354fae6e79bece36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 20:06:46 +0300 +Subject: mfd: max77705: max77705_charger: move active discharge setting to mfd + parent + +From: Dzmitry Sankouski + +[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ] + +Active discharge setting is a part of MFD top level i2c device, hence +cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1 +register from charger driver is a mistake. + +Move active discharge setting to MFD parent driver. + +Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") +Signed-off-by: Dzmitry Sankouski +Acked-by: Lee Jones +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/mfd/max77705.c | 3 +++ + drivers/power/supply/max77705_charger.c | 3 --- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c +index 6b263bacb8c28..ff07d0e0d5f8e 100644 +--- a/drivers/mfd/max77705.c ++++ b/drivers/mfd/max77705.c +@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c) + if (pmic_rev != MAX77705_PASS3) + return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev); + ++ /* Active Discharge Enable */ ++ regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1); ++ + ret = devm_regmap_add_irq_chip(dev, max77705->regmap, + i2c->irq, + IRQF_ONESHOT | IRQF_SHARED, 0, +diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c +index 329b430d0e506..3b75c82b9b9ea 100644 +--- a/drivers/power/supply/max77705_charger.c ++++ b/drivers/power/supply/max77705_charger.c +@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg) + regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00, + MAX77705_WDTEN_MASK, 0); + +- /* Active Discharge Enable */ +- regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1); +- + /* VBYPSET=5.0V */ + regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0); + +-- +2.51.0 + diff --git a/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch b/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch new file mode 100644 index 0000000000..d68ae039a3 --- /dev/null +++ b/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch @@ -0,0 +1,93 @@ +From acd3712440cbc1f5446e74f4963d9f0895d609bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 21:23:07 +0300 +Subject: mfd: max77705: Setup the core driver as an interrupt controller + +From: Dzmitry Sankouski + +[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ] + +Current implementation describes only MFD's own topsys interrupts. +However, max77705 has a register which indicates interrupt source, i.e. +it acts as an interrupt controller. There's 4 interrupt sources in +max77705: topsys, charger, fuelgauge, usb type-c manager. + +Setup max77705 MFD parent as an interrupt controller. Delete topsys +interrupts because currently unused. + +Remove shared interrupt flag, because we're are an interrupt controller +now, and subdevices should request interrupts from us. + +Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC") + +Signed-off-by: Dzmitry Sankouski +Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/max77705.c | 35 ++++++++++++++--------------------- + 1 file changed, 14 insertions(+), 21 deletions(-) + +diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c +index ff07d0e0d5f8e..e1a9bfd658560 100644 +--- a/drivers/mfd/max77705.c ++++ b/drivers/mfd/max77705.c +@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = { + .max_register = MAX77705_PMIC_REG_USBC_RESET, + }; + +-static const struct regmap_irq max77705_topsys_irqs[] = { +- { .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_TM_INT, }, ++static const struct regmap_irq max77705_irqs[] = { ++ { .mask = MAX77705_SRC_IRQ_CHG, }, ++ { .mask = MAX77705_SRC_IRQ_TOP, }, ++ { .mask = MAX77705_SRC_IRQ_FG, }, ++ { .mask = MAX77705_SRC_IRQ_USBC, }, + }; + +-static const struct regmap_irq_chip max77705_topsys_irq_chip = { +- .name = "max77705-topsys", +- .status_base = MAX77705_PMIC_REG_SYSTEM_INT, +- .mask_base = MAX77705_PMIC_REG_SYSTEM_INT_MASK, ++static const struct regmap_irq_chip max77705_irq_chip = { ++ .name = "max77705", ++ .status_base = MAX77705_PMIC_REG_INTSRC, ++ .ack_base = MAX77705_PMIC_REG_INTSRC, ++ .mask_base = MAX77705_PMIC_REG_INTSRC_MASK, + .num_regs = 1, +- .irqs = max77705_topsys_irqs, +- .num_irqs = ARRAY_SIZE(max77705_topsys_irqs), ++ .irqs = max77705_irqs, ++ .num_irqs = ARRAY_SIZE(max77705_irqs), + }; + + static int max77705_i2c_probe(struct i2c_client *i2c) +@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c) + + ret = devm_regmap_add_irq_chip(dev, max77705->regmap, + i2c->irq, +- IRQF_ONESHOT | IRQF_SHARED, 0, +- &max77705_topsys_irq_chip, ++ IRQF_ONESHOT, 0, ++ &max77705_irq_chip, + &irq_data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add IRQ chip\n"); + +- /* Unmask interrupts from all blocks in interrupt source register */ +- ret = regmap_update_bits(max77705->regmap, +- MAX77705_PMIC_REG_INTSRC_MASK, +- MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL); +- if (ret < 0) +- return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n"); +- + domain = regmap_irq_get_domain(irq_data); + + ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, +-- +2.51.0 + diff --git a/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..9481315ba0 --- /dev/null +++ b/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From afc32d8a473d55bc59462083e3120dd85613ea65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch b/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch new file mode 100644 index 0000000000..743519bfa7 --- /dev/null +++ b/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch @@ -0,0 +1,49 @@ +From a3abc0ffc4d5bd9ea896bb2950f90b265c899049 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 14:23:14 +0800 +Subject: mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal + +From: Kuan-Wei Chiu + +[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ] + +The comparison function cmp_loc_by_count() used for sorting stack trace +locations in debugfs currently returns -1 if a->count > b->count and 1 +otherwise. This breaks the antisymmetry property required by sort(), +because when two counts are equal, both cmp(a, b) and cmp(b, a) return +1. + +This can lead to undefined or incorrect ordering results. Fix it by +updating the comparison logic to explicitly handle the case when counts +are equal, and use cmp_int() to ensure the comparison function adheres +to the required mathematical properties of antisymmetry. + +Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces") +Reviewed-by: Joshua Hahn +Signed-off-by: Kuan-Wei Chiu +Reviewed-by: Harry Yoo +Signed-off-by: Vlastimil Babka +Signed-off-by: Sasha Levin +--- + mm/slub.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/mm/slub.c b/mm/slub.c +index 09b6404ac5752..a63053505a1ac 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -7738,10 +7738,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data) + struct location *loc1 = (struct location *)a; + struct location *loc2 = (struct location *)b; + +- if (loc1->count > loc2->count) +- return -1; +- else +- return 1; ++ return cmp_int(loc2->count, loc1->count); + } + + static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos) +-- +2.51.0 + diff --git a/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch b/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch new file mode 100644 index 0000000000..5e80072a90 --- /dev/null +++ b/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch @@ -0,0 +1,56 @@ +From 19e9d8361570ae84122aa9109d8698e18ab39a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:06:05 +0200 +Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() + +From: Bean Huo + +[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ] + +Rename the inner 'frm' variable to 'resp_frm' in the write path of +mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable. + +The function declares 'frm' at function scope pointing to the request +frame, but then redeclares another 'frm' variable inside the write +block pointing to the response frame. This shadowing makes the code +confusing and error-prone. + +Using 'resp_frm' for the response frame makes the distinction clear +and improves code readability. + +Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") +Reviewed-by: Avri Altman +Reviewed-by: Jens Wiklander +Signed-off-by: Bean Huo +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 9cc47bf94804b..dd6cffc0df729 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req, + return -ENOMEM; + + if (write) { +- struct rpmb_frame *frm = (struct rpmb_frame *)resp; ++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp; + + /* Send write request frame(s) */ + set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK, + 1 | MMC_CMD23_ARG_REL_WR, req, req_len); + + /* Send result request frame */ +- memset(frm, 0, sizeof(*frm)); +- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); ++ memset(resp_frm, 0, sizeof(*resp_frm)); ++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); + set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp, + resp_len); + +-- +2.51.0 + diff --git a/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch new file mode 100644 index 0000000000..b29f5beae6 --- /dev/null +++ b/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch @@ -0,0 +1,50 @@ +From 7e82c67f4de28a3890505a22170294dd85cc78fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 14:07:27 +0300 +Subject: mtd: rawnand: atmel: Fix error handling path in + atmel_nand_controller_add_nands + +From: Erick Karanja + +[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ] + +In case of a jump to the err label due to atmel_nand_create() or +atmel_nand_controller_add_nand() failure, the reference to nand_np +need to be released + +Use for_each_child_of_node_scoped() to fix the issue. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") + +Signed-off-by: Erick Karanja +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index db94d14a3807f..49e00458eebeb 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +-- +2.51.0 + diff --git a/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch new file mode 100644 index 0000000000..0d71f71d2f --- /dev/null +++ b/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch @@ -0,0 +1,54 @@ +From a9f3e0578a96b8723a7b578cfb47044760e926d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:22:43 +0000 +Subject: nbd: restrict sockets to TCP and UDP + +From: Eric Dumazet + +[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] + +Recently, syzbot started to abuse NBD with all kinds of sockets. + +Commit cf1b2326b734 ("nbd: verify socket is supported during setup") +made sure the socket supported a shutdown() method. + +Explicitely accept TCP and UNIX stream sockets. + +Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") +Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 +Signed-off-by: Eric Dumazet +Cc: Mike Christie +Cc: Richard W.M. Jones +Cc: Jens Axboe +Cc: Yu Kuai +Cc: linux-block@vger.kernel.org +Cc: nbd@other.debian.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 6463d0e8d0cef..87b0b78249da3 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +-- +2.51.0 + diff --git a/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..ae017bfced --- /dev/null +++ b/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From ba22f040951694b8d604feec1ea01e99af033148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index f828f38cd7682..7e22f1dc4a49f 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..eb831177d4 --- /dev/null +++ b/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From fd307c2e5c1c0a6a9e9710d05ac67a1f3ff12153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index a3c934c3de71d..3620a4deb0187 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch b/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch new file mode 100644 index 0000000000..71d4390197 --- /dev/null +++ b/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch @@ -0,0 +1,38 @@ +From 94a7201d0fe2b97490d45764f37fceb25c082c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:27:55 +0800 +Subject: net: enetc: Fix probing error message typo for the ENETCv4 PF driver + +From: Claudiu Manoil + +[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ] + +Blamed commit wrongly indicates VF error in case of PF probing error. + +Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") +Signed-off-by: Claudiu Manoil +Signed-off-by: Wei Fang +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c +index b3dc1afeefd1d..a5c1f1cef3b0c 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c +@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev, + err = enetc_get_driver_data(si); + if (err) + return dev_err_probe(dev, err, +- "Could not get VF driver data\n"); ++ "Could not get PF driver data\n"); + + err = enetc4_pf_struct_init(si); + if (err) +-- +2.51.0 + diff --git a/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch b/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch new file mode 100644 index 0000000000..eb19eed0ff --- /dev/null +++ b/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch @@ -0,0 +1,76 @@ +From 81924896f7cd7bcf041b60b6a4d7a9840945b765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:39:53 +0800 +Subject: net: enetc: initialize SW PIR and CIR based HW PIR and CIR values + +From: Wei Fang + +[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ] + +Software can only initialize the PIR and CIR of the command BD ring after +a FLR, and these two registers can only be set to 0. But the reset values +of these two registers are 0, so software does not need to update them. +If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or +other values by software will cause the command BD ring to work +abnormally. This is because of an internal context in the ring prefetch +logic that will retain the state from the first incarnation of the ring +and continue prefetching from the stale location when the ring is +reinitialized. The internal context can only be reset by the FLR. + +In addition, there is a logic error in the implementation, next_to_clean +indicates the software CIR and next_to_use indicates the software PIR. +But the current driver uses next_to_clean to set PIR and use next_to_use +to set CIR. This does not cause a problem in actual use, because the +current command BD ring is only initialized after FLR, and the initial +values of next_to_use and next_to_clean are both 0. + +Therefore, this patch removes the initialization of PIR and CIR. Instead, +next_to_use and next_to_clean are initialized by reading the values of +PIR and CIR. + +Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") +Signed-off-by: Wei Fang +Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c +index ba32c1bbd9e18..0c1d343253bfb 100644 +--- a/drivers/net/ethernet/freescale/enetc/ntmp.c ++++ b/drivers/net/ethernet/freescale/enetc/ntmp.c +@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, + cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base, + NTMP_BASE_ADDR_ALIGN); + +- cbdr->next_to_clean = 0; +- cbdr->next_to_use = 0; + spin_lock_init(&cbdr->ring_lock); + ++ cbdr->next_to_use = netc_read(cbdr->regs.pir); ++ cbdr->next_to_clean = netc_read(cbdr->regs.cir); ++ + /* Step 1: Configure the base address of the Control BD Ring */ + netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align)); + netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align)); + +- /* Step 2: Configure the producer index register */ +- netc_write(cbdr->regs.pir, cbdr->next_to_clean); +- +- /* Step 3: Configure the consumer index register */ +- netc_write(cbdr->regs.cir, cbdr->next_to_use); +- +- /* Step4: Configure the number of BDs of the Control BD Ring */ ++ /* Step 2: Configure the number of BDs of the Control BD Ring */ + netc_write(cbdr->regs.lenr, cbdr->bd_num); + +- /* Step 5: Enable the Control BD Ring */ ++ /* Step 3: Enable the Control BD Ring */ + netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN); + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch b/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch new file mode 100644 index 0000000000..9fdfd0e403 --- /dev/null +++ b/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch @@ -0,0 +1,49 @@ +From 6e72c9ce5fe15802cb2c9cef57e3565d88f44ab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:19:24 -0700 +Subject: net: ethtool: tsconfig: set command must provide a reply + +From: Vadim Fedorenko + +[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ] + +Timestamping configuration through ethtool has inconsistent behavior of +skipping the reply for set command if configuration was not changed. Fix +it be providing reply in any case. + +Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") +Signed-off-by: Vadim Fedorenko +Reviewed-by: Kory Maincent +Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/tsconfig.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c +index 2be356bdfe873..169b413b31fc5 100644 +--- a/net/ethtool/tsconfig.c ++++ b/net/ethtool/tsconfig.c +@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base, + return ret; + } + +- if (hwprov_mod || config_mod) { +- ret = tsconfig_send_reply(dev, info); +- if (ret && ret != -EOPNOTSUPP) { +- NL_SET_ERR_MSG(info->extack, +- "error while reading the new configuration set"); +- return ret; +- } ++ ret = tsconfig_send_reply(dev, info); ++ if (ret && ret != -EOPNOTSUPP) { ++ NL_SET_ERR_MSG(info->extack, ++ "error while reading the new configuration set"); ++ return ret; + } + + /* tsconfig has no notification */ +-- +2.51.0 + diff --git a/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch new file mode 100644 index 0000000000..f041a49981 --- /dev/null +++ b/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch @@ -0,0 +1,97 @@ +From e81e0d172153c9e2a83894c6dc0feb8356a57352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:09 +0300 +Subject: net/mlx5: fw reset, add reset timeout work + +From: Moshe Shemesh + +[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ] + +Add sync reset timeout to stop poll_sync_reset in case there was no +reset done or abort event within timeout. Otherwise poll sync reset will +just continue and in case of fw fatal error no health reporting will be +done. + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 22995131824a0..89e399606877b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -27,6 +27,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + u8 reset_method; + struct timer_list timer; +@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + static const struct devlink_param mlx5_fw_reset_devlink_params[] = { +@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +-- +2.51.0 + diff --git a/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch new file mode 100644 index 0000000000..5d6812cc86 --- /dev/null +++ b/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch @@ -0,0 +1,57 @@ +From e3c0e17db3a4054ee9765b414af53dbffbb2dda0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:08 +0300 +Subject: net/mlx5: pagealloc: Fix reclaim race during command interface + teardown + +From: Shay Drory + +[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ] + +The reclaim_pages_cmd() function sends a command to the firmware to +reclaim pages if the command interface is active. + +A race condition can occur if the command interface goes down (e.g., due +to a PCI error) while the mlx5_cmd_do() call is in flight. In this +case, mlx5_cmd_do() will return an error. The original code would +propagate this error immediately, bypassing the software-based page +reclamation logic that is supposed to run when the command interface is +down. + +Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark +that command interface is down. If this is the case, fall through to +the software reclamation path. If the command failed for any another +reason, or finished successfully, return as before. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 9bc9bd83c2324..cd68c4b2c0bf9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +-- +2.51.0 + diff --git a/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch new file mode 100644 index 0000000000..22633ad5e7 --- /dev/null +++ b/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch @@ -0,0 +1,53 @@ +From c2d19aee8efe09777c98f61e6d5cec539e6882ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:07 +0300 +Subject: net/mlx5: Stop polling for command response if interface goes down + +From: Moshe Shemesh + +[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ] + +Stop polling on firmware response to command in polling mode if the +command interface got down. This situation can occur, for example, if a +firmware fatal error is detected during polling. + +This change halts the polling process when the command interface goes +down, preventing unnecessary waits. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index e395ef5f356eb..722282cebce9a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +-- +2.51.0 + diff --git a/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..5ac9f769b4 --- /dev/null +++ b/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From a3f26c0d306cbb8107c8be6e52a69f1f60c4950d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98e..92add3daadbb1 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..e461be9317 --- /dev/null +++ b/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 2bc556139fe247ffe817f8eca2699ee5079b6ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 5251524b96afa..5e4453e9ef8e7 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -63,7 +63,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch b/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch new file mode 100644 index 0000000000..7a86b4ddec --- /dev/null +++ b/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch @@ -0,0 +1,49 @@ +From a20a1ac139f5502f12f0b5323e8ebe3f2bfa6026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 07:27:09 +0000 +Subject: netfilter: nf_conntrack: do not skip entries in + /proc/net/nf_conntrack + +From: Eric Dumazet + +[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ] + +ct_seq_show() has an opportunistic garbage collector : + +if (nf_ct_should_gc(ct)) { + nf_ct_kill(ct); + goto release; +} + +So if one nf_conn is killed there, next time ct_get_next() runs, +we skip the following item in the bucket, even if it should have +been displayed if gc did not take place. + +We can decrement st->skip_elems to tell ct_get_next() one of the items +was removed from the chain. + +Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack") +Signed-off-by: Eric Dumazet +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_standalone.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 6c4cff10357df..e271dd648a681 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -322,6 +322,9 @@ static int ct_seq_show(struct seq_file *s, void *v) + smp_acquire__after_ctrl_dep(); + + if (nf_ct_should_gc(ct)) { ++ struct ct_iter_state *st = s->private; ++ ++ st->skip_elems--; + nf_ct_kill(ct); + goto release; + } +-- +2.51.0 + diff --git a/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch b/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch new file mode 100644 index 0000000000..f5de61dedf --- /dev/null +++ b/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch @@ -0,0 +1,51 @@ +From 7014e6bc134b0b67575660f7a2511313f2ad657d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 14:40:43 +0200 +Subject: netfilter: nfnetlink: reset nlh pointer during batch replay + +From: Fernando Fernandez Mancera + +[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ] + +During a batch replay, the nlh pointer is not reset until the parsing of +the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle +ACK flags for batch messages") that is problematic as the condition to +add an ACK for batch begin will evaluate to true even if NLM_F_ACK +wasn't used for batch begin message. + +If there is an error during the command processing, netlink is sending +an ACK despite that. This misleads userspace tools which think that the +return code was 0. Reset the nlh pointer to the original one when a +replay is triggered. + +Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") +Signed-off-by: Fernando Fernandez Mancera +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index e598a2a252b0a..811d02b4c4f7c 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + const struct nfnetlink_subsystem *ss; + const struct nfnl_callback *nc; + struct netlink_ext_ack extack; ++ struct nlmsghdr *onlh = nlh; + LIST_HEAD(err_list); + u32 status; + int err; +@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + status = 0; + replay_abort: + skb = netlink_skb_clone(oskb, GFP_KERNEL); ++ nlh = onlh; + if (!skb) + return netlink_ack(oskb, nlh, -ENOMEM, NULL); + +-- +2.51.0 + diff --git a/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..620efc8647 --- /dev/null +++ b/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From 68cb2e1e884b771e49c0d4450737b0c15feceafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index fbca8d0efd858..37a46596268a0 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..cf3c7c585e --- /dev/null +++ b/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From 82222c2816dee2f673762b97d9f9d079defb1a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 8d492e3b21631..0366322de20f3 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9438,7 +9438,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch new file mode 100644 index 0000000000..55cbb8fd49 --- /dev/null +++ b/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch @@ -0,0 +1,56 @@ +From 87dd5f95877afd3c9145d0a37b595fe3b1eb19ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:07:32 +0800 +Subject: null_blk: Fix the description of the cache_size module argument + +From: Genjian Zhang + +[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ] + +When executing modinfo null_blk, there is an error in the description +of module parameter mbps, and the output information of cache_size is +incomplete.The output of modinfo before and after applying this patch +is as follows: + +Before: +[...] +parm: cache_size:ulong +[...] +parm: mbps:Cache size in MiB for memory-backed device. + Default: 0 (none) (uint) +[...] + +After: +[...] +parm: cache_size:Cache size in MiB for memory-backed device. + Default: 0 (none) (ulong) +[...] +parm: mbps:Limit maximum bandwidth (in MiB/s). + Default: 0 (no limit) (uint) +[...] + +Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") +Signed-off-by: Genjian Zhang +Reviewed-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index aa163ae9b2aa5..8b58986d538fa 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static bool g_fua = true; + module_param_named(fua, g_fua, bool, 0444); +-- +2.51.0 + diff --git a/queue-6.16/nvme-auth-update-bi_directional-flag.patch b/queue-6.16/nvme-auth-update-bi_directional-flag.patch new file mode 100644 index 0000000000..c57d2a5ff9 --- /dev/null +++ b/queue-6.16/nvme-auth-update-bi_directional-flag.patch @@ -0,0 +1,43 @@ +From 7f435c0ac926a6b550e276a3ef794984ef42c4f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 17:19:21 +0530 +Subject: nvme-auth: update bi_directional flag + +From: Martin George + +[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ] + +While setting chap->s2 to zero as part of secure channel +concatenation, the host missed out to disable the bi_directional +flag to indicate that controller authentication is not requested. +Fix the same. + +Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") +Signed-off-by: Martin George +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index f6ddbe5532890..1386e5f8682ef 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl, + } else { + memset(chap->c2, 0, chap->hash_len); + } +- if (ctrl->opts->concat) ++ if (ctrl->opts->concat) { + chap->s2 = 0; +- else ++ chap->bi_directional = false; ++ } else + chap->s2 = nvme_auth_get_seqnum(); + data->seqnum = cpu_to_le32(chap->s2); + if (chap->host_key_len) { +-- +2.51.0 + diff --git a/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch b/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch new file mode 100644 index 0000000000..998f81f96f --- /dev/null +++ b/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch @@ -0,0 +1,42 @@ +From 491a598605c08da6336def33aa12e5f460c66f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:05:09 +0530 +Subject: nvme-tcp: send only permitted commands for secure concat + +From: Martin George + +[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ] + +In addition to sending permitted commands such as connect/auth +over the initial unencrypted admin connection as part of secure +channel concatenation, the host also sends commands such as +Property Get and Identify on the same. This is a spec violation +leading to secure concat failures. Fix this by ensuring these +additional commands are avoided on this connection. + +Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") +Signed-off-by: Martin George +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 9233f088fac88..7ecd9866453fb 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new) + if (error) + goto out_cleanup_tagset; + ++ if (ctrl->opts->concat && !ctrl->tls_pskid) ++ return 0; ++ + error = nvme_enable_ctrl(ctrl); + if (error) + goto out_stop_queue; +-- +2.51.0 + diff --git a/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..b6db99d5fc --- /dev/null +++ b/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From 4ec17f98cc0ff435093f3a5c3c41fd1b72ca2e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 25598a46bf0d6..fb2cd1118eb83 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch b/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch new file mode 100644 index 0000000000..943f5793da --- /dev/null +++ b/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch @@ -0,0 +1,53 @@ +From f898a02aec6b8c550db6e7992e5954f63bf471f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:02 +0200 +Subject: nvmet-fcloop: call done callback even when remote port is gone + +From: Daniel Wagner + +[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ] + +When the target port is gone, it's not possible to access any of the +request resources. The function should just silently drop the response. +The comment is misleading in this regard. + +Though it's still necessary to call the driver via the ->done callback +so the driver is able to release all resources. + +Reported-by: Yi Zhang +Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/ +Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 257b497d515a8..5dffcc5becae8 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport, + if (!targetport) { + /* + * The target port is gone. The target doesn't expect any +- * response anymore and the ->done call is not valid +- * because the resources have been freed by +- * nvmet_fc_free_pending_reqs. ++ * response anymore and thus lsreq can't be accessed anymore. + * + * We end up here from delete association exchange: + * nvmet_fc_xmt_disconnect_assoc sends an async request. ++ * ++ * Return success because this is what LLDDs do; silently ++ * drop the response. + */ ++ lsrsp->done(lsrsp); + kmem_cache_free(lsreq_cache, tls_req); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..a7ca016bb5 --- /dev/null +++ b/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 774b9cc89b3062d44669270e29600d490a95a3b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 77edcd70f72c2..c5236b3ed168f 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch b/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch new file mode 100644 index 0000000000..b8804b20d3 --- /dev/null +++ b/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch @@ -0,0 +1,43 @@ +From 5da60b047e39008ebf0ce039a8cf853723443377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 14:12:36 +0800 +Subject: octeontx2-pf: fix bitmap leak + +From: Bo Sun + +[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ] + +The bitmap allocated with bitmap_zalloc() in otx2_probe() was not +released in otx2_remove(). Unbinding and rebinding the driver therefore +triggers a kmemleak warning: + + unreferenced object (size 8): + backtrace: + bitmap_zalloc + otx2_probe + +Call bitmap_free() in the remove path to fix the leak. + +Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") +Signed-off-by: Bo Sun +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index c6d2f2249cc35..12fe71dc20a79 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -3468,6 +3468,7 @@ static void otx2_remove(struct pci_dev *pdev) + otx2_disable_mbox_intr(pf); + otx2_pfaf_mbox_destroy(pf); + pci_free_irq_vectors(pf->pdev); ++ bitmap_free(pf->af_xdp_zc_qidx); + pci_set_drvdata(pdev, NULL); + free_netdev(netdev); + } +-- +2.51.0 + diff --git a/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch b/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch new file mode 100644 index 0000000000..f268fce42d --- /dev/null +++ b/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch @@ -0,0 +1,43 @@ +From d183342228bf64af767b3c150057d4c7a482c21b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 14:12:35 +0800 +Subject: octeontx2-vf: fix bitmap leak + +From: Bo Sun + +[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ] + +The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not +released in otx2vf_remove(). Unbinding and rebinding the driver therefore +triggers a kmemleak warning: + + unreferenced object (size 8): + backtrace: + bitmap_zalloc + otx2vf_probe + +Call bitmap_free() in the remove path to fix the leak. + +Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") +Signed-off-by: Bo Sun +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 76dd2e965cf03..e9018775ffadd 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -822,6 +822,7 @@ static void otx2vf_remove(struct pci_dev *pdev) + qmem_free(vf->dev, vf->dync_lmt); + otx2vf_vfaf_mbox_destroy(vf); + pci_free_irq_vectors(vf->pdev); ++ bitmap_free(vf->af_xdp_zc_qidx); + pci_set_drvdata(pdev, NULL); + free_netdev(netdev); + } +-- +2.51.0 + diff --git a/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch b/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch new file mode 100644 index 0000000000..31e7cef488 --- /dev/null +++ b/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch @@ -0,0 +1,91 @@ +From 9204e93c5cc63562381033f419192d96883f4722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 19:29:10 +0800 +Subject: once: fix race by moving DO_ONCE to separate section + +From: Qi Xi + +[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ] + +The commit c2c60ea37e5b ("once: use __section(".data.once")") moved +DO_ONCE's ___done variable to .data.once section, which conflicts with +DO_ONCE_LITE() that also uses the same section. + +This creates a race condition when clear_warn_once is used: + +Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) +__do_once_start + read ___done (false) + acquire once_lock +execute func +__do_once_done + write ___done (true) __do_once_start + release once_lock // Thread 3 clear_warn_once reset ___done + read ___done (false) + acquire once_lock + execute func +schedule once_work __do_once_done +once_deferred: OK write ___done (true) +static_branch_disable release once_lock + schedule once_work + once_deferred: + BUG_ON(!static_key_enabled) + +DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning +macros. Keep its ___done flag in the .data..once section and allow resetting +by clear_warn_once, as originally intended. + +In contrast, DO_ONCE() is used for functions like get_random_once() and +relies on its ___done flag for internal synchronization. We should not reset +DO_ONCE() by clear_warn_once. + +Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, +shielding it from clear_warn_once. + +Fixes: c2c60ea37e5b ("once: use __section(".data.once")") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 1 + + include/linux/once.h | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index fa5f19b8d53a0..083d091bd7263 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG) + __start_once = .; \ + *(.data..once) \ + __end_once = .; \ ++ *(.data..do_once) \ + STRUCT_ALIGN(); \ + *(__tracepoints) \ + /* implement dynamic printk debug */ \ +diff --git a/include/linux/once.h b/include/linux/once.h +index 30346fcdc7995..449a0e34ad5ad 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + unsigned long ___flags; \ +@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE_SLEEPABLE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_sleepable_start(&___done); \ +-- +2.51.0 + diff --git a/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch b/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch new file mode 100644 index 0000000000..e7408b89e6 --- /dev/null +++ b/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch @@ -0,0 +1,52 @@ +From bafdfcd3d5e9c812044913d961e34bebca872951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 14:46:42 -0700 +Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak + +From: Nirmoy Das + +[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ] + +pci_acpi_preserve_config() leaks memory by returning early without freeing +the ACPI object on success. Fix that by always freeing the obj, which is +not needed by the caller. + +Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()") +Signed-off-by: Nirmoy Das +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index 99c58ee09fbb0..0cd8a75e22580 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle) + + bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + { ++ bool ret = false; ++ + if (ACPI_HANDLE(&host_bridge->dev)) { + union acpi_object *obj; + +@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + 1, DSM_PCI_PRESERVE_BOOT_CONFIG, + NULL, ACPI_TYPE_INTEGER); + if (obj && obj->integer.value == 0) +- return true; ++ ret = true; + ACPI_FREE(obj); + } + +- return false; ++ return ret; + } + + /* _HPX PCI Setting Record (Type 0); same as _HPP */ +-- +2.51.0 + diff --git a/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch b/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch new file mode 100644 index 0000000000..6890451071 --- /dev/null +++ b/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch @@ -0,0 +1,42 @@ +From 66954a40719ea005e8ff62a5ada6bc1b0e74da83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 14:14:34 -0700 +Subject: PCI: j721e: Fix incorrect error message in probe() + +From: Alok Tiwari + +[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ] + +The probe() function prints "pm_runtime_get_sync failed" when +j721e_pcie_ctrl_init() returns an error. This is misleading since +the failure is not from pm_runtime, but from the controller init +routine. Update the error message to correctly reflect the source. + +No functional changes. + +Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") +Signed-off-by: Alok Tiwari +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Siddharth Vadapalli +Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 6c93f39d02888..5e445a7bda332 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + ret = j721e_pcie_ctrl_init(pcie); + if (ret < 0) { +- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n"); ++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n"); + goto err_get_sync; + } + +-- +2.51.0 + diff --git a/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch b/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch new file mode 100644 index 0000000000..edeb106a23 --- /dev/null +++ b/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch @@ -0,0 +1,66 @@ +From 5840b068521700885f229d8af75d563e2a318508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 17:56:25 +0200 +Subject: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure + +From: Geert Uytterhoeven + +[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ] + +When devm_add_action_or_reset() fails, it calls the passed cleanup +function. Hence the caller must not repeat that cleanup. + +Replace the "goto err_regulator_free" by the actual freeing, as there +will never be a need again for a second user of this label. + +Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Vasut # V4H Sparrow Hawk +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Marek Vasut +Acked-by: Bartosz Golaszewski +Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pci/pwrctrl/slot.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c +index 18becc144913e..26b21746da50b 100644 +--- a/drivers/pci/pwrctrl/slot.c ++++ b/drivers/pci/pwrctrl/slot.c +@@ -47,13 +47,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev) + ret = regulator_bulk_enable(slot->num_supplies, slot->supplies); + if (ret < 0) { + dev_err_probe(dev, ret, "Failed to enable slot regulators\n"); +- goto err_regulator_free; ++ regulator_bulk_free(slot->num_supplies, slot->supplies); ++ return ret; + } + + ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off, + slot); + if (ret) +- goto err_regulator_disable; ++ return ret; + + pci_pwrctrl_init(&slot->ctx, dev); + +@@ -62,13 +63,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev) + return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n"); + + return 0; +- +-err_regulator_disable: +- regulator_bulk_disable(slot->num_supplies, slot->supplies); +-err_regulator_free: +- regulator_bulk_free(slot->num_supplies, slot->supplies); +- +- return ret; + } + + static const struct of_device_id pci_pwrctrl_slot_of_match[] = { +-- +2.51.0 + diff --git a/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch b/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch new file mode 100644 index 0000000000..daf5810060 --- /dev/null +++ b/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch @@ -0,0 +1,183 @@ +From 9513a4c36480ef71b13470906639717eb4f7b73f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 14:52:23 +0800 +Subject: PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s + +From: Ziyue Zhang + +[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ] + +Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link +stability and avoid AER Correctable Errors reported on some platforms +(eg. SA8775P). + +8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting. +This setting is programmed into a group of shadow registers, which can be +switched to configure equalization for different speeds by writing 00b, +01b and 10b to `RATE_SHADOW_SEL`. + +Hence, program equalization registers in a loop using link speed as index, +so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s +and 32.0 GT/s. + +Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes") +Co-developed-by: Qiang Yu +Signed-off-by: Qiang Yu +Signed-off-by: Ziyue Zhang +[mani: wrapped the warning to fit 100 columns, used post-increment for loop] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware.h | 1 - + drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++-------- + drivers/pci/controller/dwc/pcie-qcom-common.h | 2 +- + drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +- + drivers/pci/controller/dwc/pcie-qcom.c | 6 +- + 5 files changed, 41 insertions(+), 32 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h +index ce9e18554e426..388306991467a 100644 +--- a/drivers/pci/controller/dwc/pcie-designware.h ++++ b/drivers/pci/controller/dwc/pcie-designware.h +@@ -127,7 +127,6 @@ + #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE BIT(16) + #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT 24 + #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK GENMASK(25, 24) +-#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT 0x1 + + #define GEN3_EQ_CONTROL_OFF 0x8A8 + #define GEN3_EQ_CONTROL_OFF_FB_MODE GENMASK(3, 0) +diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c +index 3aad19b56da8f..0c6f4514f922f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-common.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-common.c +@@ -8,9 +8,11 @@ + #include "pcie-designware.h" + #include "pcie-qcom-common.h" + +-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci) ++void qcom_pcie_common_set_equalization(struct dw_pcie *pci) + { ++ struct device *dev = pci->dev; + u32 reg; ++ u16 speed; + + /* + * GEN3_RELATED_OFF register is repurposed to apply equalization +@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci) + * determines the data rate for which these equalization settings are + * applied. + */ +- reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF); +- reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL; +- reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK; +- reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK, +- GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT); +- dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg); + +- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF); +- reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 | +- GEN3_EQ_FMDC_N_EVALS | +- GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA | +- GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA); +- reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) | +- FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) | +- FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) | +- FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5); +- dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg); ++ for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) { ++ if (speed > PCIE_SPEED_32_0GT) { ++ dev_warn(dev, "Skipped equalization settings for unsupported data rate\n"); ++ break; ++ } + +- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF); +- reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE | +- GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE | +- GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL | +- GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC); +- dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg); ++ reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF); ++ reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL; ++ reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK; ++ reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK, ++ speed - PCIE_SPEED_8_0GT); ++ dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg); ++ ++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF); ++ reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 | ++ GEN3_EQ_FMDC_N_EVALS | ++ GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA | ++ GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA); ++ reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) | ++ FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) | ++ FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) | ++ FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5); ++ dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg); ++ ++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF); ++ reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE | ++ GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE | ++ GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL | ++ GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC); ++ dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg); ++ } + } +-EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization); ++EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization); + + void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci) + { +diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h +index 7d88d29e47661..7f5ca2fd9a72f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-common.h ++++ b/drivers/pci/controller/dwc/pcie-qcom-common.h +@@ -8,7 +8,7 @@ + + struct dw_pcie; + +-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci); ++void qcom_pcie_common_set_equalization(struct dw_pcie *pci); + void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci); + + #endif +diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c +index bf7c6ac0f3e39..aaf060bf39d40 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c +@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci) + goto err_disable_resources; + } + +- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) { +- qcom_pcie_common_set_16gt_equalization(pci); ++ qcom_pcie_common_set_equalization(pci); ++ ++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) + qcom_pcie_common_set_16gt_lane_margining(pci); +- } + + /* + * The physical address of the MMIO region which is exposed as the BAR +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 9b12f2f020422..e5e686705e485 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -298,10 +298,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci) + { + struct qcom_pcie *pcie = to_qcom_pcie(pci); + +- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) { +- qcom_pcie_common_set_16gt_equalization(pci); ++ qcom_pcie_common_set_equalization(pci); ++ ++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) + qcom_pcie_common_set_16gt_lane_margining(pci); +- } + + /* Enable Link Training state machine */ + if (pcie->cfg->ops->ltssm_enable) +-- +2.51.0 + diff --git a/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch b/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch new file mode 100644 index 0000000000..a9c6720e83 --- /dev/null +++ b/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch @@ -0,0 +1,65 @@ +From ba636f596a61b2a62f9bdb252d1e2f5a94e2ce3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:45:58 +0200 +Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585 +Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC +domain, after reset has been asserted by writing a matching reset bit into +register SRCR, it is mandatory to wait 1ms. + +Because it is the controller driver which can determine whether or not the +controller is in HSC domain based on its compatible string, add the missing +delay in the controller driver. + +This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear +whether S4 is affected as well. This patch does apply the extra delay on +R-Car S4 as well. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Suggested-by: Geert Uytterhoeven +Signed-off-by: Marek Vasut +[mani: added the missing r-b tag from Krzysztof] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Krzysztof Wilczyński +Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 18055807a4f5f..d9a42fa51520a 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + return ret; + } + +- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) ++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) { + reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ /* ++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. ++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B) ++ * indicates that for peripherals in HSC domain, after ++ * reset has been asserted by writing a matching reset bit ++ * into register SRCR, it is mandatory to wait 1ms. ++ */ ++ fsleep(1000); ++ } + + val = readl(rcar->base + PCIEMSR0); + if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) { +-- +2.51.0 + diff --git a/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch b/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch new file mode 100644 index 0000000000..7795f6a103 --- /dev/null +++ b/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch @@ -0,0 +1,56 @@ +From f4a4e26cf3ce57afbc3fed97355e6b9ad0947d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 02:55:45 +0200 +Subject: PCI: rcar-gen4: Assure reset occurs before DBI access + +From: Marek Vasut + +[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ] + +Assure the reset is latched and the core is ready for DBI access. On R-Car +V4H, the PCIe reset is asynchronous and does not take effect immediately, +but needs a short time to complete. In case DBI access happens in that +short time, that access generates an SError. Make sure that condition can +never happen, read back the state of the reset, which should turn the +asynchronous reset into a synchronous one, and wait a little over 1ms to +add additional safety margin. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index d9a42fa51520a..9ac3f0f11adad 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + if (ret) + goto err_unprepare; + ++ /* ++ * Assure the reset is latched and the core is ready for DBI access. ++ * On R-Car V4H, the PCIe reset is asynchronous and does not take ++ * effect immediately, but needs a short time to complete. In case ++ * DBI access happens in that short time, that access generates an ++ * SError. To make sure that condition can never happen, read back the ++ * state of the reset, which should turn the asynchronous reset into ++ * synchronous one, and wait a little over 1ms to add additional ++ * safety margin. ++ */ ++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ fsleep(1000); ++ + if (rcar->drvdata->additional_common_init) + rcar->drvdata->additional_common_init(rcar); + +-- +2.51.0 + diff --git a/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch b/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch new file mode 100644 index 0000000000..b8d2389c33 --- /dev/null +++ b/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch @@ -0,0 +1,54 @@ +From e8bf04acc9dda3e15ee2605f6572987e20370228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 01:58:40 +0200 +Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization + +From: Marek Vasut + +[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 +Figure 104.3b Initial Setting of PCIEC(example), third quarter of the +figure indicates that register 0xf8 should be polled until bit 18 becomes +set to 1. + +Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is +set to 1 in less than 1 ms afterward. The current readl_poll_timeout() +break condition is inverted and returns when register 0xf8, bit 18 is set +to 0, which in most cases means immediately. In case +CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first +readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and +afterward never read register 0xf8, bit 18 as 0, which leads to timeout +and failure to start the PCIe controller. + +Fix this by inverting the poll condition to match the reference manual +initialization sequence. + +Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 9ac3f0f11adad..c16c4c2be4993 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable + val &= ~APP_HOLD_PHY_RST; + writel(val, rcar->base + PCIERSTCTRL1); + +- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000); ++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000); + if (ret < 0) + return ret; + +-- +2.51.0 + diff --git a/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..7e7d7e0601 --- /dev/null +++ b/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 1a749bda74d696311944b61e569fa0451d8a956f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 467ddc701adce..bb88767a37979 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch new file mode 100644 index 0000000000..249636170e --- /dev/null +++ b/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch @@ -0,0 +1,53 @@ +From c5160d5c782d7979a7388ca0541fc67e0f1d1f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 11:30:22 +0200 +Subject: PCI: tegra194: Fix duplicate PLL disable in + pex_ep_event_pex_rst_assert() + +From: Nagarjuna Kristam + +[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ] + +During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently +called twice. + +pex_ep_event_pex_rst_assert() should do the opposite of +pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate +tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate +tegra_pcie_bpmp_set_pll_state() call should instead be a call to +tegra_pcie_bpmp_set_ctrl_state(). + +With this, the uninitialization sequence also matches that of +tegra_pcie_unconfig_controller(). + +Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") +Signed-off-by: Nagarjuna Kristam +[cassel: improve commit log] +Signed-off-by: Niklas Cassel +Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 4f26086f25daf..0c0734aa14b68 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +-- +2.51.0 + diff --git a/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..5884ff5f31 --- /dev/null +++ b/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 5b1423b1bc20ea91b0cee4564332d2759bcf2505 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 3efed8839a4ec..ef9b3955ac662 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -97,7 +97,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch b/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch new file mode 100644 index 0000000000..5d504e0baa --- /dev/null +++ b/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch @@ -0,0 +1,92 @@ +From 918ec43e00dcdc9a84ad1533d900bea0bc65b22c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:30:27 +0800 +Subject: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error + +From: Dapeng Mi + +[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ] + +When running perf_fuzzer on PTL, sometimes the below "unchecked MSR + access error" is seen when accessing IA32_PMC_x_CFG_B MSRs. + +[ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30) +[ 55.611280] Call Trace: +[ 55.611282] +[ 55.611284] ? intel_pmu_config_acr+0x87/0x160 +[ 55.611289] intel_pmu_enable_acr+0x6d/0x80 +[ 55.611291] intel_pmu_enable_event+0xce/0x460 +[ 55.611293] x86_pmu_start+0x78/0xb0 +[ 55.611297] x86_pmu_enable+0x218/0x3a0 +[ 55.611300] ? x86_pmu_enable+0x121/0x3a0 +[ 55.611302] perf_pmu_enable+0x40/0x50 +[ 55.611307] ctx_resched+0x19d/0x220 +[ 55.611309] __perf_install_in_context+0x284/0x2f0 +[ 55.611311] ? __pfx_remote_function+0x10/0x10 +[ 55.611314] remote_function+0x52/0x70 +[ 55.611317] ? __pfx_remote_function+0x10/0x10 +[ 55.611319] generic_exec_single+0x84/0x150 +[ 55.611323] smp_call_function_single+0xc5/0x1a0 +[ 55.611326] ? __pfx_remote_function+0x10/0x10 +[ 55.611329] perf_install_in_context+0xd1/0x1e0 +[ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10 +[ 55.611333] __do_sys_perf_event_open+0xa76/0x1040 +[ 55.611336] __x64_sys_perf_event_open+0x26/0x30 +[ 55.611337] x64_sys_call+0x1d8e/0x20c0 +[ 55.611339] do_syscall_64+0x4f/0x120 +[ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +On PTL, GP counter 0 and 1 doesn't support auto counter reload feature, +thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR +which requires to enable auto counter reload on GP counter 0. + +The root cause of causing this issue is the check for auto counter +reload (ACR) counter mask from user space is incorrect in +intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter +mask from user space could be set into hw.config1 and then written into +CFG_B MSRs and trigger the MSR access warning. + +e.g., User may create a perf event with ACR counter mask (config2=0xcb), +and there is only 1 event created, so "cpuc->n_events" is 1. + +The correct check condition should be "i + idx >= cpuc->n_events" +instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise, +the counter mask would traverse twice and an invalid "cpuc->assign[1]" +bit (bit 0) is set into hw.config1 and cause MSR accessing error. + +Besides, also check if the ACR counter mask corresponding events are +ACR events. If not, filter out these counter mask. If a event is not a +ACR event, it could be scheduled to an HW counter which doesn't support +ACR. It's invalid to add their counter index in ACR counter mask. + +Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as +user could set any invalid ACR counter mask and the warning message +could mislead users. + +Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") +Signed-off-by: Dapeng Mi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index c2fb729c270ec..15da60cf69f20 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc) + if (event->group_leader != leader->group_leader) + break; + for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) { +- if (WARN_ON_ONCE(i + idx > cpuc->n_events)) ++ if (i + idx >= cpuc->n_events || ++ !is_acr_event_group(cpuc->event_list[i + idx])) + return; + __set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1); + } +-- +2.51.0 + diff --git a/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch b/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch new file mode 100644 index 0000000000..987a284334 --- /dev/null +++ b/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch @@ -0,0 +1,48 @@ +From d2187771c7ef3eaa6df4427f371d8cad4dec57a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:30:26 +0800 +Subject: perf/x86/intel: Use early_initcall() to hook bts_init() + +From: Dapeng Mi + +[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ] + +After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS + initialization from PEBS initialization")' is introduced, x86_pmu.bts +would initialized in bts_init() which is hooked by arch_initcall(). + +Whereas init_hw_perf_events() is hooked by early_initcall(). Once the +core PMU is initialized, nmi watchdog initialization is called +immediately before bts_init() is called. It leads to the BTS buffer is +not really initialized since bts_init() is not called and x86_pmu.bts is +still false at that time. Worse, BTS buffer would never be initialized +then unless all core PMU events are freed and reserve_ds_buffers() +is called again. + +Thus aligning with init_hw_perf_events(), use early_initcall() to hook +bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog +initialization. + +Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization") +Signed-off-by: Dapeng Mi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/bts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c +index 61da6b8a3d519..cbac54cb3a9ec 100644 +--- a/arch/x86/events/intel/bts.c ++++ b/arch/x86/events/intel/bts.c +@@ -643,4 +643,4 @@ static __init int bts_init(void) + + return perf_pmu_register(&bts_pmu, "intel_bts", -1); + } +-arch_initcall(bts_init); ++early_initcall(bts_init); +-- +2.51.0 + diff --git a/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch b/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch new file mode 100644 index 0000000000..472e5209a2 --- /dev/null +++ b/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch @@ -0,0 +1,69 @@ +From ff3fbe786ddd9325e829e0cf29bfef9adeb5200e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 07:23:22 +0000 +Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 + +From: Jonas Karlman + +[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ] + +The boot firmware may disable the U3 port early during boot and leave it +up to the controller or PHY driver to re-enable U3 when needed. + +The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, +something the Rockchip Naneng Combo PHY driver never does for RK3568. +This may result in USB 3.0 ports being limited to only using USB 2.0 or +in special cases not working at all on RK3568. + +Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled +when a PHY with PHY_TYPE_USB3 mode is used. + +Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index ce91fb1d51671..17c6310f4b54b 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg { + struct combphy_reg pipe_xpcs_phy_ready; + struct combphy_reg pipe_pcie1l0_sel; + struct combphy_reg pipe_pcie1l1_sel; ++ struct combphy_reg u3otg0_port_en; ++ struct combphy_reg u3otg1_port_en; + }; + + struct rockchip_combphy_cfg { +@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); ++ switch (priv->id) { ++ case 0: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); ++ break; ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); ++ break; ++ } + break; + + case PHY_TYPE_SATA: +@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + /* pipe-grf */ + .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, + .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, ++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, ++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { +-- +2.51.0 + diff --git a/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch b/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch new file mode 100644 index 0000000000..20abac3e96 --- /dev/null +++ b/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch @@ -0,0 +1,53 @@ +From acab3b4a0c47761b8bc246a2c38268e0d856cbc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 21:26:05 +0200 +Subject: pid: use ns_capable_noaudit() when determining net sysctl permissions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Göttsche + +[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ] + +The capability check should not be audited since it is only being used +to determine the inode permissions. A failed check does not indicate a +violation of security policy but, when an LSM is enabled, a denial audit +message was being generated. + +The denial audit message can either lead to the capability being +unnecessarily allowed in a security policy, or being silenced potentially +masking a legitimate capability check at a later point in time. + +Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when +determining net sysctl permissions") + +Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace") +CC: Christian Brauner +CC: linux-security-module@vger.kernel.org +CC: selinux@vger.kernel.org +Signed-off-by: Christian Göttsche +Acked-by: Serge Hallyn +Reviewed-by: Paul Moore +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + kernel/pid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/pid.c b/kernel/pid.c +index 8317bcbc7cf7d..24f839d9c3031 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head, + container_of(head->set, struct pid_namespace, set); + int mode = table->mode; + +- if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) || ++ if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) || + uid_eq(current_euid(), make_kuid(pidns->user_ns, 0))) + mode = (mode & S_IRWXU) >> 6; + else if (in_egroup_p(make_kgid(pidns->user_ns, 0))) +-- +2.51.0 + diff --git a/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..495b0f9ba7 --- /dev/null +++ b/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From 4f469996b4e4a41f36206e533ba187d5a3e073a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 9171de657f978..a75762e4d2641 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch b/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch new file mode 100644 index 0000000000..ec89e6190f --- /dev/null +++ b/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch @@ -0,0 +1,49 @@ +From 3924b273c44e295f6d9ac0523a78a3e163b891cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 17:08:13 +0100 +Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in + rzg3s_oen_read() + +From: Lad Prabhakar + +[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ] + +rzg3s_oen_read() returns a u32 value, but previously propagated a negative +error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large +positive value due to unsigned conversion. This caused incorrect +output-enable reporting for certain pins. + +Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported +as "output enabled" in the pinconf-pins debugfs file. With this fix, only +P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the +hardware manual. + +Fix this by returning 0 when the OEN bit lookup fails, treating the pin +as output-disabled by default. + +Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index 78fa08ff0faa8..47b983ca44712 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -1119,7 +1119,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin) + + bit = rzg3s_pin_to_oen_bit(pctrl, _pin); + if (bit < 0) +- return bit; ++ return 0; + + return !(readb(pctrl->base + ETH_MODE) & BIT(bit)); + } +-- +2.51.0 + diff --git a/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..70fc1c30d6 --- /dev/null +++ b/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From ede27b0f3c361673324af90fe0a8bcd283d802bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 29d16c9c1bd19..3a742f74ecd1d 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch new file mode 100644 index 0000000000..4ffe760b77 --- /dev/null +++ b/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch @@ -0,0 +1,40 @@ +From 27b0ea1bc5b2c6a322d21a7b2e993096c21846bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:58:23 +0300 +Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in + probe() + +From: Dan Carpenter + +[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ] + +The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which +would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check +that the pointer is valid. + +Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") +Signed-off-by: Dan Carpenter +Signed-off-by: Chanwoo Choi +Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/mtk-cci-devfreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index 22fe9e631f8aa..5730076846e1b 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +-- +2.51.0 + diff --git a/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch b/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch new file mode 100644 index 0000000000..6db838b897 --- /dev/null +++ b/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch @@ -0,0 +1,88 @@ +From c1d8afde7a597e39b8dbe87bbc69ded64995226a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 May 2025 15:38:08 +0200 +Subject: PM / devfreq: rockchip-dfi: double count on RK3588 + +From: Nicolas Frattaroli + +[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ] + +On RK3588 with LPDDR4X memory, the cycle count as returned by + + perf stat -a -e rockchip_ddr/cycles/ sleep 1 + +consistently reads half as much as what the actual DDR frequency is at. +For a LPDDR4X module running at 2112MHz, I get more like 1056059916 +cycles per second, which is almost bang-on half what it should be. No, +I'm not mixing up megatransfers and megahertz. + +Consulting the downstream driver, this appears to be because the RK3588 +hardware specifically (and RK3528 as well, for future reference) needs a +multiplier of 2 to get to the correct frequency with everything but +LPDDR5. + +The RK3588's actual memory bandwidth measurements in MB/s are correct +however, as confirmed with stress-ng --stream. This makes me think the +access counters are not affected in the same way. This tracks with the +vendor kernel not multiplying the access counts either. + +Solve this by adding a new member to the dfi struct, which each SoC can +set to whatever they want, but defaults to 1 if left unset by the SoC +init functions. The event_get_count op can then use this multiplier if +the cycle count is requested. + +The cycle multiplier is not used in rockchip_dfi_get_event because the +vendor driver doesn't use it there either, and we don't do other actual +bandwidth unit conversion stuff in there anyway. + +Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588") +Signed-off-by: Nicolas Frattaroli +Signed-off-by: Chanwoo Choi +Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/event/rockchip-dfi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c +index 0470d7c175f4f..54effb6351965 100644 +--- a/drivers/devfreq/event/rockchip-dfi.c ++++ b/drivers/devfreq/event/rockchip-dfi.c +@@ -116,6 +116,7 @@ struct rockchip_dfi { + int buswidth[DMC_MAX_CHANNELS]; + int ddrmon_stride; + bool ddrmon_ctrl_single; ++ unsigned int count_multiplier; /* number of data clocks per count */ + }; + + static int rockchip_dfi_enable(struct rockchip_dfi *dfi) +@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event) + + switch (event->attr.config) { + case PERF_EVENT_CYCLES: +- count = total.c[0].clock_cycles; ++ count = total.c[0].clock_cycles * dfi->count_multiplier; + break; + case PERF_EVENT_READ_BYTES: + for (i = 0; i < dfi->max_channels; i++) +@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi) + break; + } + ++ if (!dfi->count_multiplier) ++ dfi->count_multiplier = 1; ++ + ret = perf_pmu_register(pmu, "rockchip_ddr", -1); + if (ret) + return ret; +@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi) + dfi->max_channels = 4; + + dfi->ddrmon_stride = 0x4000; ++ dfi->count_multiplier = 2; + + return 0; + }; +-- +2.51.0 + diff --git a/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..434c7810a5 --- /dev/null +++ b/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From c62f16114008861fa125c57e35990d42714b2d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 7a50af416cac8..9f25ae5b2dc62 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -690,8 +690,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch new file mode 100644 index 0000000000..9339ff5dea --- /dev/null +++ b/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch @@ -0,0 +1,37 @@ +From 54dc97eef66a0c1bdcd11b662bff68513319d641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 20:32:59 +0800 +Subject: power: supply: cw2015: Fix a alignment coding style issue + +From: Andy Yan + +[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ] + +Fix the checkpatch warning: +CHECK: Alignment should match open parenthesis + +Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") +Signed-off-by: Andy Yan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index f63c3c4104515..382dff8805c62 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +-- +2.51.0 + diff --git a/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch b/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch new file mode 100644 index 0000000000..ed52f6285b --- /dev/null +++ b/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch @@ -0,0 +1,64 @@ +From 47ef6e2bc554cfcb026d468b600dcdeeb5f80bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 08:30:18 +0200 +Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs + +From: Christophe Leroy + +[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ] + +Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all +PGDIRs and preallocate execmem page tables") was supposed to extend +to powerpc 603 the copy of kernel PGD entries into all PGDIRs +implemented in a previous patch on the 8xx. But 603 is book3s/32 and +uses a duplicate of pgd_alloc() defined in another header. + +So really do the copy at the correct place for the 603. + +Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++-- + arch/powerpc/include/asm/nohash/pgalloc.h | 2 +- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h +index dd4eb30631758..f4390704d5ba2 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h +@@ -7,8 +7,14 @@ + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { +- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ ++#ifdef CONFIG_PPC_BOOK3S_603 ++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, ++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); ++#endif ++ return pgd; + } + + static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) +diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h +index bb5f3e8ea912d..4ef780b291bc3 100644 +--- a/arch/powerpc/include/asm/nohash/pgalloc.h ++++ b/arch/powerpc/include/asm/nohash/pgalloc.h +@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm) + pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), + pgtable_gfp_flags(mm, GFP_KERNEL)); + +-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603) ++#ifdef CONFIG_PPC_8xx + memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, + (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); + #endif +-- +2.51.0 + diff --git a/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch b/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch new file mode 100644 index 0000000000..2c00e1a026 --- /dev/null +++ b/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch @@ -0,0 +1,71 @@ +From 52dc3e52139882c0f2430f5b3e6569ecf24bbe43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 18:33:26 +0200 +Subject: powerpc/8xx: Remove left-over instruction and comments in + DataStoreTLBMiss handler + +From: Christophe Leroy + +[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ] + +Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in +DTLB misses") removed the test that needed the valeur in SPRN_EPN but +failed to remove the read. + +Remove it. + +And remove related comments, including the very same comment +in InstructionTLBMiss that should have been removed by +commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in +ITLB misses"). + +Also update the comment about absence of a second level table which +has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx: +remove tests on PGDIR entry validity"). + +Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 56c5ebe21b99a..613606400ee99 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -162,7 +162,7 @@ instruction_counter: + * For the MPC8xx, this is a software tablewalk to load the instruction + * TLB. The task switch loads the M_TWB register with the pointer to the first + * level table. +- * If we discover there is no second level table (value is zero) or if there ++ * If there is no second level table (value is zero) or if there + * is an invalid pte, we load that into the TLB, which causes another fault + * into the TLB Error interrupt where we can handle such problems. + * We have to use the MD_xxx registers for the tablewalk because the +@@ -183,9 +183,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ + mfspr r10, SPRN_SRR0 /* Get effective address of fault */ + INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11) + mtspr SPRN_MD_EPN, r10 +@@ -228,10 +225,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ +- mfspr r10, SPRN_MD_EPN + mfspr r10, SPRN_M_TWB /* Get level 1 table */ + lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */ + +-- +2.51.0 + diff --git a/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch b/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch new file mode 100644 index 0000000000..636fc1c750 --- /dev/null +++ b/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch @@ -0,0 +1,60 @@ +From 82090854441c653641c40c031790f7da6c7fb598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 10:27:38 -0400 +Subject: powerpc/ftrace: ensure ftrace record ops are always set for NOPs + +From: Joe Lawrence + +[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ] + +When an ftrace call site is converted to a NOP, its corresponding +dyn_ftrace record should have its ftrace_ops pointer set to +ftrace_nop_ops. + +Correct the powerpc implementation to ensure the +ftrace_rec_set_nop_ops() helper is called on all successful NOP +initialization paths. This ensures all ftrace records are consistent +before being handled by the ftrace core. + +Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") +Suggested-by: Naveen N Rao +Signed-off-by: Joe Lawrence +Acked-by: Naveen N Rao (AMD) +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c +index 6dca92d5a6e82..841d077e28251 100644 +--- a/arch/powerpc/kernel/trace/ftrace.c ++++ b/arch/powerpc/kernel/trace/ftrace.c +@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) + return ret; + + /* Set up out-of-line stub */ +- if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) +- return ftrace_init_ool_stub(mod, rec); ++ if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) { ++ ret = ftrace_init_ool_stub(mod, rec); ++ goto out; ++ } + + /* Nop-out the ftrace location */ + new = ppc_inst(PPC_RAW_NOP()); +@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) + return -EINVAL; + } + ++out: ++ if (!ret) ++ ret = ftrace_rec_set_nop_ops(rec); ++ + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch b/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch new file mode 100644 index 0000000000..bc1e3baabd --- /dev/null +++ b/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch @@ -0,0 +1,43 @@ +From 84ac9169b524c175717af72705912ec4f0a6b770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 10:27:39 -0400 +Subject: powerpc64/modules: correctly iterate over stubs in + setup_ftrace_ool_stubs + +From: Joe Lawrence + +[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ] + +CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to +extend the ppc64le module .stubs section with an array of +ftrace_ool_stub structures for each patchable function. + +Fix its ppc64_stub_entry stub reservation loop to properly write across +all of the num_stubs used and not just the first entry. + +Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") +Signed-off-by: Joe Lawrence +Acked-by: Naveen N Rao (AMD) +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/module_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 126bf3b06ab7e..0e45cac4de76b 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr, + + /* reserve stubs */ + for (i = 0; i < num_stubs; i++) +- if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP())) ++ if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP())) + return -1; + #endif + +-- +2.51.0 + diff --git a/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..53bfb84673 --- /dev/null +++ b/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From ba7b282d8c3d9318721e68a6e4bf3cff0c5a0880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index 9463232af8d2e..c6b8b64782761 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch b/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch new file mode 100644 index 0000000000..178dbe7a2e --- /dev/null +++ b/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch @@ -0,0 +1,58 @@ +From 2161b8f891ec7bd2a4b32f051c92a8ea2afaa244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 21:29:08 +0530 +Subject: ptp: Add a upper bound on max_vclocks + +From: I Viswanath + +[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ] + +syzbot reported WARNING in max_vclocks_store. + +This occurs when the argument max is too large for kcalloc to handle. + +Extend the guard to guard against values that are too large for +kcalloc + +Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df +Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") +Signed-off-by: I Viswanath +Acked-by: Richard Cochran +Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_private.h | 1 + + drivers/ptp/ptp_sysfs.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index b352df4cd3f97..f329263f33aa1 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -22,6 +22,7 @@ + #define PTP_MAX_TIMESTAMPS 128 + #define PTP_BUF_TIMESTAMPS 30 + #define PTP_DEFAULT_MAX_VCLOCKS 20 ++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int))) + #define PTP_MAX_CHANNELS 2048 + + enum { +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index 6b1b8f57cd951..200eaf5006968 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev, + size_t size; + u32 max; + +- if (kstrtou32(buf, 0, &max) || max == 0) ++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT) + return -EINVAL; + + if (max == ptp->max_vclocks) +-- +2.51.0 + diff --git a/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch b/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch new file mode 100644 index 0000000000..5527c031de --- /dev/null +++ b/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch @@ -0,0 +1,49 @@ +From 069b1b06b52afc035e610ca52140d649c7448455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:00:59 +0200 +Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ] + +The pwm driver calls pm_runtime_get_sync() when the hardware becomes +enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's +state is kept when a consumer goes away, so the call to +pm_runtime_put_sync() in the .free() callback is unbalanced resulting in +a non-functional device and a reference underlow for the second consumer. + +The easiest fix for that issue is to just not drop the runtime PM +reference in .free(), so do that. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 0125e73b98dfb..5e674a7bbf3be 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- if (pwm_is_enabled(pwm)) { +- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n"); +- pm_runtime_put_sync(pwmchip_parent(chip)); +- } +- + /* set period value to zero on free */ + pc->period_cycles[pwm->hwpwm] = 0; + } +-- +2.51.0 + diff --git a/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..013105553d --- /dev/null +++ b/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From af981354d8c58afad1a5202a3cf34de1c1ab3d87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a23e48b8523db..7a86cb090f76f 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(pwmchip_parent(chip), "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch b/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch new file mode 100644 index 0000000000..e6df9a24d6 --- /dev/null +++ b/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch @@ -0,0 +1,279 @@ +From fc22efba86f3800689b9f09eace61d3285286a49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:01 +0200 +Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle + calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ] + +In Up-Count Mode the timer is reset to zero one tick after it reaches +TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both +the documentation and measurements. So the value written to the TBPRD has +to be one less than the calculated period_cycles value. + +A complication here is that for a 100% relative duty-cycle the value +written to the CMPx register has to be TBPRD + 1 which might overflow if +TBPRD is 0xffff. To handle that the calculation of the AQCTLx register +has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to +be skipped. + +Additionally the AQCTL_PRD register field has to be 0 because that defines +the hardware's action when the maximal counter value is reached, which is +(as above) one clock tick before the period's end. The period start edge +has to happen when the counter is reset and so is defined in the AQCTL_ZRO +field. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++---------------------- + 1 file changed, 58 insertions(+), 85 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a94b1e387b924..a23e48b8523db 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -36,7 +36,7 @@ + + #define CLKDIV_MAX 7 + #define HSPCLKDIV_MAX 7 +-#define PERIOD_MAX 0xFFFF ++#define PERIOD_MAX 0x10000 + + /* compare module registers */ + #define CMPA 0x12 +@@ -65,14 +65,10 @@ + #define AQCTL_ZRO_FRCHIGH BIT(1) + #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0)) + +-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) +-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW) + + #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6)) + #define AQSFRC_RLDCSF_ZRO 0 +@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip { + unsigned long clk_rate; + void __iomem *mmio_base; + unsigned long period_cycles[NUM_PWM_CHANNEL]; +- enum pwm_polarity polarity[NUM_PWM_CHANNEL]; + struct clk *tbclk; + struct ehrpwm_context ctx; + }; +@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + return 1; + } + +-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan) +-{ +- u16 aqctl_val, aqctl_mask; +- unsigned int aqctl_reg; +- +- /* +- * Configure PWM output to HIGH/LOW level on counter +- * reaches compare register value and LOW/HIGH level +- * on counter value reaches period register value and +- * zero value on counter +- */ +- if (chan == 1) { +- aqctl_reg = AQCTLB; +- aqctl_mask = AQCTL_CBU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANB_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANB_POLNORMAL; +- } else { +- aqctl_reg = AQCTLA; +- aqctl_mask = AQCTL_CAU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANA_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANA_POLNORMAL; +- } +- +- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; +- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); +-} +- + /* + * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE + * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE + */ + static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, +- u64 duty_ns, u64 period_ns) ++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + u32 period_cycles, duty_cycles; + u16 ps_divval, tb_divval; + unsigned int i, cmp_reg; + unsigned long long c; ++ u16 aqctl_val, aqctl_mask; ++ unsigned int aqctl_reg; + + if (period_ns > NSEC_PER_SEC) + return -ERANGE; +@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + do_div(c, NSEC_PER_SEC); + period_cycles = (unsigned long)c; + +- if (period_cycles < 1) { +- period_cycles = 1; +- duty_cycles = 1; +- } else { +- c = pc->clk_rate; +- c = c * duty_ns; +- do_div(c, NSEC_PER_SEC); +- duty_cycles = (unsigned long)c; +- } ++ c = pc->clk_rate; ++ c = c * duty_ns; ++ do_div(c, NSEC_PER_SEC); ++ duty_cycles = (unsigned long)c; + + /* + * Period values should be same for multiple PWM channels as IP uses +@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + return -EINVAL; + } + +- pm_runtime_get_sync(pwmchip_parent(chip)); +- +- /* Update clock prescaler values */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); +- + /* Update period & duty cycle with presacler division */ + period_cycles = period_cycles / ps_divval; + duty_cycles = duty_cycles / ps_divval; + +- /* Configure shadow loading on Period register */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ if (period_cycles < 1) ++ period_cycles = 1; + +- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles); ++ pm_runtime_get_sync(pwmchip_parent(chip)); + +- /* Configure ehrpwm counter for up-count mode */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, +- TBCTL_CTRMODE_UP); ++ /* Update clock prescaler values */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); + +- if (pwm->hwpwm == 1) ++ if (pwm->hwpwm == 1) { + /* Channel 1 configured with compare B register */ + cmp_reg = CMPB; +- else ++ ++ aqctl_reg = AQCTLB; ++ aqctl_mask = AQCTL_CBU_MASK; ++ ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANB_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANB_POLNORMAL; ++ ++ /* if duty_cycle is big, don't toggle on CBU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CBU_MASK; ++ ++ } else { + /* Channel 0 configured with compare A register */ + cmp_reg = CMPA; + +- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); ++ aqctl_reg = AQCTLA; ++ aqctl_mask = AQCTL_CAU_MASK; + +- pm_runtime_put_sync(pwmchip_parent(chip)); ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANA_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANA_POLNORMAL; + +- return 0; +-} ++ /* if duty_cycle is big, don't toggle on CAU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CAU_MASK; ++ } + +-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip, +- struct pwm_device *pwm, +- enum pwm_polarity polarity) +-{ +- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); ++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; ++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); ++ ++ /* Configure shadow loading on Period register */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ ++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1); ++ ++ /* Configure ehrpwm counter for up-count mode */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, ++ TBCTL_CTRMODE_UP); ++ ++ if (!(duty_cycles > period_cycles)) ++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); + +- /* Configuration of polarity in hardware delayed, do at enable */ +- pc->polarity[pwm->hwpwm] = polarity; ++ pm_runtime_put_sync(pwmchip_parent(chip)); + + return 0; + } +@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + + ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); + +- /* Channels polarity can be configured from action qualifier module */ +- configure_polarity(pc, pwm->hwpwm); +- + /* Enable TBCLK */ + ret = clk_enable(pc->tbclk); + if (ret) { +@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + ehrpwm_pwm_disable(chip, pwm); + enabled = false; + } +- +- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity); +- if (err) +- return err; + } + + if (!state->enabled) { +@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + return 0; + } + +- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period); ++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity); + if (err) + return err; + +-- +2.51.0 + diff --git a/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch b/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch new file mode 100644 index 0000000000..6d70596ab2 --- /dev/null +++ b/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch @@ -0,0 +1,40 @@ +From 81392e5367d2a4298e998730c7d3dd75b9d7be38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:00 +0200 +Subject: pwm: tiehrpwm: Make code comment in .free() more useful +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ] + +Instead of explaining trivia to everyone who can read C describe the +higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero. + +Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 5e674a7bbf3be..a94b1e387b924 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- /* set period value to zero on free */ ++ /* Don't let a pwm without consumer block requests to the other channel */ + pc->period_cycles[pwm->hwpwm] = 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch b/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch new file mode 100644 index 0000000000..6e4cb6bc9a --- /dev/null +++ b/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch @@ -0,0 +1,57 @@ +From 615ab6b2ae8a2b8340a93f5df6abbb7344be83e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jul 2025 15:27:07 +0800 +Subject: raid6: riscv: Clean up unused header file inclusion + +From: Chunyan Zhang + +[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ] + +These two C files don't reference things defined in simd.h or types.h +so remove these redundant #inclusions. + +Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations") +Reviewed-by: Alexandre Ghiti +Signed-off-by: Chunyan Zhang +Reviewed-by: Nutty Liu +Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + lib/raid6/recov_rvv.c | 2 -- + lib/raid6/rvv.c | 3 --- + 2 files changed, 5 deletions(-) + +diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c +index f29303795ccfe..500da521a8063 100644 +--- a/lib/raid6/recov_rvv.c ++++ b/lib/raid6/recov_rvv.c +@@ -4,9 +4,7 @@ + * Author: Chunyan Zhang + */ + +-#include + #include +-#include + #include + + static int rvv_has_vector(void) +diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c +index 7d82efa5b14f9..b193ea176d5d3 100644 +--- a/lib/raid6/rvv.c ++++ b/lib/raid6/rvv.c +@@ -9,11 +9,8 @@ + * Copyright 2002-2004 H. Peter Anvin + */ + +-#include + #include +-#include + #include +-#include + #include "rvv.h" + + #define NSIZE (riscv_v_vsize / 32) /* NSIZE = vlenb */ +-- +2.51.0 + diff --git a/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..3c9071fbf0 --- /dev/null +++ b/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From 22414da3ca108d561fe54f14d611b5f8907872bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 8670e58675c6d..75b2911462628 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1034,8 +1034,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..5052fe6fcc --- /dev/null +++ b/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From 58d684f9dc1caeb7bfc9d9877d5af2fa2d1c46f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index be0743dac3fff..929e89841c12a 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch b/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch new file mode 100644 index 0000000000..2bb6c21eb6 --- /dev/null +++ b/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch @@ -0,0 +1,115 @@ +From 5afe228318475b91eddbd6ba8ae8b86018c48a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:39:56 +0300 +Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Or Har-Toov + +[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ] + +The mlx5 driver currently derives max_qp_wr directly from the +log_max_qp_sz HCA capability: + + props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); + +However, this value represents the number of WQEs in units of Basic +Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size +of a WQE can vary depending on transport type and features (e.g., atomic +operations, UMR, LSO), the actual number of WQEs can be significantly +smaller than the WQEBB count suggests. + +This patch introduces a conservative estimation of the worst-case WQE size +— considering largest segments possible with 1 SGE and no inline data or +special features. It uses this to derive a more accurate max_qp_wr value. + +Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling") +Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org +Reported-by: Chuck Lever +Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/ +Signed-off-by: Or Har-Toov +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++- + 1 file changed, 47 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index df6557ddbdfc5..fdc4306878615 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -882,6 +883,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev, + resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask(); + } + ++/* ++ * Calculate maximum SQ overhead across all QP types. ++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT) ++ * have smaller overhead than the types calculated below, ++ * so they are implicitly included. ++ */ ++static u32 mlx5_ib_calc_max_sq_overhead(void) ++{ ++ u32 max_overhead_xrc, overhead_ud_lso, a, b; ++ ++ /* XRC_INI */ ++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg); ++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg); ++ a = sizeof(struct mlx5_wqe_atomic_seg) + ++ sizeof(struct mlx5_wqe_raddr_seg); ++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) + ++ sizeof(struct mlx5_mkey_seg) + ++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD; ++ max_overhead_xrc += max(a, b); ++ ++ /* UD with LSO */ ++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg); ++ ++ return max(max_overhead_xrc, overhead_ud_lso); ++} ++ ++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev) ++{ ++ struct mlx5_core_dev *mdev = dev->mdev; ++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ u32 max_wqe_size; ++ /* max QP overhead + 1 SGE, no inline, no special features */ ++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() + ++ sizeof(struct mlx5_wqe_data_seg); ++ ++ max_wqe_size = roundup_pow_of_two(max_wqe_size); ++ ++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB); ++ ++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size; ++} ++ + static int mlx5_ib_query_device(struct ib_device *ibdev, + struct ib_device_attr *props, + struct ib_udata *uhw) +@@ -1040,7 +1086,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, + props->max_mr_size = ~0ull; + props->page_size_cap = ~(min_page_size - 1); + props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp); +- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev); + max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) / + sizeof(struct mlx5_wqe_data_seg); + max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512); +-- +2.51.0 + diff --git a/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch new file mode 100644 index 0000000000..066b2d2edb --- /dev/null +++ b/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch @@ -0,0 +1,117 @@ +From e4b6da443b44a29101ce59bd090e061cd8bca96e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:41:19 +0300 +Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device + +From: Patrisious Haddad + +[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ] + +Previously loopback for MPV was supposed to be permanently enabled, +however other driver flows were able to over-ride that configuration and +disable it. + +Add force_lb parameter that indicates that loopback should always be +enabled which prevents all other driver flows from disabling it. + +Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") +Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++---- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index fdc4306878615..268ebf6609708 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1838,7 +1838,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + } + + static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + int err; + +@@ -1850,6 +1851,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + if (err) + goto out; + ++ lb_state->force_enable = true; + return 0; + + out: +@@ -1858,16 +1860,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + } + + static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + mlx5_nic_vport_update_local_lb(slave, false); + mlx5_nic_vport_update_local_lb(master, false); ++ ++ lb_state->force_enable = false; + } + + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; + ++ if (dev->lb.force_enable) ++ return 0; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td++; +@@ -1889,6 +1897,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + + void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { ++ if (dev->lb.force_enable) ++ return; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td--; +@@ -3568,7 +3579,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + +- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + + mlx5_core_mp_event_replay(ibdev->mdev, + MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, +@@ -3665,7 +3676,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + MLX5_DRIVER_EVENT_AFFILIATION_DONE, + &key); + +- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + if (err) + goto unbind; + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index fde859d207aea..030b7c2b109b1 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1113,6 +1113,7 @@ struct mlx5_ib_lb_state { + u32 user_td; + int qps; + bool enabled; ++ bool force_enable; + }; + + struct mlx5_ib_pf_eq { +-- +2.51.0 + diff --git a/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch b/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch new file mode 100644 index 0000000000..3540c4a9a5 --- /dev/null +++ b/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch @@ -0,0 +1,62 @@ +From 937d7c49a673c238bcd9c95cdca3d8e78036ec26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 02:52:12 +0000 +Subject: RDMA/rxe: Fix race in do_task() when draining + +From: Gui-Dong Han + +[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ] + +When do_task() exhausts its iteration budget (!ret), it sets the state +to TASK_STATE_IDLE to reschedule, without a secondary check on the +current task->state. This can overwrite the TASK_STATE_DRAINING state +set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). + +While state changes are protected by a spinlock, both rxe_cleanup_task() +and rxe_disable_task() release the lock while waiting for the task to +finish draining in the while(!is_done(task)) loop. The race occurs if +do_task() hits its iteration limit and acquires the lock in this window. +The cleanup logic may then proceed while the task incorrectly +reschedules itself, leading to a potential use-after-free. + +This bug was introduced during the migration from tasklets to workqueues, +where the special handling for the draining case was lost. + +Fix this by restoring the original pre-migration behavior. If the state is +TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to +force a new loop iteration. This allows the task to finish its work, so +that a subsequent iteration can reach the switch statement and correctly +transition the state to TASK_STATE_DRAINED, stopping the task as intended. + +Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks") +Reviewed-by: Zhu Yanjun +Signed-off-by: Gui-Dong Han +Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 6f8f353e95838..f522820b950c7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) + * yield the cpu and reschedule the task + */ + if (!ret) { +- task->state = TASK_STATE_IDLE; +- resched = 1; ++ if (task->state != TASK_STATE_DRAINING) { ++ task->state = TASK_STATE_IDLE; ++ resched = 1; ++ } else { ++ cont = 1; ++ } + goto exit; + } + +-- +2.51.0 + diff --git a/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..7a51641efd --- /dev/null +++ b/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 1bac02a368a9b5ea9cb92e3b72485675058a4b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 2b2a7b8e93b01..3acb23d13729d 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..5952974ca9 --- /dev/null +++ b/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From e3fa6a892ccb28155c4ec83f7b6501e4e7965612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1f3f782a04ba2..6883e1a43fe5d 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +-- +2.51.0 + diff --git a/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..3db4690db8 --- /dev/null +++ b/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 16b3a245820cb1b3b7d826c4bfd26c33d97d5981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 9df726f10ad12..6d609c42e4793 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch b/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch new file mode 100644 index 0000000000..b56d34fc85 --- /dev/null +++ b/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch @@ -0,0 +1,86 @@ +From 77ad1b9b943dd43cb662c6da1195382d680323f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:35 +0200 +Subject: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E + +From: Stephan Gerhold + +[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ] + +The ADSP firmware on X1E has separate firmware binaries for the main +firmware and the DTB. The same applies for the "lite" firmware loaded by +the boot firmware. + +When preparing to load the new ADSP firmware we shutdown the lite_pas_id +for the main firmware, but we don't shutdown the corresponding lite pas_id +for the DTB. The fact that we're leaving it "running" forever becomes +obvious if you try to reuse (or just access) the memory region used by the +"lite" firmware: The &adsp_boot_mem is accessible, but accessing the +&adsp_boot_dtb_mem results in a crash. + +We don't support reusing the memory regions currently, but nevertheless we +should not keep part of the lite firmware running. Fix this by adding the +lite_dtb_pas_id and shutting it down as well. + +We don't have a way to detect if the lite firmware is actually running yet, +so ignore the return status of qcom_scm_pas_shutdown() for now. This was +already the case before, the assignment to "ret" is not used anywhere. + +Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 02e29171cbbee..f3ec5b06261e8 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -42,6 +42,7 @@ struct qcom_pas_data { + int pas_id; + int dtb_pas_id; + int lite_pas_id; ++ int lite_dtb_pas_id; + unsigned int minidump_id; + bool auto_boot; + bool decrypt_shutdown; +@@ -80,6 +81,7 @@ struct qcom_pas { + int pas_id; + int dtb_pas_id; + int lite_pas_id; ++ int lite_dtb_pas_id; + unsigned int minidump_id; + int crash_reason_smem; + unsigned int smem_host_id; +@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw) + + if (pas->lite_pas_id) + ret = qcom_scm_pas_shutdown(pas->lite_pas_id); ++ if (pas->lite_dtb_pas_id) ++ qcom_scm_pas_shutdown(pas->lite_dtb_pas_id); + + if (pas->dtb_pas_id) { + ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev); +@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev) + pas->minidump_id = desc->minidump_id; + pas->pas_id = desc->pas_id; + pas->lite_pas_id = desc->lite_pas_id; ++ pas->lite_dtb_pas_id = desc->lite_dtb_pas_id; + pas->info_name = desc->sysmon_name; + pas->smem_host_id = desc->smem_host_id; + pas->decrypt_shutdown = desc->decrypt_shutdown; +@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = { + .pas_id = 1, + .dtb_pas_id = 0x24, + .lite_pas_id = 0x1f, ++ .lite_dtb_pas_id = 0x29, + .minidump_id = 5, + .auto_boot = true, + .proxy_pd_names = (char*[]){ +-- +2.51.0 + diff --git a/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..c806ca8481 --- /dev/null +++ b/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From 6b5470d23ef54a8c34f43fc94dde8bc530860cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 4ee5e67a9f03f..769c6d6d6a731 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch b/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch new file mode 100644 index 0000000000..4e94a25099 --- /dev/null +++ b/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch @@ -0,0 +1,57 @@ +From e1f7ff8eea47e78b25fac616e76f7826cb2efcf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 17:47:08 +0300 +Subject: remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 + +From: Dmitry Baryshkov + +[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ] + +On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw +MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was +specified as the firmware image. + +Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss # msm8974pro-fairphone-fp2 +Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com +[bjorn: Unwrapped the long memcpy line, to taste] +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index 0c0199fb0e68d..3087d895b87f4 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region) + release_firmware(dp_fw); + } + ++#define MSM8974_B00_OFFSET 0x1000 ++ + static int q6v5_load(struct rproc *rproc, const struct firmware *fw) + { + struct q6v5 *qproc = rproc->priv; +@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw) + return -EBUSY; + } + +- memcpy(mba_region, fw->data, fw->size); ++ if ((qproc->version == MSS_MSM8974 || ++ qproc->version == MSS_MSM8226 || ++ qproc->version == MSS_MSM8926) && ++ fw->size > MSM8974_B00_OFFSET && ++ !memcmp(fw->data, ELFMAG, SELFMAG)) ++ memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET); ++ else ++ memcpy(mba_region, fw->data, fw->size); + q6v5_debug_policy_load(qproc, mba_region); + memunmap(mba_region); + +-- +2.51.0 + diff --git a/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..2c89d5590a --- /dev/null +++ b/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From 74383ba9b795a732a2d6ba7477437f8130877006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 66d276a1be836..f4a19ffbb641c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index f0142d32b648f..16d818943487b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -48,7 +48,6 @@ + #include "en.h" + #include "en/dim.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2986,11 +2985,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -3000,18 +2997,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..1434d2e7ed --- /dev/null +++ b/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From 0d94bfa3dca317a6120b62abf8f017a7877489ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 4f8f5aab109d0..6309200e93dc3 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +-- +2.51.0 + diff --git a/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch b/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch new file mode 100644 index 0000000000..74963c2c25 --- /dev/null +++ b/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch @@ -0,0 +1,139 @@ +From 4b788aa7069a33835b239020db74d6472c372fee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 01:24:48 +0000 +Subject: riscv, bpf: Sign extend struct ops return values properly + +From: Hengqi Chen + +[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ] + +The ns_bpf_qdisc selftest triggers a kernel panic: + + Unable to handle kernel paging request at virtual address ffffffffa38dbf58 + Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 + [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 + Oops [#1] + Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] + CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE + Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE + Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 + epc : __qdisc_run+0x82/0x6f0 + ra : __qdisc_run+0x6e/0x6f0 + epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 + gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 + t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 + s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 + a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 + a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 + s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 + s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 + s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 + s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 + t5 : 0000000000000000 t6 : ff60000093a6a8b6 + status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d + [] __qdisc_run+0x82/0x6f0 + [] __dev_queue_xmit+0x4c0/0x1128 + [] neigh_resolve_output+0xd0/0x170 + [] ip6_finish_output2+0x226/0x6c8 + [] ip6_finish_output+0x10c/0x2a0 + [] ip6_output+0x5e/0x178 + [] ip6_xmit+0x29a/0x608 + [] inet6_csk_xmit+0xe6/0x140 + [] __tcp_transmit_skb+0x45c/0xaa8 + [] tcp_connect+0x9ce/0xd10 + [] tcp_v6_connect+0x4ac/0x5e8 + [] __inet_stream_connect+0xd8/0x318 + [] inet_stream_connect+0x3e/0x68 + [] __sys_connect_file+0x50/0x88 + [] __sys_connect+0x96/0xc8 + [] __riscv_sys_connect+0x20/0x30 + [] do_trap_ecall_u+0x256/0x378 + [] handle_exception+0x14a/0x156 + Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 + ---[ end trace 0000000000000000 ]--- + +The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer +is treated as a 32bit value and sign extend to 64bit in epilogue. This +behavior is right for most bpf prog types but wrong for struct ops which +requires RISC-V ABI. + +So let's sign extend struct ops return values according to the function +model and RISC-V ABI([0]). + + [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf + +Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") +Signed-off-by: Hengqi Chen +Signed-off-by: Daniel Borkmann +Tested-by: Pu Lehui +Reviewed-by: Pu Lehui +Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com +Signed-off-by: Sasha Levin +--- + arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c +index 9883a55d61b5b..f1efa4d6b27f3 100644 +--- a/arch/riscv/net/bpf_jit_comp64.c ++++ b/arch/riscv/net/bpf_jit_comp64.c +@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn, + return 0; + } + ++/* ++ * Sign-extend the register if necessary ++ */ ++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) ++{ ++ if (!sign && (sz == 1 || sz == 2)) { ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ return 0; ++ } ++ ++ switch (sz) { ++ case 1: ++ emit_sextb(rd, rs, ctx); ++ break; ++ case 2: ++ emit_sexth(rd, rs, ctx); ++ break; ++ case 4: ++ emit_sextw(rd, rs, ctx); ++ break; ++ case 8: ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ break; ++ default: ++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) + #define BPF_FIXUP_REG_MASK GENMASK(31, 27) + #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */ +@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); + + if (save_ret) { +- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); + emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); ++ if (is_struct_ops) { ++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, ++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); ++ if (ret) ++ goto out; ++ } else { ++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); ++ } + } + + emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); +-- +2.51.0 + diff --git a/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch b/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch new file mode 100644 index 0000000000..2f84a7a318 --- /dev/null +++ b/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch @@ -0,0 +1,45 @@ +From 35ce44a31d6a8c8f3cdd34ee5e815f9893f23bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 22:02:58 +0200 +Subject: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ] + +mbox_request_channel() returning value was changed in case of error. +It uses returning value of of_parse_phandle_with_args(). +It is returning with -ENOENT instead of -ENODEV when no mboxes property +exists. + +Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Stephan Gerhold +Tested-by: Stephan Gerhold # msm8939 +Signed-off-by: Barnabás Czémán +Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index 87c944d4b4f31..1cbe457b4e96f 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev, + edge->mbox_client.knows_txdone = true; + edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0); + if (IS_ERR(edge->mbox_chan)) { +- if (PTR_ERR(edge->mbox_chan) != -ENODEV) { ++ if (PTR_ERR(edge->mbox_chan) != -ENOENT) { + ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan), + "failed to acquire IPC mailbox\n"); + goto put_node; +-- +2.51.0 + diff --git a/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch b/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch new file mode 100644 index 0000000000..fc881a3fd4 --- /dev/null +++ b/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch @@ -0,0 +1,38 @@ +From 5abb1511a4a79f8fa2b32e6cda8eb0926eabf264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 16:42:11 +0200 +Subject: rust: cpumask: Mark CpumaskVar as transparent + +From: Baptiste Lepers + +[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ] + +Unsafe code in CpumaskVar's methods assumes that the type has the same +layout as `bindings::cpumask_var_t`. This is not guaranteed by +the default struct representation in Rust, but requires specifying the +`transparent` representation. + +Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions") +Signed-off-by: Baptiste Lepers +Reviewed-by: Alice Ryhl +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + rust/kernel/cpumask.rs | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs +index 19c607709b5fd..8bc8325b200dc 100644 +--- a/rust/kernel/cpumask.rs ++++ b/rust/kernel/cpumask.rs +@@ -215,6 +215,7 @@ impl Cpumask { + /// } + /// assert_eq!(mask2.weight(), count); + /// ``` ++#[repr(transparent)] + pub struct CpumaskVar { + #[cfg(CONFIG_CPUMASK_OFFSTACK)] + ptr: NonNull, +-- +2.51.0 + diff --git a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch new file mode 100644 index 0000000000..7dcb96639c --- /dev/null +++ b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch @@ -0,0 +1,77 @@ +From 0138fe973bbc3899540a7b7f3200b9d960622195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:29 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL + +From: Ilya Leoshkevich + +[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ] + +The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is +as follows: + + entry() + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + +entry() copies its tail call counter to the subprog_tail()'s frame, +which then increments it. However, the incremented result is discarded, +leading to an astronomically large number of tail calls. + +Fix by writing the incremented counter back to the entry()'s frame. + +Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 0c9a35782c833..794f99675cef4 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1778,13 +1778,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + jit->seen |= SEEN_FUNC; + /* + * Copy the tail call counter to where the callee expects it. +- * +- * Note 1: The callee can increment the tail call counter, but +- * we do not load it back, since the x86 JIT does not do this +- * either. +- * +- * Note 2: We assume that the verifier does not let us call the +- * main program, which clears the tail call counter on entry. + */ + /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */ + _EMIT6(0xd203f000 | STK_OFF_TCCNT, +@@ -1810,6 +1803,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + call_r1(jit); + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); ++ ++ /* ++ * Copy the potentially updated tail call counter back. ++ */ ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc frame_off+tail_call_cnt(%r15), ++ * tail_call_cnt(4,%r15) ++ */ ++ _EMIT6(0xd203f000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt)), ++ 0xf000 | offsetof(struct prog_frame, ++ tail_call_cnt)); ++ + break; + } + case BPF_JMP | BPF_TAIL_CALL: { +-- +2.51.0 + diff --git a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch new file mode 100644 index 0000000000..2c8649ac0e --- /dev/null +++ b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch @@ -0,0 +1,52 @@ +From 26a6ee9b28e1aaa8fad7a3b7e2a9e92ac4e2430b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:30 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG + +From: Ilya Leoshkevich + +[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ] + +The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call +graph is as follows: + + entry() + subprog_tail() + trampoline() + fentry() + the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG + return to entry() + +The problem is that the rest of subprog_tail() increments the tail call +counter, but the trampoline discards the incremented value. This +results in an astronomically large number of tail calls. + +Fix by making the trampoline write the incremented tail call counter +back. + +Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 794f99675cef4..47046e3080355 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -2811,6 +2811,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r2,retval_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, + tjit->retval_off); ++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ ++ _EMIT6(0xd203f000 | tjit->tccnt_off, ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + + im->ip_after_call = jit->prg_buf + jit->prg; + +-- +2.51.0 + diff --git a/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..94083c61ae --- /dev/null +++ b/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From c29dc45d58e9ecbcc0dfe8285407792a5ab0f73e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index dc74ebc6405ac..66fd301f03b0d 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..1b1fac0c1b --- /dev/null +++ b/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From 51c0819725af9b72f6f62f8b7f255c38ae9eb1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 95af3bb03834c..a58abd796603b 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..77a9b1e09a --- /dev/null +++ b/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From 4a3389c2af7d30e951d89195ea60d1040b1983b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 753c09363cbbc..3e1dac4b820fe 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch b/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch new file mode 100644 index 0000000000..21149a0e3e --- /dev/null +++ b/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch @@ -0,0 +1,59 @@ +From 9ab4d406299701ae4e0dbe3a3595b7134a48e318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:16 +0200 +Subject: scsi: pm80xx: Restore support for expanders + +From: Niklas Cassel + +[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ] + +Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke +support for expanders. After the commit, devices behind an expander are +no longer detected. + +Simply reverting the commit restores support for devices behind an +expander. + +Instead of reverting the commit (and reintroducing a helper to get the +port), get the port directly from the lldd_port pointer in struct +asd_sas_port. + +Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") +Suggested-by: Igor Pylypiv +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index f7067878b34f3..753c09363cbbc 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags) + struct pm8001_device *pm8001_dev = dev->lldd_dev; + bool internal_abort = sas_is_internal_abort(task); + struct pm8001_hba_info *pm8001_ha; +- struct pm8001_port *port = NULL; ++ struct pm8001_port *port; + struct pm8001_ccb_info *ccb; + unsigned long flags; + u32 n_elem = 0; +@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags) + + spin_lock_irqsave(&pm8001_ha->lock, flags); + +- pm8001_dev = dev->lldd_dev; +- port = pm8001_ha->phy[pm8001_dev->attached_phy].port; ++ port = dev->port->lldd_port; + + if (!internal_abort && + (DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) { +-- +2.51.0 + diff --git a/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..e64c166e24 --- /dev/null +++ b/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From 5e43b3b22579579c5775904ec5928d3603929c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 91bbd3b75bff9..ccd4485087a10 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch new file mode 100644 index 0000000000..0ac47bac04 --- /dev/null +++ b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch @@ -0,0 +1,39 @@ +From 1ac65f86203e886d7c837ad6d3ad91ac77ec6a6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:45 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + qla_nvme_xmt_ls_rsp() + +From: Qianfeng Rong + +[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ] + +Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to +align with qla2x00_start_sp() returning negative error codes or +QLA_SUCCESS, preventing logical errors. + +Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 8ee2e337c9e1b..316594aa40cc5 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(PURLS_MSLEEP_INTERVAL); + cnt++; + if (cnt < PURLS_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..f65caa43ad --- /dev/null +++ b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From 45b62c45695e905d3ee10d88c6cabc8b9aced7dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 514934dd6f80e..caba003abfd69 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch b/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch new file mode 100644 index 0000000000..e6103de177 --- /dev/null +++ b/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch @@ -0,0 +1,130 @@ +From 5333326ef0baa485207a1fc903ac054fc54183fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 17:41:43 +0800 +Subject: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling + +From: Zhongqiu Han + +[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ] + +The cpu_latency_qos_add/remove/update_request interfaces lack internal +synchronization by design, requiring the caller to ensure thread safety. +The current implementation relies on the 'pm_qos_enabled' flag, which is +insufficient to prevent concurrent access and cannot serve as a proper +synchronization mechanism. This has led to data races and list +corruption issues. + +A typical race condition call trace is: + +[Thread A] +ufshcd_pm_qos_exit() + --> cpu_latency_qos_remove_request() + --> cpu_latency_qos_apply(); + --> pm_qos_update_target() + --> plist_del <--(1) delete plist node + --> memset(req, 0, sizeof(*req)); + --> hba->pm_qos_enabled = false; + +[Thread B] +ufshcd_devfreq_target + --> ufshcd_devfreq_scale + --> ufshcd_scale_clks + --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true + --> cpu_latency_qos_update_request + --> pm_qos_update_target + --> plist_del <--(3) plist node use-after-free + +Introduces a dedicated mutex to serialize PM QoS operations, preventing +data races and ensuring safe access to PM QoS resources, including sysfs +interface reads. + +Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver") +Signed-off-by: Zhongqiu Han +Reviewed-by: Bart Van Assche +Tested-by: Huan Tang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-sysfs.c | 2 ++ + drivers/ufs/core/ufshcd.c | 9 +++++++++ + include/ufs/ufshcd.h | 3 +++ + 3 files changed, 14 insertions(+) + +diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c +index fcb4b14a710ff..62c7a3ecfb7eb 100644 +--- a/drivers/ufs/core/ufs-sysfs.c ++++ b/drivers/ufs/core/ufs-sysfs.c +@@ -494,6 +494,8 @@ static ssize_t pm_qos_enable_show(struct device *dev, + { + struct ufs_hba *hba = dev_get_drvdata(dev); + ++ guard(mutex)(&hba->pm_qos_mutex); ++ + return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled); + } + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 5224a21454021..b698e2fdc15fb 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -1017,6 +1017,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active); + */ + void ufshcd_pm_qos_init(struct ufs_hba *hba) + { ++ guard(mutex)(&hba->pm_qos_mutex); + + if (hba->pm_qos_enabled) + return; +@@ -1033,6 +1034,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba) + */ + void ufshcd_pm_qos_exit(struct ufs_hba *hba) + { ++ guard(mutex)(&hba->pm_qos_mutex); ++ + if (!hba->pm_qos_enabled) + return; + +@@ -1047,6 +1050,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba) + */ + static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on) + { ++ guard(mutex)(&hba->pm_qos_mutex); ++ + if (!hba->pm_qos_enabled) + return; + +@@ -10711,6 +10716,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + mutex_init(&hba->ee_ctrl_mutex); + + mutex_init(&hba->wb_mutex); ++ ++ /* Initialize mutex for PM QoS request synchronization */ ++ mutex_init(&hba->pm_qos_mutex); ++ + init_rwsem(&hba->clk_scaling_lock); + + ufshcd_init_clk_gating(hba); +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 9b3515cee7117..b94afda2233d6 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr { + * @ufs_rtc_update_work: A work for UFS RTC periodic update + * @pm_qos_req: PM QoS request handle + * @pm_qos_enabled: flag to check if pm qos is enabled ++ * @pm_qos_mutex: synchronizes PM QoS request and status updates + * @critical_health_count: count of critical health exceptions + * @dev_lvl_exception_count: count of device level exceptions since last reset + * @dev_lvl_exception_id: vendor specific information about the +@@ -1136,6 +1137,8 @@ struct ufs_hba { + struct delayed_work ufs_rtc_update_work; + struct pm_qos_request pm_qos_req; + bool pm_qos_enabled; ++ /* synchronizes PM QoS request and status updates */ ++ struct mutex pm_qos_mutex; + + int critical_health_count; + atomic_t dev_lvl_exception_count; +-- +2.51.0 + diff --git a/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch new file mode 100644 index 0000000000..96d4f76f32 --- /dev/null +++ b/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch @@ -0,0 +1,78 @@ +From 98fe73eaee81920a717d4c178c17cc478dda0729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 18:31:18 +0200 +Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too + fast + +From: Johannes Nixdorf + +[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ] + +Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an +event to the tracer, and starts to wait interruptibly. With +SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the +message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting +and is subsequently interrupted, the tracee begins to wait again +uninterruptibly (but killable). + +This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee +is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a +condition to begin waiting again. In this case the tracee is interrupted +even though the tracer already acted on its behalf. This breaks the +assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, +namely that the tracer can be sure the syscall is not interrupted or +restarted on the tracee after it is received on the tracer. Fix this +by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to +switch to uninterruptible waiting. + +With the condition changed the loop in seccomp_do_user_notification() +would exit immediately after deciding that noninterruptible waiting +is required if the operation already reached SECCOMP_NOTIFY_REPLIED, +skipping the code that processes pending addfd commands first. Prevent +this by executing the remaining loop body one last time in this case. + +Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") +Reported-by: Ali Polatel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 +Signed-off-by: Johannes Nixdorf +Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + kernel/seccomp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 41aa761c7738c..3bbfba30a777a 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +-- +2.51.0 + diff --git a/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch b/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch new file mode 100644 index 0000000000..a4f2ba0de7 --- /dev/null +++ b/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch @@ -0,0 +1,52 @@ +From 57836f0ae04ac873f872cf8180696a9b9233c6cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:56:36 +0200 +Subject: selftests: always install UAPI headers to the correct directory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ] + +Currently the UAPI headers are always installed into the source directory. +When building out-of-tree this doesn't work, as the include path will be +wrong and it dirties the source tree, leading to complains by kbuild. + +Make sure the 'headers' target installs the UAPI headers in the correctly. + +The real target directory can come from multiple places. To handle them all +extract the target directory from KHDR_INCLUDES. + +Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de +Reported-by: Jason Gunthorpe +Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/ +Fixes: 1a59f5d31569 ("selftests: Add headers target") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Jason Gunthorpe +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/lib.mk | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index 5303900339292..a448fae57831d 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S + $(LINK.S) $^ $(LDLIBS) -o $@ + endif + ++# Extract the expected header directory ++khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES))) ++ + headers: +- $(Q)$(MAKE) -C $(top_srcdir) headers ++ $(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers + + .PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers +-- +2.51.0 + diff --git a/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..65ac97540f --- /dev/null +++ b/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From e4177c850ddbcd87af072c3248256d12b88ebdc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch b/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch new file mode 100644 index 0000000000..f7662314f2 --- /dev/null +++ b/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch @@ -0,0 +1,40 @@ +From c515097583306509e25831331d6a2e2c3ef4448f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 10:50:39 -0700 +Subject: selftests/bpf: Copy test_kmods when installing selftest + +From: Amery Hung + +[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ] + +Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into +common directory") consolidated the Makefile of test_kmods. However, +since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel +modules required by bpf selftests are now missing from kselftest_install +when "make install". Fix it by adding test_kmod to TEST_GEN_FILES. + +Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory") +Signed-off-by: Amery Hung +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 910d8d6402ef1..159b7cb3dcb9b 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -136,7 +136,7 @@ TEST_GEN_PROGS_EXTENDED = \ + xdping \ + xskxceiver + +-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi ++TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi + + ifneq ($(V),1) + submake_extras := feature_display=0 +-- +2.51.0 + diff --git a/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch b/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch new file mode 100644 index 0000000000..1dd83a7e7b --- /dev/null +++ b/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch @@ -0,0 +1,61 @@ +From d3342dd7181f347947149450a21df24de9bd37b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:33:49 -0300 +Subject: selftests/bpf: Fix count write in testapp_xdp_metadata_copy() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ricardo B. Marlière + +[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ] + +Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support +check") added a new global to xsk_xdp_progs.c, but left out the access in +the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will +write to the whole bss section, it gets truncated. Fix by writing to +skel_rx->bss->count directly. + +Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check") +Signed-off-by: Ricardo B. Marlière +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xskxceiver.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index 0ced4026ee443..50b03b89f2ee2 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -2240,25 +2240,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test) + { + struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs; + struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs; +- struct bpf_map *data_map; +- int count = 0; +- int key = 0; + + test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata, + skel_tx->progs.xsk_xdp_populate_metadata, + skel_rx->maps.xsk, skel_tx->maps.xsk); + test->ifobj_rx->use_metadata = true; + +- data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss"); +- if (!data_map || !bpf_map__is_internal(data_map)) { +- ksft_print_msg("Error: could not find bss section of XDP program\n"); +- return TEST_FAILURE; +- } +- +- if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) { +- ksft_print_msg("Error: could not update count element\n"); +- return TEST_FAILURE; +- } ++ skel_rx->bss->count = 0; + + return testapp_validate_traffic(test); + } +-- +2.51.0 + diff --git a/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch b/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch new file mode 100644 index 0000000000..30028a6010 --- /dev/null +++ b/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch @@ -0,0 +1,82 @@ +From d730cf70b01c3dae5ae6e23db215e60fcfcef94c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:53:00 +0200 +Subject: selftests: cgroup: Make test_pids backwards compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Koutný + +[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ] + +The predicates in test expect event counting from 73e75e6fc352b +("cgroup/pids: Separate semantics of pids.events related to pids.max") +and the test would fail on older kernels. We want to have one version of +tests for all, so detect the feature and skip the test on old kernels. +(The test could even switch to check v1 semantics based on the flag but +keep it simple for now.) + +Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller") +Signed-off-by: Michal Koutný +Tested-by: Sebastian Chlad +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/cgroup/lib/cgroup_util.c | 12 ++++++++++++ + .../selftests/cgroup/lib/include/cgroup_util.h | 1 + + tools/testing/selftests/cgroup/test_pids.c | 3 +++ + 3 files changed, 16 insertions(+) + +diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c +index 8832f3d1cb614..84c2b5a021a77 100644 +--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c +@@ -520,6 +520,18 @@ int proc_mount_contains(const char *option) + return strstr(buf, option) != NULL; + } + ++int cgroup_feature(const char *feature) ++{ ++ char buf[PAGE_SIZE]; ++ ssize_t read; ++ ++ read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf)); ++ if (read < 0) ++ return read; ++ ++ return strstr(buf, feature) != NULL; ++} ++ + ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size) + { + char path[PATH_MAX]; +diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h +index adb2bc1931839..e726c959d6538 100644 +--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h ++++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h +@@ -56,6 +56,7 @@ extern int cg_run_nowait(const char *cgroup, + extern int cg_wait_for_proc_count(const char *cgroup, int count); + extern int cg_killall(const char *cgroup); + int proc_mount_contains(const char *option); ++int cgroup_feature(const char *feature); + extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size); + extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle); + extern pid_t clone_into_cgroup(int cgroup_fd); +diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c +index 9ecb83c6cc5cb..d8a1d1cd50072 100644 +--- a/tools/testing/selftests/cgroup/test_pids.c ++++ b/tools/testing/selftests/cgroup/test_pids.c +@@ -77,6 +77,9 @@ static int test_pids_events(const char *root) + char *cg_parent = NULL, *cg_child = NULL; + int pid; + ++ if (cgroup_feature("pids_localevents") <= 0) ++ return KSFT_SKIP; ++ + cg_parent = cg_name(root, "pids_parent"); + cg_child = cg_name(cg_parent, "pids_child"); + if (!cg_parent || !cg_child) +-- +2.51.0 + diff --git a/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch b/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch new file mode 100644 index 0000000000..8198f121f8 --- /dev/null +++ b/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch @@ -0,0 +1,70 @@ +From 95ac739a3596224d48a3a30aee09272a9686d337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:00:08 +0200 +Subject: selftests/futex: Fix some futex_numa_mpol subtests + +From: Waiman Long + +[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ] + +The "Memory out of range" subtest of futex_numa_mpol assumes that memory +access outside of the mmap'ed area is invalid. That may not be the case +depending on the actual memory layout of the test application. When that +subtest was run on an x86-64 system with latest upstream kernel, the test +passed as an error was returned from futex_wake(). On another PowerPC system, +the same subtest failed because futex_wake() returned 0. + + Bail out! futex2_wake(64, 0x86) should fail, but didn't + +Looking further into the passed subtest on x86-64, it was found that an +-EINVAL was returned instead of -EFAULT. The -EINVAL error was returned +because the node value test with FLAGS_NUMA set failed with a node value +of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed +because the supposed node number wasn't valid. If that memory location +happens to have a very small value (e.g. 0), the test will pass and no +error will be returned. + +Since this subtest is non-deterministic, drop it unless a guard page beyond +the mmap region is explicitly set. + +The other problematic test is the "Memory too small" test. The futex_wake() +function returns the -EINVAL error code because the given futex address isn't +8-byte aligned, not because only 4 of the 8 bytes are valid and the other +4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to +reflect the reality. + + [ bp: Massage commit message. ] + +Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol") +Signed-off-by: Waiman Long +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +index a9ecfb2d3932a..802c15c821906 100644 +--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c ++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +@@ -182,12 +182,10 @@ int main(int argc, char *argv[]) + if (futex_numa->numa == FUTEX_NO_NODE) + ksft_exit_fail_msg("NUMA node is left uninitialized\n"); + +- ksft_print_msg("Memory too small\n"); ++ /* FUTEX2_NUMA futex must be 8-byte aligned */ ++ ksft_print_msg("Mis-aligned futex\n"); + test_futex(futex_ptr + mem_size - 4, 1); + +- ksft_print_msg("Memory out of range\n"); +- test_futex(futex_ptr + mem_size, 1); +- + futex_numa->numa = FUTEX_NO_NODE; + mprotect(futex_ptr, mem_size, PROT_READ); + ksft_print_msg("Memory, RO\n"); +-- +2.51.0 + diff --git a/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch b/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch new file mode 100644 index 0000000000..f6fa1490ab --- /dev/null +++ b/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch @@ -0,0 +1,46 @@ +From 448aca94b3a3298d6ba4bf6f2b476b53cf4ac94d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:26:19 +0800 +Subject: selftests/kselftest_harness: Add harness-selftest.expected to + TEST_FILES +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yi Lai + +[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ] + +The harness-selftest.expected is not installed in INSTALL_PATH. +Attempting to execute harness-selftest.sh shows warning: + +diff: ./kselftest_harness/harness-selftest.expected: No such file or +directory + +Add harness-selftest.expected to TEST_FILES. + +Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com +Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest") +Signed-off-by: Yi Lai +Reviewed-by: Thomas Weißschuh +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile +index 0617535a6ce42..d2369c01701a0 100644 +--- a/tools/testing/selftests/kselftest_harness/Makefile ++++ b/tools/testing/selftests/kselftest_harness/Makefile +@@ -2,6 +2,7 @@ + + TEST_GEN_PROGS_EXTENDED := harness-selftest + TEST_PROGS := harness-selftest.sh ++TEST_FILES := harness-selftest.expected + EXTRA_CLEAN := harness-selftest.seen + + include ../lib.mk +-- +2.51.0 + diff --git a/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch b/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch new file mode 100644 index 0000000000..bb78663985 --- /dev/null +++ b/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch @@ -0,0 +1,101 @@ +From 5fe56e0a2b3dd5a0fe27a6c240633d26c71909e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 09:37:11 +0800 +Subject: selftests/mm: fix va_high_addr_switch.sh failure on x86_64 + +From: Chunyu Hu + +[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ] + +The test will fail as below on x86_64 with cpu la57 support (will skip if +no la57 support). Note, the test requries nr_hugepages to be set first. + + # running bash ./va_high_addr_switch.sh + # ------------------------------------- + # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK + # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK + # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK + # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK + # mmap(NULL): 0x7f55b60f9000 - OK + # mmap(low_addr): 0x40000000 - OK + # mmap(high_addr): 0x1000000000000 - OK + # mmap(high_addr) again: 0xffff55b6136000 - OK + # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK + # mmap(-1): 0xffff55b6134000 - OK + # mmap(-1) again: 0xffff55b6132000 - OK + # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK + # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK + # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK + # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK + # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK + # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK + # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK + # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK + # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK + # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK + # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK + # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK + # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED + # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK + # [FAIL] + +addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for +x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit. + +Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} +functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch +code arch/x86/mm/hugetlbpage.c and addr is checked with +map_address_hint_valid() after align with 'addr &= huge_page_mask(h)' +which is a round down way, and it will fail the check because the addr is +within the DEFAULT_MAP_WINDOW but (addr + len) is above the +DFEFAULT_MAP_WINDOW. So it wil go through the +hugetlb_get_unmmaped_area_top_down() to find an area within the +DFEFAULT_MAP_WINDOW. + +After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} +functions"). The addr hint for hugetlb_get_unmmaped_area() will be +rounded up and aligned to hugepage size with ALIGN() for all arches. And +after the align, the addr will be above the default MAP_DEFAULT_WINDOW, +and the map_addresshint_valid() check will pass because both aligned addr +(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned +hint address (0x800000000000) is returned as an suitable gap is found +there, in arch_get_unmapped_area_topdown(). + +To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and +addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last +hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr, +and the addr + len (2 hugepages) will be one hugepage above the +DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page +round up or round down from kernel, so it's determistic. + +Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com +Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions") +Signed-off-by: Chunyu Hu +Suggested-by: David Hildenbrand +Acked-by: David Hildenbrand +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c +index 896b3f73fc53b..306eba8251077 100644 +--- a/tools/testing/selftests/mm/va_high_addr_switch.c ++++ b/tools/testing/selftests/mm/va_high_addr_switch.c +@@ -230,10 +230,10 @@ void testcases_init(void) + .msg = "mmap(-1, MAP_HUGETLB) again", + }, + { +- .addr = (void *)(addr_switch_hint - pagesize), ++ .addr = (void *)(addr_switch_hint - hugepagesize), + .size = 2 * hugepagesize, + .flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS, +- .msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)", ++ .msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)", + .low_addr_required = 1, + .keep_mapped = 1, + }, +-- +2.51.0 + diff --git a/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch b/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch new file mode 100644 index 0000000000..198147053d --- /dev/null +++ b/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch @@ -0,0 +1,42 @@ +From dc9543f633b53b297a85e8513a7812e792c845a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 22:12:22 +0200 +Subject: selftests/nolibc: fix EXPECT_NZ macro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benjamin Berg + +[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ] + +The expect non-zero macro was incorrect and never used. Fix its +definition. + +Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests") +Signed-off-by: Benjamin Berg +Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index b5c04c1372495..c2f0c40c1856f 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen) + } + + +-#define EXPECT_NZ(cond, expr, val) \ +- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) ++#define EXPECT_NZ(cond, expr) \ ++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) + + static __attribute__((unused)) + int expect_nz(int expr, int llen) +-- +2.51.0 + diff --git a/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch b/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch new file mode 100644 index 0000000000..525dc0d758 --- /dev/null +++ b/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch @@ -0,0 +1,79 @@ +From 60af0c353f0cd4a1778d4cb3f16567d186b6fdbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:02 +0200 +Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ] + +The _rval register variable is meant to be an output operand of the asm +statement but is instead used as input operand. +clang 20.1 notices this and triggers -Wuninitialized warnings: + +tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized] + 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL' + 59 | : "r" (_rval) \ + | ^~~~~ +tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here +tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL' + 47 | register long _rval asm ("r3"); \ + | ^ + +It seems the list of input and output operands have been switched around. +However as the argument registers are not always initialized they can not +be marked as pure inputs as that would trigger -Wuninitialized warnings. +Adding _rval as another input and output operand does also not work as it +would collide with the existing _r3 variable. + +Instead reuse _r3 for both the argument and the return value. + +Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc") +Reported-by: kernel test robot +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Reviewed-by: Christophe Leroy +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de +Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_call.h | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h +index bb237d771051b..e7205584cbdca 100644 +--- a/tools/testing/selftests/vDSO/vdso_call.h ++++ b/tools/testing/selftests/vDSO/vdso_call.h +@@ -44,7 +44,6 @@ + register long _r6 asm ("r6"); \ + register long _r7 asm ("r7"); \ + register long _r8 asm ("r8"); \ +- register long _rval asm ("r3"); \ + \ + LOADARGS_##nr(fn, args); \ + \ +@@ -54,13 +53,13 @@ + " bns+ 1f\n" \ + " neg 3, 3\n" \ + "1:" \ +- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \ ++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \ + "+r" (_r6), "+r" (_r7), "+r" (_r8) \ +- : "r" (_rval) \ ++ : \ + : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \ + "cr6", "cr7", "xer", "lr", "ctr", "memory" \ + ); \ +- _rval; \ ++ _r3; \ + }) + + #else +-- +2.51.0 + diff --git a/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch b/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch new file mode 100644 index 0000000000..a04ce6f1e2 --- /dev/null +++ b/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch @@ -0,0 +1,62 @@ +From 537af440da373ab81d548095064e9249784c3163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:03 +0200 +Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with + missing vDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ] + +If AT_SYSINFO_EHDR is missing the whole test needs to be skipped. +Currently this results in the following output: + + TAP version 13 + 1..16 + # AT_SYSINFO_EHDR is not present! + +This output is incorrect, as "1..16" still requires the subtest lines to +be printed, which isn't done however. + +Switch to the correct skipping functions, so the output now correctly +indicates that no subtests are being run: + + TAP version 13 + 1..0 # SKIP AT_SYSINFO_EHDR is not present! + +Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c +index a54424e2336f4..67cbfc56e4e1b 100644 +--- a/tools/testing/selftests/vDSO/vdso_test_abi.c ++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c +@@ -182,12 +182,11 @@ int main(int argc, char **argv) + unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR); + + ksft_print_header(); +- ksft_set_plan(VDSO_TEST_PLAN); + +- if (!sysinfo_ehdr) { +- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n"); +- return KSFT_SKIP; +- } ++ if (!sysinfo_ehdr) ++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n"); ++ ++ ksft_set_plan(VDSO_TEST_PLAN); + + version = versions[VDSO_VERSION]; + name = (const char **)&names[VDSO_NAMES]; +-- +2.51.0 + diff --git a/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..09d043731f --- /dev/null +++ b/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 7d70db8f301c6b93f0ccee62ce66707c5a08ebb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index a1f506ba55786..4f09c5db0c7f3 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-6.16/serial-max310x-add-error-checking-in-probe.patch b/queue-6.16/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..0dfa17fd46 --- /dev/null +++ b/queue-6.16/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From f5f9a093d2381a944ab58013fb0d77b6b20ed6e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 541c790c01090..2b42a4c21a9b8 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regcfg_i2c.name = max310x_regmap_name(i); + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); +-- +2.51.0 + diff --git a/queue-6.16/series b/queue-6.16/series new file mode 100644 index 0000000000..cffd61b731 --- /dev/null +++ b/queue-6.16/series @@ -0,0 +1,332 @@ +arch-copy_thread-pass-clone_flags-as-u64.patch +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +init-initramfs_preserve_mtime-should-depend-on-blk_d.patch +pid-use-ns_capable_noaudit-when-determining-net-sysc.patch +seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch +kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +kselftest-arm64-gcs-correctly-check-return-value-whe.patch +gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch +powerpc-8xx-remove-left-over-instruction-and-comment.patch +powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch +powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch +powerpc64-modules-correctly-iterate-over-stubs-in-se.patch +uprobes-uprobe_warn-should-use-passed-task.patch +raid6-riscv-clean-up-unused-header-file-inclusion.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +smb-server-fix-ird-ord-negotiation-with-the-client.patch +edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch +perf-x86-intel-use-early_initcall-to-hook-bts_init.patch +perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +selftests-cgroup-make-test_pids-backwards-compatible.patch +lsm-config_lsm-can-depend-on-config_security.patch +cpuset-fix-failure-to-enable-isolated-partition-when.patch +btrfs-return-any-hit-error-from-extent_writepage_io.patch +pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch +arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch +bpf-tidy-verifier-bug-message.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +selftests-bpf-copy-test_kmods-when-installing-selfte.patch +rust-cpumask-mark-cpumaskvar-as-transparent.patch +bpf-selftests-fix-test_tcpnotify_user.patch +bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch +libbpf-fix-reuse-of-devmap.patch +arm-dts-renesas-porter-fix-can-pin-group.patch +leds-max77705-function-return-instead-of-variable-as.patch +leds-flash-leds-qcom-flash-update-torch-current-clam.patch +s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch +s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch +arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch +libbpf-export-bpf_object__prepare-symbol.patch +firmware-arm_scmi-mark-virtio-ready-before-registeri.patch +arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch +arm64-dts-imx93-kontron-fix-usb-port-assignment.patch +arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +arm-at91-pm-fix-mckx-restore-routine.patch +arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +selftests-futex-fix-some-futex_numa_mpol-subtests.patch +selftests-nolibc-fix-expect_nz-macro.patch +leds-leds-lp55xx-use-correct-address-for-memory-prog.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch +dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch +selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch +vdso-datastore-gate-time-data-behind-config_generic_.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +vdso-add-struct-__kernel_old_timeval-forward-declara.patch +arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch +arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch +arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch +pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch +power-supply-cw2015-fix-a-alignment-coding-style-iss.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +null_blk-fix-the-description-of-the-cache_size-modul.patch +blk-throttle-fix-access-race-during-throttle-policy-.patch +selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch +selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch +tick-do-not-set-device-to-detached-state-in-tick_shu.patch +arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch +nbd-restrict-sockets-to-tcp-and-udp.patch +pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +dts-arm-amlogic-fix-pwm-node-for-c3.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch +cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch +arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch +arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch +arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch +arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch +arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch +mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch +arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch +arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch +pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch +pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch +pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +acpica-apply-acpi_nonstring.patch +acpica-fix-largest-possible-resource-descriptor-inde.patch +riscv-bpf-sign-extend-struct-ops-return-values-prope.patch +nvme-auth-update-bi_directional-flag.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +nvmet-fcloop-call-done-callback-even-when-remote-por.patch +nvme-tcp-send-only-permitted-commands-for-secure-con.patch +i3c-master-svc-use-manual-response-for-ibi-events.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +selftests-kselftest_harness-add-harness-selftest.exp.patch +blk-throttle-fix-throtl_data-leak-during-disk-releas.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch +selftests-always-install-uapi-headers-to-the-correct.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +mfd-max77705-max77705_charger-move-active-discharge-.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +spi-fix-return-code-when-spi-device-has-too-many-chi.patch +clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch +clocksource-drivers-tegra186-avoid-64-bit-division.patch +bpf-mark-kfuncs-as-__noclone.patch +once-fix-race-by-moving-do_once-to-separate-section.patch +hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch +i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch +i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch +i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch +i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch +i2c-designware-fix-clock-issue-when-pm-is-disabled.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch +bpf-enforce-expected_attach_type-for-tailcall-compat.patch +mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch +drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch +drm-panel-novatek-nt35560-fix-invalid-return-value.patch +drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch +drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +f2fs-fix-condition-in-__allow_reserved_blocks.patch +f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch +f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch +drm-bridge-it6505-select-regmap_i2c.patch +wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch +hid-steelseries-refactor-probe-and-remove.patch +media-zoran-remove-zoran_fh-structure.patch +phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch +drm-bridge-cdns-dsi-fix-the-_atomic_check.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch +pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch +serial-max310x-add-error-checking-in-probe.patch +drm-amd-display-remove-redundant-semicolons.patch +drm-amd-display-add-null-pointer-checks-in-dc_stream.patch +crypto-keembay-add-missing-check-after-sg_nents_for_.patch +hwrng-nomadik-add-arm_amba-dependency.patch +docs-iio-ad3552r-fix-malformed-code-block-directive.patch +fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch +scsi-pm80xx-restore-support-for-expanders.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +crypto-octeontx2-call-strscpy-with-correct-size-argu.patch +drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +media-i2c-vd55g1-fix-duster-register-address.patch +rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch +rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch +wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch +pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +media-st-delta-avoid-excessive-stack-usage.patch +accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch +crypto-hisilicon-zip-remove-unnecessary-validation-f.patch +crypto-hisilicon-re-enable-address-prefetch-after-de.patch +crypto-hisilicon-check-the-sva-module-status-while-e.patch +crypto-hisilicon-qm-check-whether-the-input-function.patch +crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch +inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch +dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch +coresight-trbe-add-isb-after-trblimitr-write.patch +coresight-fix-missing-include-for-field_get.patch +coresight-only-register-perf-symlink-for-sinks-with-.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch +drm-amd-pm-fix-si_upload_smc_data-v3.patch +drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch +drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch +drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch +drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +fanotify-validate-the-return-value-of-mnt_ns_from_de.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +wifi-iwlwifi-remove-redundant-header-files.patch +idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +drm-msm-dpu-fix-incorrect-type-for-ret.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch +iio-consumers-fix-handling-of-negative-channel-scale.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch +tools-ynl-fix-undefined-variable-name.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +ipvs-use-read_once-write_once-for-ipvs-enable.patch +hid-steelseries-fix-steelseries_srws1-handling-in-st.patch +watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch +wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch +wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch +wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch +wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch +wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch +wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch +asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch +srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch +drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch +f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch +f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch +f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch +alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch +hid-hidraw-tighten-ioctl-command-parsing.patch +f2fs-fix-zero-sized-extent-for-precache-extents.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch +wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch +wifi-ath12k-fix-the-fetching-of-combined-rssi.patch +wifi-ath12k-add-fallback-for-invalid-channel-number-.patch +wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch +wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch +asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584 +vfio-pds-replace-bitmap_free-with-vfree.patch +crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch +wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch +rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch +remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch +rdma-rxe-fix-race-in-do_task-when-draining.patch +selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch +wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch +wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch +pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch +wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch +dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch +coresight-fix-indentation-error-in-cscfg_remove_owne.patch +coresight-etm4x-conditionally-access-register-trcext.patch +coresight-tmc-support-atclk.patch +coresight-catu-support-atclk.patch +coresight-etm4x-support-atclk.patch +coresight-appropriately-disable-programming-clocks.patch +coresight-appropriately-disable-trace-bus-clocks.patch +coresight-avoid-enable-programming-clock-duplicately.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +coresight-tpda-fix-the-logic-to-setup-the-element-si.patch +coresight-fix-incorrect-handling-for-return-value-of.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +net-ethtool-tsconfig-set-command-must-provide-a-repl.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch +netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch +scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch +pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch +pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch +iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch +iommu-selftest-prevent-use-of-uninitialized-variable.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-enetc-fix-probing-error-message-typo-for-the-ene.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +ptp-add-a-upper-bound-on-max_vclocks.patch +vhost-vringh-fix-copy_to_iter-return-value-check.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch +bluetooth-iso-free-rx_skb-if-not-consumed.patch +bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch +bluetooth-hci_sync-fix-using-random-address-for-big-.patch +keys-x.509-fix-basic-constraints-ca-flag-parsing.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch +pci-j721e-fix-incorrect-error-message-in-probe.patch +idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +net-mlx5-stop-polling-for-command-response-if-interf.patch +net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch +net-mlx5-fw-reset-add-reset-timeout-work.patch +smb-client-fix-crypto-buffers-in-non-linear-memory.patch +bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch +net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch +iommufd-register-iommufd-mock-devices-with-fwspec.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch +octeontx2-vf-fix-bitmap-leak.patch +octeontx2-pf-fix-bitmap-leak.patch +vhost-vringh-modify-the-return-value-check.patch +bpf-reject-negative-offsets-for-alu-ops.patch diff --git a/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch b/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch new file mode 100644 index 0000000000..714494e788 --- /dev/null +++ b/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch @@ -0,0 +1,169 @@ +From 410968e585100d9c0642272ba9d2b068c80482a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 12:10:33 -0300 +Subject: smb: client: fix crypto buffers in non-linear memory + +From: Enzo Matsumiya + +[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ] + +The crypto API, through the scatterlist API, expects input buffers to be +in linear memory. We handle this with the cifs_sg_set_buf() helper +that converts vmalloc'd memory to their corresponding pages. + +However, when we allocate our aead_request buffer (@creq in +smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly +puts aead_request->__ctx in vmalloc area. + +AEAD algorithm then uses ->__ctx for its private/internal data and +operations, and uses sg_set_buf() for such data on a few places. + +This works fine as long as @creq falls into kmalloc zone (small +requests) or vmalloc'd memory is still within linear range. + +Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too +many tasks will increment the base stacks' addresses to a point where +virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that +happens. + +In practice: too many parallel reads and writes on an encrypted mount +will trigger this bug. + +To fix this, always alloc @creq with kmalloc() instead. +Also drop the @sensitive_size variable/arguments since +kfree_sensitive() doesn't need it. + +Backtrace: + +[ 945.272081] ------------[ cut here ]------------ +[ 945.272774] kernel BUG at include/linux/scatterlist.h:209! +[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) +[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 +[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) +[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 +[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b +[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 +[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 +[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 +[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 +[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 +[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 +[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 +[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 +[ 945.286683] Call Trace: +[ 945.286952] +[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] +[ 945.287719] crypto_gcm_encrypt+0x36/0xe0 +[ 945.288152] crypt_message+0x54a/0xad0 [cifs] +[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] +[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] +[ 945.289944] cifs_call_async+0x178/0x340 [cifs] +[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] +[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] +[ 945.291759] ? find_held_lock+0x32/0x90 +[ 945.292212] ? netfs_advance_write+0xf2/0x310 +[ 945.292723] netfs_advance_write+0xf2/0x310 +[ 945.293210] netfs_write_folio+0x346/0xcc0 +[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 +[ 945.294250] netfs_writepages+0x117/0x460 +[ 945.294724] do_writepages+0xbe/0x170 +[ 945.295152] ? find_held_lock+0x32/0x90 +[ 945.295600] ? kvm_sched_clock_read+0x11/0x20 +[ 945.296103] __writeback_single_inode+0x56/0x4b0 +[ 945.296643] writeback_sb_inodes+0x229/0x550 +[ 945.297140] __writeback_inodes_wb+0x4c/0xe0 +[ 945.297642] wb_writeback+0x2f1/0x3f0 +[ 945.298069] wb_workfn+0x300/0x490 +[ 945.298472] process_one_work+0x1fe/0x590 +[ 945.298949] worker_thread+0x1ce/0x3c0 +[ 945.299397] ? __pfx_worker_thread+0x10/0x10 +[ 945.299900] kthread+0x119/0x210 +[ 945.300285] ? __pfx_kthread+0x10/0x10 +[ 945.300729] ret_from_fork+0x119/0x1b0 +[ 945.301163] ? __pfx_kthread+0x10/0x10 +[ 945.301601] ret_from_fork_asm+0x1a/0x30 +[ 945.302055] + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: Enzo Matsumiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index cd051bb1a9d60..62d6a465dfa10 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct sg_table *sgt, +- unsigned int *num_sgs, size_t *sensitive_size) ++ unsigned int *num_sgs) + { + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); +@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += array_size(*num_sgs, sizeof(struct scatterlist)); +- *sensitive_size = len; + +- p = kvzalloc(len, GFP_NOFS); ++ p = kzalloc(len, GFP_NOFS); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + + static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, +- struct aead_request **req, struct scatterlist **sgl, +- size_t *sensitive_size) ++ struct aead_request **req, struct scatterlist **sgl) + { + struct sg_table sgtable = {}; + unsigned int skip, num_sgs, i, j; + ssize_t rc; + void *p; + +- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, +- &num_sgs, sensitive_size); ++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); + if (IS_ERR(p)) + return ERR_CAST(p); + +@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + DECLARE_CRYPTO_WAIT(wait); + unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; +- size_t sensitive_size; + + rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); + if (rc) { +@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + return rc; + } + +- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, +- &sensitive_size); ++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (IS_ERR(creq)) + return PTR_ERR(creq); + +@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + if (!rc && enc) + memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); + +- kvfree_sensitive(creq, sensitive_size); ++ kfree_sensitive(creq); + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch new file mode 100644 index 0000000000..7ff14e586b --- /dev/null +++ b/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch @@ -0,0 +1,192 @@ +From 92876ffc0a3fbb9b5f61a05cb5bdfc012f0db042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 15:34:58 +0200 +Subject: smb: server: fix IRD/ORD negotiation with the client + +From: Stefan Metzmacher + +[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ] + +Already do real negotiation in smb_direct_handle_connect_request() +where we see the requested initiator_depth and responder_resources +from the client. + +We should detect legacy iwarp clients using MPA v1 +with the custom IRD/ORD negotiation. + +We need to send the custom IRD/ORD in big endian, +but we need to try to let clients with broken requests +using little endian (older cifs.ko) to work. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +Acked-by: Namjae Jeon +Cc: Steve French +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++----- + 1 file changed, 85 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 74dfb6496095d..e1f659d3b4cf5 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -153,6 +153,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..78c26c50bd --- /dev/null +++ b/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From 1ae3a2d8f97f193cae52bdc438142f56daa59846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index 974f3a3962e8d..35af7e58b075f 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -892,16 +892,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch new file mode 100644 index 0000000000..74e8734b21 --- /dev/null +++ b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch @@ -0,0 +1,79 @@ +From b4c275df9e4ef430bcc48f89c8b08e5817cb74bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:50 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure + +From: Johan Hovold + +[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index 7c349a94b45c0..48804e1e5a6c8 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp, + return dev; + } + ++static void svs_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; +@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + dev = svs_add_device_link(svsp, "thermal-sensor"); + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get thermal device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch new file mode 100644 index 0000000000..1973bfdd43 --- /dev/null +++ b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch @@ -0,0 +1,67 @@ +From ed3d4c1ba0edce1a72d745e243e75e2f53538bd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:51 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure + +From: Johan Hovold + +[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index 48804e1e5a6c8..f45537546553e 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst"); + if (IS_ERR(svsp->rst)) +@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get lvts device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..1fac0f2a1c --- /dev/null +++ b/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From 9eba8eb3205e6523be168eefe837352abfa9104c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index fdab2b1067dbb..c6f7d5c9c493d 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); +-- +2.51.0 + diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..f8dc61afcb --- /dev/null +++ b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 33201b3c93695aa4309694221a6c80a90f8a495e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index 635398ec7540e..154fbd35400ca 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084 new file mode 100644 index 0000000000..8419462e6a --- /dev/null +++ b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084 @@ -0,0 +1,111 @@ +From 00d90918d1633bb081c039a9a6c0ca06f18db432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894..bbd3ea0a64822 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082 new file mode 100644 index 0000000000..4c25c3b50c --- /dev/null +++ b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082 @@ -0,0 +1,67 @@ +From 211c7e7ce88c6cec9683dc4991eb8d55f71706b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584 new file mode 100644 index 0000000000..8a72a2caa4 --- /dev/null +++ b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584 @@ -0,0 +1,112 @@ +From d737d1e83bc6099846b3c1e323e74488ea365f23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..411c0bf969 --- /dev/null +++ b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From 27c3a9f853ca71452906e0e8ae994b0f8baab2ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch b/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch new file mode 100644 index 0000000000..cfff9498ae --- /dev/null +++ b/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch @@ -0,0 +1,36 @@ +From 9bb998ca4ba880c9ab805cebd7003dea83ca1d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 20:37:19 +0200 +Subject: spi: fix return code when spi device has too many chipselects + +From: Jonas Gorski + +[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ] + +Don't return a positive value when there are too many chipselects. + +Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core") +Signed-off-by: Jonas Gorski +Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 0ffa3f9f28707..68222a9898a4b 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2450,7 +2450,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + if (rc > ctlr->num_chipselect) { + dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n", + nc, rc); +- return rc; ++ return -EINVAL; + } + if ((of_property_present(nc, "parallel-memories")) && + (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) { +-- +2.51.0 + diff --git a/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch b/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch new file mode 100644 index 0000000000..d36618ec66 --- /dev/null +++ b/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch @@ -0,0 +1,52 @@ +From 25c5735cc2b1bc93a063024d3db934224e3bbafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 20:51:55 +0800 +Subject: srcu/tiny: Remove preempt_disable/enable() in + srcu_gp_start_if_needed() + +From: Zqiang + +[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ] + +Currently, the srcu_gp_start_if_needed() is always be invoked in +preempt disable's critical section, this commit therefore remove +redundant preempt_disable/enable() in srcu_gp_start_if_needed() +and adds a call to lockdep_assert_preemption_disabled() in order +to enable lockdep to diagnose mistaken invocations of this function +from preempts-enabled code. + +Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption") +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/srcutiny.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c +index 6e9fe2ce1075d..e3b64a5e0ec7e 100644 +--- a/kernel/rcu/srcutiny.c ++++ b/kernel/rcu/srcutiny.c +@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp) + { + unsigned long cookie; + +- preempt_disable(); // Needed for PREEMPT_LAZY ++ lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY + cookie = get_state_synchronize_srcu(ssp); + if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) { +- preempt_enable(); + return; + } + WRITE_ONCE(ssp->srcu_idx_max, cookie); +@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp) + else if (list_empty(&ssp->srcu_work.entry)) + list_add(&ssp->srcu_work.entry, &srcu_boot_list); + } +- preempt_enable(); + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..671b911703 --- /dev/null +++ b/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From 7d1d82fd1749bb83ca9be73b5baab5d8f1e074b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 98da33e0c308b..c818a8b32daeb 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3102,8 +3102,8 @@ bool tcp_check_oom(const struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -3122,11 +3122,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..9f9609cba2 --- /dev/null +++ b/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From e96e9466538b93d5f9b2f3c6f7624fd13b8cf548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index 991d1573983d9..dff3dc062d736 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..f3ab0288c6 --- /dev/null +++ b/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From 7b5c8fd0a70bf302bf375beb1d6e56716ca5715d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebb..a6bb01082ec69 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch b/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch new file mode 100644 index 0000000000..237d71667d --- /dev/null +++ b/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch @@ -0,0 +1,105 @@ +From 8f4fa97e635945af0cbdb17e0fe32e5a4cc36b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 14:49:51 +0800 +Subject: tick: Do not set device to detached state in tick_shutdown() + +From: Bibo Mao + +[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ] + +tick_shutdown() sets the state of the clockevent device to detached +first and the invokes clockevents_exchange_device(), which in turn +invokes clockevents_switch_state(). + +But clockevents_switch_state() returns without invoking the device shutdown +callback as the device is already in detached state. As a consequence the +timer device is not shutdown when a CPU goes offline. + +tick_shutdown() does this because it was originally invoked on a online CPU +and not on the outgoing CPU. It therefore could not access the clockevent +device of the already offlined CPU and just set the state. + +Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so +the hardware device can be accessed. + +Remove the state set before calling clockevents_exchange_device(), so that +the subsequent clockevents_switch_state() handles the state transition and +invokes the shutdown callback of the clockevent device. + +[ tglx: Massaged change log ] + +Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING") +Signed-off-by: Bibo Mao +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn +Signed-off-by: Sasha Levin +--- + kernel/time/clockevents.c | 2 +- + kernel/time/tick-common.c | 16 +++++----------- + kernel/time/tick-internal.h | 2 +- + 3 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c +index f3e831f62906f..a59bc75ab7c5b 100644 +--- a/kernel/time/clockevents.c ++++ b/kernel/time/clockevents.c +@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu) + raw_spin_lock(&clockevents_lock); + + tick_broadcast_offline(cpu); +- tick_shutdown(cpu); ++ tick_shutdown(); + + /* + * Unregister the clock event devices which were +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 9a3859443c042..7e33d3f2e889b 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu) + } + + /* +- * Shutdown an event device on a given cpu: ++ * Shutdown an event device on the outgoing CPU: + * +- * This is called on a life CPU, when a CPU is dead. So we cannot +- * access the hardware device itself. +- * We just set the mode and remove it from the lists. ++ * Called by the dying CPU during teardown, with clockevents_lock held ++ * and interrupts disabled. + */ +-void tick_shutdown(unsigned int cpu) ++void tick_shutdown(void) + { +- struct tick_device *td = &per_cpu(tick_cpu_device, cpu); ++ struct tick_device *td = this_cpu_ptr(&tick_cpu_device); + struct clock_event_device *dev = td->evtdev; + + td->mode = TICKDEV_MODE_PERIODIC; + if (dev) { +- /* +- * Prevent that the clock events layer tries to call +- * the set mode function! +- */ +- clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED); + clockevents_exchange_device(dev, NULL); + dev->event_handler = clockevents_handle_noop; + td->evtdev = NULL; +diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h +index faac36de35b9e..4e4f7bbe2a64b 100644 +--- a/kernel/time/tick-internal.h ++++ b/kernel/time/tick-internal.h +@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast); + extern void tick_handle_periodic(struct clock_event_device *dev); + extern void tick_check_new_device(struct clock_event_device *dev); + extern void tick_offline_cpu(unsigned int cpu); +-extern void tick_shutdown(unsigned int cpu); ++extern void tick_shutdown(void); + extern void tick_suspend(void); + extern void tick_resume(void); + extern bool tick_check_replacement(struct clock_event_device *curdev, +-- +2.51.0 + diff --git a/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..2d9fbb0abf --- /dev/null +++ b/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From d35607ef99c26b9d8ef77bcbf37b7d8de669ba93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index ba950f0e73384..2c1ad23b9b5c1 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -29,6 +29,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-6.16/tools-ynl-fix-undefined-variable-name.patch b/queue-6.16/tools-ynl-fix-undefined-variable-name.patch new file mode 100644 index 0000000000..f0baab2c8f --- /dev/null +++ b/queue-6.16/tools-ynl-fix-undefined-variable-name.patch @@ -0,0 +1,48 @@ +From e048876e6207334177f3f23516d80cf096a9f199 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 23:07:47 +0200 +Subject: tools: ynl: fix undefined variable name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthieu Baerts (NGI0) + +[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ] + +This variable used in the error path was not defined according to Ruff. +msg_format.attr_set is used instead, presumably the one that was +supposed to be used originally. + +This is linked to Ruff error F821 [1]: + + An undefined name is likely to raise NameError at runtime. + +Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl") +Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1] +Signed-off-by: Matthieu Baerts (NGI0) +Reviewed-by: Donald Hunter +Reviewed-by: Asbjørn Sloth Tønnesen +Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/pyynl/lib/ynl.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py +index 61deb59230671..7f49573896fd0 100644 +--- a/tools/net/ynl/pyynl/lib/ynl.py ++++ b/tools/net/ynl/pyynl/lib/ynl.py +@@ -731,7 +731,7 @@ class YnlFamily(SpecFamily): + subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set) + decoded.update(subdict) + else: +- raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'") ++ raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'") + return decoded + + def _decode(self, attrs, space, outer_attrs = None): +-- +2.51.0 + diff --git a/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch b/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch new file mode 100644 index 0000000000..0d9acaa95b --- /dev/null +++ b/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch @@ -0,0 +1,82 @@ +From 8e8cbeb90552f9eac6379c7a55609e7f05d9dd63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:26:56 +0300 +Subject: tty: n_gsm: Don't block input queue by waiting MSC + +From: Seppo Takalo + +[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ] + +Currently gsm_queue() processes incoming frames and when opening +a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). +If basic mode is used it calls gsm_modem_upd_via_msc() and it +cannot block the input queue by waiting the response to come +into the same input queue. + +Instead allow sending Modem Status Command without waiting for remote +end to respond. Define a new function gsm_modem_send_initial_msc() +for this purpose. As MSC is only valid for basic encoding, it does +not do anything for advanced or when convergence layer type 2 is used. + +Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") +Signed-off-by: Seppo Takalo +Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 7fc535452c0b3..553d8c70352b1 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); + static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); + static void gsmld_write_trigger(struct gsm_mux *gsm); + static void gsmld_write_task(struct work_struct *work); ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); + + /** + * gsm_fcs_add - update FCS +@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + pr_debug("DLCI %d goes open.\n", dlci->addr); + /* Send current modem state */ + if (dlci->addr) { +- gsm_modem_update(dlci, 0); ++ gsm_modem_send_initial_msc(dlci); + } else { + /* Start keep-alive control */ + gsm->ka_num = 0; +@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) + return gsm_control_wait(dlci->gsm, ctrl); + } + ++/** ++ * gsm_modem_send_initial_msc - Send initial modem status message ++ * ++ * @dlci channel ++ * ++ * Send an initial MSC message after DLCI open to set the initial ++ * modem status lines. This is only done for basic mode. ++ * Does not wait for a response as we cannot block the input queue ++ * processing. ++ */ ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) ++{ ++ u8 modembits[2]; ++ ++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) ++ return 0; ++ ++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ ++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; ++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); ++} ++ + /** + * gsm_modem_update - send modem status line state + * @dlci: channel +-- +2.51.0 + diff --git a/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch b/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch new file mode 100644 index 0000000000..9332776073 --- /dev/null +++ b/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch @@ -0,0 +1,40 @@ +From 7d41eb3ce5c7de94f2ad829fffa2c6c21b78fa75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 22:34:21 -0500 +Subject: uprobes: uprobe_warn should use passed task + +From: Jeremy Linton + +[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ] + +uprobe_warn() is passed a task structure, yet its using current. For +the most part this shouldn't matter, but since a task structure is +provided, lets use it. + +Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances") +Signed-off-by: Jeremy Linton +Reviewed-by: Catalin Marinas +Acked-by: Oleg Nesterov +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index 84ee7b590861a..d0a17f0e5b419 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -121,7 +121,7 @@ struct xol_area { + + static void uprobe_warn(struct task_struct *t, const char *msg) + { +- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg); ++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg); + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..88d3d924cd --- /dev/null +++ b/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From 568aa438a34c1d38b83dc16f3c46a360e1e7bc0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index f94ea196ce547..6bcac85c55501 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..112c0681ad --- /dev/null +++ b/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From d82c9ebea854b3cd22ec08045592e409a88767a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index dcf31a592f5d1..4b5f03f683f77 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch b/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch new file mode 100644 index 0000000000..2dc3a99312 --- /dev/null +++ b/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch @@ -0,0 +1,143 @@ +From 4c3b438d7c30290dba41af9d2a2d8db2a8bf18d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:31:32 +0530 +Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls + +From: Komal Bajaj + +[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ] + +EUD_MODE_MANAGER2 register is mapped to a memory region that is marked +as read-only for operating system running at EL1, enforcing access +restrictions that prohibit direct memory-mapped writes via writel(). + +Attempts to write to this region from HLOS can result in silent failures +or memory access violations, particularly when toggling EUD (Embedded +USB Debugger) state. To ensure secure register access, modify the driver +to use qcom_scm_io_writel(), which routes the write operation to Qualcomm +Secure Channel Monitor (SCM). SCM has the necessary permissions to access +protected memory regions, enabling reliable control over EUD state. + +SC7280, the only user of EUD is also affected, indicating that this could +never have worked on a properly fused device. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Signed-off-by: Melody Olvera +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Souradeep Chowdhury +Signed-off-by: Komal Bajaj +Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/Kconfig | 1 + + drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++--------- + 2 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig +index 6497c4e81e951..9bf8fc6247bac 100644 +--- a/drivers/usb/misc/Kconfig ++++ b/drivers/usb/misc/Kconfig +@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY + config USB_QCOM_EUD + tristate "QCOM Embedded USB Debugger(EUD) Driver" + depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + select USB_ROLE_SWITCH + help + This module enables support for Qualcomm Technologies, Inc. +diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c +index 83079c414b4f2..05c8bdc943a88 100644 +--- a/drivers/usb/misc/qcom_eud.c ++++ b/drivers/usb/misc/qcom_eud.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define EUD_REG_INT1_EN_MASK 0x0024 + #define EUD_REG_INT_STATUS_1 0x0044 +@@ -34,7 +35,7 @@ struct eud_chip { + struct device *dev; + struct usb_role_switch *role_sw; + void __iomem *base; +- void __iomem *mode_mgr; ++ phys_addr_t mode_mgr; + unsigned int int_status; + int irq; + bool enabled; +@@ -43,18 +44,29 @@ struct eud_chip { + + static int enable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); ++ if (ret) ++ return ret; ++ + writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); + writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, + priv->base + EUD_REG_INT1_EN_MASK); +- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); + + return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); + } + +-static void disable_eud(struct eud_chip *priv) ++static int disable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); ++ if (ret) ++ return ret; ++ + writel(0, priv->base + EUD_REG_CSR_EUD_EN); +- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); ++ return 0; + } + + static ssize_t enable_show(struct device *dev, +@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, + chip->enabled = enable; + else + disable_eud(chip); ++ + } else { +- disable_eud(chip); ++ ret = disable_eud(chip); + } + +- return count; ++ return ret < 0 ? ret : count; + } + + static DEVICE_ATTR_RW(enable); +@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) + static int eud_probe(struct platform_device *pdev) + { + struct eud_chip *chip; ++ struct resource *res; + int ret; + + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); +@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) + if (IS_ERR(chip->base)) + return PTR_ERR(chip->base); + +- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(chip->mode_mgr)) +- return PTR_ERR(chip->mode_mgr); ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -ENODEV; ++ chip->mode_mgr = res->start; + + chip->irq = platform_get_irq(pdev, 0); + if (chip->irq < 0) +-- +2.51.0 + diff --git a/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..ed608991d8 --- /dev/null +++ b/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From aa1ee3cfde970a78d7ef13a22b199612493ee918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index 49d79c1257f3a..8c09db750bfd6 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..5da3e52899 --- /dev/null +++ b/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From 4550c8ce503d72368ce63bbcf993bb0c0c51ee10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index e70fba9f55d6a..0d6c10a8490c0 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch b/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch new file mode 100644 index 0000000000..a409ffce5d --- /dev/null +++ b/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch @@ -0,0 +1,42 @@ +From baa4101c732878b92e8d4d79d4bcc304381531be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:41:10 +0200 +Subject: vdso: Add struct __kernel_old_timeval forward declaration to + gettime.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ] + +The prototype of __vdso_gettimeofday() uses this struct. However +gettime.h's own includes do not provide a definition for it. + +Add a forward declaration, similar to other used structs. + +Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de +Signed-off-by: Sasha Levin +--- + include/vdso/gettime.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h +index c50d152e7b3e0..9ac161866653a 100644 +--- a/include/vdso/gettime.h ++++ b/include/vdso/gettime.h +@@ -5,6 +5,7 @@ + #include + + struct __kernel_timespec; ++struct __kernel_old_timeval; + struct timezone; + + #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64) +-- +2.51.0 + diff --git a/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch b/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch new file mode 100644 index 0000000000..daec20e2f7 --- /dev/null +++ b/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch @@ -0,0 +1,59 @@ +From a16ebfb7d2a6e9ad2a383e06ce78ed645617bab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 08:17:04 +0200 +Subject: vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ] + +When the generic vDSO does not provide time functions, as for example on +riscv32, then the time data store is not necessary. + +Avoid allocating these time data pages when not used. + +Fixes: df7fcbefa710 ("vdso: Add generic time data storage") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de +Signed-off-by: Sasha Levin +--- + lib/vdso/datastore.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c +index 3693c6caf2c4d..a565c30c71a04 100644 +--- a/lib/vdso/datastore.c ++++ b/lib/vdso/datastore.c +@@ -11,14 +11,14 @@ + /* + * The vDSO data page. + */ +-#ifdef CONFIG_HAVE_GENERIC_VDSO ++#ifdef CONFIG_GENERIC_GETTIMEOFDAY + static union { + struct vdso_time_data data; + u8 page[PAGE_SIZE]; + } vdso_time_data_store __page_aligned_data; + struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data; + static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE); +-#endif /* CONFIG_HAVE_GENERIC_VDSO */ ++#endif /* CONFIG_GENERIC_GETTIMEOFDAY */ + + #ifdef CONFIG_VDSO_GETRANDOM + static union { +@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm, + + switch (vmf->pgoff) { + case VDSO_TIME_PAGE_OFFSET: +- if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO)) ++ if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY)) + return VM_FAULT_SIGBUS; + pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data)); + if (timens_page) { +-- +2.51.0 + diff --git a/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch b/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch new file mode 100644 index 0000000000..da053df222 --- /dev/null +++ b/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch @@ -0,0 +1,43 @@ +From 243e2837359056017a342c754ad6eaafae370b0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 15:31:54 +0000 +Subject: vfio/pds: replace bitmap_free with vfree + +From: Zilin Guan + +[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ] + +host_seq_bmp is allocated with vzalloc but is currently freed with +bitmap_free, which uses kfree internally. This mismach prevents the +resource from being released properly and may result in memory leaks +or other issues. + +Fix this by freeing host_seq_bmp with vfree to match the vzalloc +allocation. + +Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") +Signed-off-by: Zilin Guan +Reviewed-by: Brett Creeley +Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/dirty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c +index c51f5e4c3dd6d..481992142f790 100644 +--- a/drivers/vfio/pci/pds/dirty.c ++++ b/drivers/vfio/pci/pds/dirty.c +@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region, + + host_ack_bmp = vzalloc(bytes); + if (!host_ack_bmp) { +- bitmap_free(host_seq_bmp); ++ vfree(host_seq_bmp); + return -ENOMEM; + } + +-- +2.51.0 + diff --git a/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..142049cd94 --- /dev/null +++ b/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,53 @@ +From dcfbda4e9e02b9f0bbcb355f60fbfe53ef2f36be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:04:08 -0400 +Subject: vhost: vringh: Fix copy_to_iter return value check + +From: Michael S. Tsirkin + +[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ] + +The return value of copy_to_iter can't be negative, check whether the +copied length is equal to the requested length instead of checking for +negative values. + +Cc: zhang jiao +Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Simon Horman +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index bbce654527013..e547bdc21940b 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1236,6 +1236,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1253,9 +1254,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.16/vhost-vringh-modify-the-return-value-check.patch b/queue-6.16/vhost-vringh-modify-the-return-value-check.patch new file mode 100644 index 0000000000..035ff79f09 --- /dev/null +++ b/queue-6.16/vhost-vringh-modify-the-return-value-check.patch @@ -0,0 +1,50 @@ +From 8477c47a7bacd7db420d93f6db22d3711aa9d609 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:17:38 +0800 +Subject: vhost: vringh: Modify the return value check + +From: zhang jiao + +[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ] + +The return value of copy_from_iter and copy_to_iter can't be negative, +check whether the copied lengths are equal. + +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Cc: "Stefano Garzarella" +Signed-off-by: zhang jiao +Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index e547bdc21940b..1e7c5e25860b7 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1190,6 +1190,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1207,9 +1208,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch b/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch new file mode 100644 index 0000000000..79ac32b7c5 --- /dev/null +++ b/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch @@ -0,0 +1,80 @@ +From e5c2e55b680380f9a80cc1c42f2ef97741807a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Aug 2025 07:48:17 -0700 +Subject: watchdog: intel_oc_wdt: Do not try to write into const memory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ] + +The code tries to update the intel_oc_wdt_info data structure if the +watchdog is locked. That data structure is marked as const and can not +be written into. Copy it into struct intel_oc_wdt and modify it there +to fix the problem. + +Reported-by: Petar Kulić +Cc: Diogo Ivo +Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT") +Signed-off-by: Guenter Roeck +Reviewed-by: Diogo Ivo +Tested-by: Diogo Ivo +Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/intel_oc_wdt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c +index 7c0551106981b..a39892c10770e 100644 +--- a/drivers/watchdog/intel_oc_wdt.c ++++ b/drivers/watchdog/intel_oc_wdt.c +@@ -41,6 +41,7 @@ + struct intel_oc_wdt { + struct watchdog_device wdd; + struct resource *ctrl_res; ++ struct watchdog_info info; + bool locked; + }; + +@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = { + + static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + { +- struct watchdog_info *info; + unsigned long val; + + val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt)); +@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status); + + if (oc_wdt->locked) { +- info = (struct watchdog_info *)&intel_oc_wdt_info; + /* + * Set nowayout unconditionally as we cannot stop + * the watchdog. +@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + * and inform the core we can't change it. + */ + oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1; +- info->options &= ~WDIOF_SETTIMEOUT; ++ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT; + + dev_info(oc_wdt->wdd.parent, + "Register access locked, heartbeat fixed at: %u s\n", +@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev) + wdd->min_timeout = INTEL_OC_WDT_MIN_TOV; + wdd->max_timeout = INTEL_OC_WDT_MAX_TOV; + wdd->timeout = INTEL_OC_WDT_DEF_TOV; +- wdd->info = &intel_oc_wdt_info; ++ oc_wdt->info = intel_oc_wdt_info; ++ wdd->info = &oc_wdt->info; + wdd->ops = &intel_oc_wdt_ops; + wdd->parent = dev; + +-- +2.51.0 + diff --git a/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..9ffb0934c5 --- /dev/null +++ b/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 709fc8103c0fafe1b25076ebf63b1fe447dfd060 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 867f9f3113797..a4b497ecfa205 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..0861a57f6e --- /dev/null +++ b/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From 05f1efa98556cbf018127cc0f08147dfacca9c93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index cb8ae751eb312..e595b0979a56d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch b/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch new file mode 100644 index 0000000000..ce24f13c78 --- /dev/null +++ b/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch @@ -0,0 +1,88 @@ +From 4d25d86128a4a5f84a33aadcb27d0242287df7f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 00:36:51 +0530 +Subject: wifi: ath12k: Add fallback for invalid channel number in PHY metadata + +From: Sriram R + +[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ] + +Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency +based on the channel number and center frequency from the RX descriptor's +PHY metadata. However, in rare cases, it is observed that frequency +retrieved from the metadata may be invalid or unexpected especially for +6 GHz frames. +This can result in a NULL sband, which prevents proper frequency assignment +in rx_status and potentially leading to incorrect RX packet classification. + +To fix this potential issue, add a fallback mechanism that uses +ar->rx_channel to populate the band and frequency when the derived +sband is invalid or missing. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Sriram R +Co-developed-by: Vinith Kumar R +Signed-off-by: Vinith Kumar R +Signed-off-by: Aishwarya R +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index e9137ffeb5ab4..5a57290927f19 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2504,6 +2504,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info) + channel_num = meta_data; + center_freq = meta_data >> 16; + ++ rx_status->band = NUM_NL80211_BANDS; ++ + if (center_freq >= ATH12K_MIN_6GHZ_FREQ && + center_freq <= ATH12K_MAX_6GHZ_FREQ) { + rx_status->band = NL80211_BAND_6GHZ; +@@ -2512,21 +2514,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info) + rx_status->band = NL80211_BAND_2GHZ; + } else if (channel_num >= 36 && channel_num <= 173) { + rx_status->band = NL80211_BAND_5GHZ; +- } else { ++ } ++ ++ if (unlikely(rx_status->band == NUM_NL80211_BANDS || ++ !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) { ++ ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n", ++ rx_status->band, channel_num, center_freq, ar->pdev_idx); ++ + spin_lock_bh(&ar->data_lock); + channel = ar->rx_channel; + if (channel) { + rx_status->band = channel->band; + channel_num = + ieee80211_frequency_to_channel(channel->center_freq); ++ rx_status->freq = ieee80211_channel_to_frequency(channel_num, ++ rx_status->band); ++ } else { ++ ath12k_err(ar->ab, "unable to determine channel, band for rx packet"); + } + spin_unlock_bh(&ar->data_lock); ++ goto h_rate; + } + + if (rx_status->band != NL80211_BAND_6GHZ) + rx_status->freq = ieee80211_channel_to_frequency(channel_num, + rx_status->band); + ++h_rate: + ath12k_dp_rx_h_rate(ar, rx_info); + } + +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch b/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch new file mode 100644 index 0000000000..cf8383447a --- /dev/null +++ b/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch @@ -0,0 +1,103 @@ +From 4d55c533f1e7e85be8e40f1e80dc85d585edaa6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 17:59:33 +0800 +Subject: wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode + +From: Kang Yang + +[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ] + +Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with +struct hal_phyrx_common_user_info. + +Obviously, they do not match. The original intention here was to parse +HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing +HAL_PHYRX_COMMON_USER_INFO instead. + +Also add LTF parsing and report to radiotap along with GI. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support") +Signed-off-by: Kang Yang +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++---- + drivers/net/wireless/ath/ath12k/hal_rx.h | 3 +- + 2 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index 6a0915a0c7aae..559cbb1ae20f2 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap) + *errmap |= HAL_RX_MPDU_ERR_MPDU_LEN; + } + ++static void ++ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info, ++ struct hal_rx_mon_ppdu_info *ppdu_info) ++{ ++ struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht; ++ u32 known, data, cp_setting, ltf_size; ++ ++ known = __le32_to_cpu(eht->known); ++ known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI | ++ IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF; ++ eht->known = cpu_to_le32(known); ++ ++ cp_setting = le32_get_bits(cmn_usr_info->info0, ++ HAL_RX_CMN_USR_INFO0_CP_SETTING); ++ ltf_size = le32_get_bits(cmn_usr_info->info0, ++ HAL_RX_CMN_USR_INFO0_LTF_SIZE); ++ ++ data = __le32_to_cpu(eht->data[0]); ++ data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI); ++ data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF); ++ eht->data[0] = cpu_to_le32(data); ++ ++ if (!ppdu_info->ltf_size) ++ ppdu_info->ltf_size = ltf_size; ++ if (!ppdu_info->gi) ++ ppdu_info->gi = cp_setting; ++} ++ + static void + ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon, + const struct hal_rx_msdu_end *msdu_end) +@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar, + HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW); + break; + } +- case HAL_PHYRX_OTHER_RECEIVE_INFO: { +- const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data; +- +- ppdu_info->gi = le32_get_bits(cmn_usr_info->info0, +- HAL_RX_PHY_CMN_USER_INFO0_GI); ++ case HAL_PHYRX_COMMON_USER_INFO: { ++ ath12k_parse_cmn_usr_info(tlv_data, ppdu_info); + break; + } + case HAL_RX_PPDU_START_USER_INFO: +diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h +index a3ab588aae19d..801a5f6d3458b 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_rx.h ++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h +@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info { + #define HAL_RX_MPDU_ERR_MPDU_LEN BIT(6) + #define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME BIT(7) + +-#define HAL_RX_PHY_CMN_USER_INFO0_GI GENMASK(17, 16) ++#define HAL_RX_CMN_USR_INFO0_CP_SETTING GENMASK(17, 16) ++#define HAL_RX_CMN_USR_INFO0_LTF_SIZE GENMASK(19, 18) + + struct hal_phyrx_common_user_info { + __le32 rsvd[2]; +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch b/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch new file mode 100644 index 0000000000..acade1f1a7 --- /dev/null +++ b/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch @@ -0,0 +1,89 @@ +From d10032d9db337715ca7d12e65e66a340b5a58302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 11:03:11 +0800 +Subject: wifi: ath12k: fix overflow warning on num_pwr_levels + +From: Baochen Qiang + +[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ] + +In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is +limited by ATH12K_NUM_PWR_LEVELS which is 16: + + if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) + tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; + +Then it is used to iterate entries in local_non_psd->power[] and +reg_non_psd->power[]: + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_non_psd->power[i], + reg_non_psd->power[i]) / 2; + +Since the two array are of size 5, Smatch warns: + +drivers/net/wireless/ath/ath12k/mac.c:9812 +ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15 +drivers/net/wireless/ath/ath12k/mac.c:9812 +ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15 + +This is a false positive as there is already implicit limitation: + + tpc_info->num_pwr_levels = max(local_non_psd->count, + reg_non_psd->count); + +meaning it won't exceed 5. + +However, to make robot happy, add explicit limit there. + +Also add the same to the PSD case, although no warning due to +ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 + +Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/ +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 708dc3dd4347a..4f66f79091e37 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -10609,8 +10609,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar, + + tpc_info->num_pwr_levels = max(local_psd->count, + reg_psd->count); +- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) +- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; ++ tpc_info->num_pwr_levels = ++ min3(tpc_info->num_pwr_levels, ++ IEEE80211_TPE_PSD_ENTRIES_320MHZ, ++ ATH12K_NUM_PWR_LEVELS); + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_psd->power[i], +@@ -10625,8 +10627,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar, + + tpc_info->num_pwr_levels = max(local_non_psd->count, + reg_non_psd->count); +- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) +- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; ++ tpc_info->num_pwr_levels = ++ min3(tpc_info->num_pwr_levels, ++ IEEE80211_TPE_EIRP_ENTRIES_320MHZ, ++ ATH12K_NUM_PWR_LEVELS); + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_non_psd->power[i], +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch b/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch new file mode 100644 index 0000000000..9fff3c3e70 --- /dev/null +++ b/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch @@ -0,0 +1,79 @@ +From 059be386de6ad215d84ed0dcac69bb3c48d15fc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 09:35:52 +0530 +Subject: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() + +From: Hari Chandrakanthan + +[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ] + +In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because +rxcb->peer_id is not updated with a valid value. This is expected +in monitor mode, where RX frames bypass the regular RX +descriptor path that typically sets rxcb->peer_id. +As a result, the peer is NULL, and link_id and link_valid fields +in the RX status are not populated. This leads to a WARN_ON in +mac80211 when it receives data frame from an associated station +with invalid link_id. + +Fix this potential issue by using ppduinfo->peer_id, which holds +the correct peer id for the received frame. This ensures that the +peer is correctly found and the associated link metadata is updated +accordingly. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info") +Signed-off-by: Hari Chandrakanthan +Signed-off-by: Aishwarya R +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index 3be6bcd2a3d92..212a30fb9824a 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -2264,6 +2264,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar, + + static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi, + struct sk_buff *msdu, ++ const struct hal_rx_mon_ppdu_info *ppduinfo, + struct ieee80211_rx_status *status, + u8 decap) + { +@@ -2277,7 +2278,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct + struct ieee80211_sta *pubsta = NULL; + struct ath12k_peer *peer; + struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu); +- struct ath12k_dp_rx_info rx_info; + bool is_mcbc = rxcb->is_mcbc; + bool is_eapol_tkip = rxcb->is_eapol; + +@@ -2291,8 +2291,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct + } + + spin_lock_bh(&ar->ab->base_lock); +- rx_info.addr2_present = false; +- peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info); ++ peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id); + if (peer && peer->sta) { + pubsta = peer->sta; + if (pubsta->valid_links) { +@@ -2385,7 +2384,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar, + decap = mon_mpdu->decap_format; + + ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs); +- ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap); ++ ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap); + mon_skb = skb_next; + } while (mon_skb); + rxs->flag = 0; +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch b/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch new file mode 100644 index 0000000000..9952041345 --- /dev/null +++ b/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch @@ -0,0 +1,92 @@ +From aca18bde882da33dc9bcc249e5608434b4dfffce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 17:59:34 +0800 +Subject: wifi: ath12k: fix the fetching of combined rssi + +From: Kang Yang + +[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ] + +Currently, host fetches combined rssi from rssi_comb in struct +hal_rx_phyrx_rssi_legacy_info. + +rssi_comb is 8th to 15th bits of the second to last variable. +rssi_comb_ppdu is the 0th to 7th of the last variable. + +When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth > +20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power +of primary 20 MHz while rssi_comb_ppdu includes power of active +RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu. + +Also related macro definitions are too long, rename them. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Kang Yang +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++---- + drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++---- + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index 559cbb1ae20f2..3be6bcd2a3d92 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar, + const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data; + + info[0] = __le32_to_cpu(rssi->info0); +- info[1] = __le32_to_cpu(rssi->info1); ++ info[2] = __le32_to_cpu(rssi->info2); + + /* TODO: Please note that the combined rssi will not be accurate + * in MU case. Rssi in MU needs to be retrieved from + * PHYRX_OTHER_RECEIVE_INFO TLV. + */ + ppdu_info->rssi_comb = +- u32_get_bits(info[1], +- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB); ++ u32_get_bits(info[2], ++ HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU); + + ppdu_info->bw = u32_get_bits(info[0], +- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW); ++ HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW); + break; + } + case HAL_PHYRX_COMMON_USER_INFO: { +diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h +index 801a5f6d3458b..d1ad7747b82c4 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_rx.h ++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h +@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type { + HAL_RECEPTION_TYPE_FRAMELESS + }; + +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0) +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5) +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU GENMASK(7, 0) + + struct hal_rx_phyrx_rssi_legacy_info { + __le32 info0; + __le32 rsvd0[39]; + __le32 info1; +- __le32 rsvd1; ++ __le32 info2; + } __packed; + + #define HAL_RX_MPDU_START_INFO0_PPDU_ID GENMASK(31, 16) +-- +2.51.0 + diff --git a/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch b/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch new file mode 100644 index 0000000000..026b668d72 --- /dev/null +++ b/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch @@ -0,0 +1,53 @@ +From f098bf4770187cb653a9193899b447aa6adb7b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 09:44:57 +0800 +Subject: wifi: ath12k: fix wrong logging ID used for CE + +From: Baochen Qiang + +[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ] + +ATH12K_DBG_AHB is used for CE logging which is not proper. Add +ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it. + +Compile tested only. + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/ce.c | 2 +- + drivers/net/wireless/ath/ath12k/debug.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c +index f7c15b547504d..139365cbf89de 100644 +--- a/drivers/net/wireless/ath/ath12k/ce.c ++++ b/drivers/net/wireless/ath/ath12k/ce.c +@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe) + } + + while ((skb = __skb_dequeue(&list))) { +- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n", ++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n", + pipe->pipe_num, skb->len); + pipe->recv_cb(ab, skb); + } +diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h +index 48916e4e1f601..bf254e43a68d0 100644 +--- a/drivers/net/wireless/ath/ath12k/debug.h ++++ b/drivers/net/wireless/ath/ath12k/debug.h +@@ -26,6 +26,7 @@ enum ath12k_debug_mask { + ATH12K_DBG_DP_TX = 0x00002000, + ATH12K_DBG_DP_RX = 0x00004000, + ATH12K_DBG_WOW = 0x00008000, ++ ATH12K_DBG_CE = 0x00010000, + ATH12K_DBG_ANY = 0xffffffff, + }; + +-- +2.51.0 + diff --git a/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch b/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch new file mode 100644 index 0000000000..ac2c91f133 --- /dev/null +++ b/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch @@ -0,0 +1,37 @@ +From 580faf44cb1c538467bd0fa8d23936ef289a878b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 22:19:08 +0000 +Subject: wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() + +From: Ryder Lee + +[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ] + +The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz. +However, the expected unit is KHz. + +Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio") +Signed-off-by: Ryder Lee +Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/ +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 1ad5a6bdfd755..c1c4d32a8efcf 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -2956,7 +2956,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio, + u32 freq, width; + + freq = ieee80211_chandef_to_khz(chandef); +- width = cfg80211_chandef_get_width(chandef); ++ width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef)); + if (!ieee80211_radio_freq_range_valid(radio, freq, width)) + return false; + +-- +2.51.0 + diff --git a/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch b/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch new file mode 100644 index 0000000000..cccfcd7f16 --- /dev/null +++ b/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch @@ -0,0 +1,36 @@ +From 5f79a6878a4e04bac01d4c6accea8f02d359fc4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 20:11:51 +0800 +Subject: wifi: iwlwifi: Remove redundant header files + +From: Liao Yuanhong + +[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ] + +The header file "fw/img.h" is already included on line 9. Remove the +redundant include. + +Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") +Signed-off-by: Liao Yuanhong +Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com +Signed-off-by: Miri Korenblit +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +index 9bed3d573b1ef..c676e0d14f310 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +@@ -12,7 +12,6 @@ + #include "fw/api/phy.h" + #include "fw/api/config.h" + #include "fw/api/nvm-reg.h" +-#include "fw/img.h" + #include "iwl-trans.h" + + #define BIOS_SAR_MAX_PROFILE_NUM 4 +-- +2.51.0 + diff --git a/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch new file mode 100644 index 0000000000..82219c9da9 --- /dev/null +++ b/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch @@ -0,0 +1,87 @@ +From 918d624e19d0ff62f8fff8cdee50574cea50f1f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 12:42:03 +0530 +Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not + available + +From: Aditya Kumar Singh + +[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ] + +In ieee80211_rx_handle_packet(), if the caller does not provide pubsta +information, an attempt is made to find the station using the address 2 +(source address) field in the header. Since pubsta is missing, link +information such as link_valid and link_id is also unavailable. Now if such +a situation comes, and if a matching ML station entry is found based on +the source address, currently the packet is dropped due to missing link ID +in the status field which is not correct. + +Hence, to fix this issue, if link_valid is not set and the station is an +ML station, make an attempt to find a link station entry using the source +address. If a valid link station is found, derive the link ID and proceed +with packet processing. Otherwise, drop the packet as per the existing +flow. + +Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") +Suggested-by: Vasanthakumar Thiagarajan +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 7b801dd3f569a..ad6776069ded0 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5210,12 +5210,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5223,10 +5231,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..a437474fd3 --- /dev/null +++ b/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From 872efdd9e868ab90b2d5bf8ee4ed7563ec13a90d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index 08590aa68356f..1dd3723720480 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch b/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch new file mode 100644 index 0000000000..c8900f5f2f --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch @@ -0,0 +1,132 @@ +From 678a5c64698638e1b40a60eac9439eca73baa741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 14:48:24 +0800 +Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration + +From: Zhi-Jun You + +[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ] + +In vendor driver, size of group cal and dpd cal for mt7981 includes 6G +although the chip doesn't support it. + +mt76 doesn't take this into account which results in reading from the +incorrect offset. + +For devices with precal, this would lead to lower bitrate. + +Fix this by aligning groupcal size with vendor driver and switch to +freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset. + +Below are iwinfo of the test device with two clients connected +(iPhone 16, Intel AX210). +Before : + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 612.4 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +After: + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 900.6 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +Tested-on: mt7981 20240823 + +Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration") +Signed-off-by: Zhi-Jun You +Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++-- + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++-------------- + 2 files changed, 10 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +index 31aec0f40232a..73611c9d26e15 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +@@ -50,9 +50,9 @@ enum mt7915_eeprom_field { + #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16) ++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT) + #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT) +-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */ + + #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0) + #define MT_EE_WIFI_CONF0_RX_PATH GENMASK(5, 3) +@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev) + val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val); + return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G : + MT_EE_CAL_GROUP_SIZE_7916; ++ } else if (is_mt7981(&dev->mt76)) { ++ return MT_EE_CAL_GROUP_SIZE_7981; + } else if (mt7915_check_adie(dev, false)) { + return MT_EE_CAL_GROUP_SIZE_7976; + } else { +@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev) + { + if (is_mt7915(&dev->mt76)) + return MT_EE_CAL_DPD_SIZE_V1; +- else if (is_mt7981(&dev->mt76)) +- return MT_EE_CAL_DPD_SIZE_V2_7981; + else + return MT_EE_CAL_DPD_SIZE_V2; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index c1cfdbc2fe848..9689a49020a4b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -3050,30 +3050,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw) + /* 5G BW160 */ + 5250, 5570, 5815 + }; +- static const u16 freq_list_v2_7981[] = { +- /* 5G BW20 */ +- 5180, 5200, 5220, 5240, +- 5260, 5280, 5300, 5320, +- 5500, 5520, 5540, 5560, +- 5580, 5600, 5620, 5640, +- 5660, 5680, 5700, 5720, +- 5745, 5765, 5785, 5805, +- 5825, 5845, 5865, 5885, +- /* 5G BW160 */ +- 5250, 5570, 5815 +- }; +- const u16 *freq_list = freq_list_v1; +- int n_freqs = ARRAY_SIZE(freq_list_v1); +- int idx; ++ const u16 *freq_list; ++ int idx, n_freqs; + + if (!is_mt7915(&dev->mt76)) { +- if (is_mt7981(&dev->mt76)) { +- freq_list = freq_list_v2_7981; +- n_freqs = ARRAY_SIZE(freq_list_v2_7981); +- } else { +- freq_list = freq_list_v2; +- n_freqs = ARRAY_SIZE(freq_list_v2); +- } ++ freq_list = freq_list_v2; ++ n_freqs = ARRAY_SIZE(freq_list_v2); ++ } else { ++ freq_list = freq_list_v1; ++ n_freqs = ARRAY_SIZE(freq_list_v1); + } + + if (freq < 4000) { +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch b/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch new file mode 100644 index 0000000000..22d95892bb --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch @@ -0,0 +1,95 @@ +From 5218384a4fcd4d61dbd461795def49dce093a12f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:19 +0200 +Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE + +From: Lorenzo Bianconi + +[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ] + +Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not +break endianness + +Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++--- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------ + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index be729db5b75c1..84015ab24af62 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev) + static int mt7996_wed_rro_init(struct mt7996_dev *dev) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mtk_wed_device *wed = &dev->mt76.mmio.wed; + u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0; + struct mt7996_wed_rro_addr *addr; +@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + + addr = dev->wed_rro.addr_elem[i].ptr; + for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + dev->wed_rro.session.ptr = ptr; + addr = dev->wed_rro.session.ptr; + for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev) + static void mt7996_wed_rro_work(struct work_struct *work) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mt7996_dev *dev; + LIST_HEAD(list); + +@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work) + MT7996_RRO_WINDOW_MAX_LEN; + reset: + elem = ptr + elem_id * sizeof(*elem); +- elem->signature = 0xff; ++ elem->data |= cpu_to_le32(val); + } + mt7996_mcu_wed_rro_reset_sessions(dev, e->id); + out: +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index b98cfe6e5be8c..048d9a9898c6e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -277,13 +277,12 @@ struct mt7996_hif { + int irq; + }; + ++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24) ++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4) ++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0) + struct mt7996_wed_rro_addr { +- u32 head_low; +- u32 head_high : 4; +- u32 count: 11; +- u32 oor: 1; +- u32 rsv : 8; +- u32 signature : 8; ++ __le32 head_low; ++ __le32 data; + }; + + struct mt7996_wed_rro_session_id { +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch new file mode 100644 index 0000000000..723dc3b4b0 --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch @@ -0,0 +1,215 @@ +From 26e84f3f887edd048259df1a4cef8185410b87bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 10:26:19 +0200 +Subject: wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine + +From: Lorenzo Bianconi + +[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ] + +Update mt7996_mcu_bss_mld_tlv routine to properly support MLO +configuring the BSS. + +Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/main.c | 46 ++++++++++++++++++- + .../net/wireless/mediatek/mt76/mt7996/mcu.c | 26 ++++++++--- + .../net/wireless/mediatek/mt76/mt7996/mcu.h | 3 +- + .../wireless/mediatek/mt76/mt7996/mt7996.h | 8 ++++ + 4 files changed, 75 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index cb522153113ce..1394155a68ce7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask) + return -1; + } + ++static int get_own_mld_idx(u64 mask, bool group_mld) ++{ ++ u8 start = group_mld ? 0 : 16; ++ u8 end = group_mld ? 15 : 63; ++ int idx; ++ ++ idx = get_free_idx(mask, start, end); ++ if (idx) ++ return idx - 1; ++ ++ /* If the 16-63 range is not available, perform another lookup in the ++ * range 0-15 ++ */ ++ if (!group_mld) { ++ idx = get_free_idx(mask, 0, 15); ++ if (idx) ++ return idx - 1; ++ } ++ ++ return -EINVAL; ++} ++ + static void + mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink) + { +@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + struct mt7996_dev *dev = phy->dev; + u8 band_idx = phy->mt76->band_idx; + struct mt76_txq *mtxq; +- int idx, ret; ++ int mld_idx, idx, ret; + + mlink->idx = __ffs64(~dev->mt76.vif_mask); + if (mlink->idx >= mt7996_max_interface_num(dev)) +@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + if (idx < 0) + return -ENOSPC; + ++ if (!dev->mld_idx_mask) { /* first link in the group */ ++ mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true); ++ mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask, ++ 0, 15); ++ } ++ ++ mld_idx = get_own_mld_idx(dev->mld_idx_mask, false); ++ if (mld_idx < 0) ++ return -ENOSPC; ++ ++ link->mld_idx = mld_idx; + link->phy = phy; + mlink->omac_idx = idx; + mlink->band_idx = band_idx; +@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + return ret; + + dev->mt76.vif_mask |= BIT_ULL(mlink->idx); ++ if (!dev->mld_idx_mask) { ++ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx); ++ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx); ++ } ++ dev->mld_idx_mask |= BIT_ULL(link->mld_idx); + phy->omac_mask |= BIT_ULL(mlink->omac_idx); + + idx = MT7996_WTBL_RESERVED - mlink->idx; +@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif, + } + + dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx); ++ dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx); + phy->omac_mask &= ~BIT_ULL(mlink->omac_idx); ++ if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) { ++ /* last link */ ++ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx); ++ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx); ++ } + + spin_lock_bh(&dev->mt76.sta_poll_lock); + if (!list_empty(&msta_link->wcid.poll_list)) +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index d422b65737966..14373b2285438 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en) + } + + static void +-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink) ++mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, ++ struct ieee80211_bss_conf *link_conf, ++ struct mt7996_vif_link *link) + { ++ struct ieee80211_vif *vif = link_conf->vif; ++ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; + struct bss_mld_tlv *mld; + struct tlv *tlv; + + tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld)); +- + mld = (struct bss_mld_tlv *)tlv; +- mld->group_mld_id = 0xff; +- mld->own_mld_id = mlink->idx; +- mld->remap_idx = 0xff; ++ mld->own_mld_id = link->mld_idx; ++ mld->link_id = link_conf->link_id; ++ ++ if (ieee80211_vif_is_mld(vif)) { ++ mld->group_mld_id = mvif->mld_group_idx; ++ mld->remap_idx = mvif->mld_remap_idx; ++ memcpy(mld->mac_addr, vif->addr, ETH_ALEN); ++ } else { ++ mld->group_mld_id = 0xff; ++ mld->remap_idx = 0xff; ++ } + } + + static void +@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif, + goto out; + + if (enable) { ++ struct mt7996_vif_link *link; ++ + mt7996_mcu_bss_rfch_tlv(skb, phy); + mt7996_mcu_bss_bmc_tlv(skb, mlink, phy); + mt7996_mcu_bss_ra_tlv(skb, phy); +@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif, + mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy); + + /* this tag is necessary no matter if the vif is MLD */ +- mt7996_mcu_bss_mld_tlv(skb, mlink); ++ link = container_of(mlink, struct mt7996_vif_link, mt76); ++ mt7996_mcu_bss_mld_tlv(skb, link_conf, link); + } + + mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h +index 130ea95626d5b..7b21d6ae7e435 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h +@@ -481,7 +481,8 @@ struct bss_mld_tlv { + u8 own_mld_id; + u8 mac_addr[ETH_ALEN]; + u8 remap_idx; +- u8 __rsv[3]; ++ u8 link_id; ++ u8 __rsv[2]; + } __packed; + + struct sta_rec_ht_uni { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index bbd4679edc9d3..b98cfe6e5be8c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -248,11 +248,16 @@ struct mt7996_vif_link { + + struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS]; + struct cfg80211_bitrate_mask bitrate_mask; ++ ++ u8 mld_idx; + }; + + struct mt7996_vif { + struct mt7996_vif_link deflink; /* must be first */ + struct mt76_vif_data mt76; ++ ++ u8 mld_group_idx; ++ u8 mld_remap_idx; + }; + + /* crash-dump */ +@@ -337,6 +342,9 @@ struct mt7996_dev { + u32 q_int_mask[MT7996_MAX_QUEUE]; + u32 q_wfdma_mask; + ++ u64 mld_idx_mask; ++ u64 mld_remap_idx_mask; ++ + const struct mt76_bus_ops *bus_ops; + struct mt7996_phy phy; + +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch new file mode 100644 index 0000000000..3de5b34f44 --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch @@ -0,0 +1,96 @@ +From 8c1a3da9cfc578ba8f1a0f29ee4c07f8fc3cbfbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 09:12:05 +0200 +Subject: wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration + +From: Lorenzo Bianconi + +[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ] + +Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly +support MLO scenario. + +Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++-- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 12 +++++++----- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 ++- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index f6590ef85c0d0..cb522153113ce 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -1321,11 +1321,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + case IEEE80211_AMPDU_RX_START: + mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid, + ssn, params->buf_size); +- ret = mt7996_mcu_add_rx_ba(dev, params, link, true); ++ ret = mt7996_mcu_add_rx_ba(dev, params, link, ++ msta_link, true); + break; + case IEEE80211_AMPDU_RX_STOP: + mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid); +- ret = mt7996_mcu_add_rx_ba(dev, params, link, false); ++ ret = mt7996_mcu_add_rx_ba(dev, params, link, ++ msta_link, false); + break; + case IEEE80211_AMPDU_TX_OPERATIONAL: + mtxq->aggr = true; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index a808218da394c..d422b65737966 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif, + static int + mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif, + struct ieee80211_ampdu_params *params, +- bool enable, bool tx) ++ struct mt76_wcid *wcid, bool enable, bool tx) + { +- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv; + struct sta_rec_ba_uni *ba; + struct sk_buff *skb; + struct tlv *tlv; +@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev, + if (enable && !params->amsdu) + msta_link->wcid.amsdu = false; + +- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true); ++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid, ++ enable, true); + } + + int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev, + struct ieee80211_ampdu_params *params, +- struct mt7996_vif_link *link, bool enable) ++ struct mt7996_vif_link *link, ++ struct mt7996_sta_link *msta_link, bool enable) + { +- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false); ++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid, ++ enable, false); + } + + static void +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index 8509d508e1e19..bbd4679edc9d3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev, + struct mt7996_sta_link *msta_link, bool enable); + int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev, + struct ieee80211_ampdu_params *params, +- struct mt7996_vif_link *link, bool enable); ++ struct mt7996_vif_link *link, ++ struct mt7996_sta_link *msta_link, bool enable); + int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, + struct mt76_vif_link *mlink, + struct cfg80211_he_bss_color *he_bss_color); +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch b/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch new file mode 100644 index 0000000000..3427664adb --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch @@ -0,0 +1,46 @@ +From ff2cc0a148f52e4dad2f746836e44332776873c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:17 +0200 +Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED + device + +From: Lorenzo Bianconi + +[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ] + +In order to properly set the number of rx packets for primary WED device +if hif device is available, move hif pointer initialization before +running mt7996_mmio_wed_init routine. + +Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +index 19e99bc1c6c41..f5ce50056ee94 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + mdev = &dev->mt76; + mt7996_wfsys_reset(dev); + hif2 = mt7996_pci_init_hif2(pdev); ++ dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, pdev, false, &irq); + if (ret < 0) +@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + + if (hif2) { + hif2_dev = container_of(hif2->dev, struct pci_dev, dev); +- dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch b/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch new file mode 100644 index 0000000000..2609dd13fe --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch @@ -0,0 +1,63 @@ +From 04ea838323eed6cb17e6a5d442d87d692cb2e29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:16 +0200 +Subject: wifi: mt76: mt7996: Fix tx-queues initialization for second phy on + mt7996 + +From: Lorenzo Bianconi + +[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ] + +Fix the second phy tx queue initialization if hif device is not +available for MT7990 chipset. + +Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") +Co-developed-by: Sujuan Chen +Signed-off-by: Sujuan Chen +Co-developed-by: Benjamin Lin +Signed-off-by: Benjamin Lin +Co-developed-by: Rex Lu +Signed-off-by: Rex Lu +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/init.c | 21 ++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index a9599c286328e..be729db5b75c1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band) + + /* init wiphy according to mphy and phy */ + mt7996_init_wiphy_band(mphy->hw, phy); +- ret = mt7996_init_tx_queues(mphy->priv, +- MT_TXQ_ID(band), +- MT7996_TX_RING_SIZE, +- MT_TXQ_RING_BASE(band) + hif1_ofs, +- wed); +- if (ret) +- goto error; ++ ++ if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) { ++ int i; ++ ++ for (i = 0; i <= MT_TXQ_PSD; i++) ++ mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0]; ++ } else { ++ ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band), ++ MT7996_TX_RING_SIZE, ++ MT_TXQ_RING_BASE(band) + hif1_ofs, ++ wed); ++ if (ret) ++ goto error; ++ } + + ret = mt76_register_phy(mphy, true, mt76_rates, + ARRAY_SIZE(mt76_rates)); +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch b/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch new file mode 100644 index 0000000000..de6a3015c6 --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch @@ -0,0 +1,275 @@ +From 8f0387f05c3f1afa599db49758065ce18482ceaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:58:56 +0200 +Subject: wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during + restart + +From: Felix Fietkau + +[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ] + +There is only one wiphy, so extra calls must be removed. +For calls that need to remain per-wiphy, use mt7996_for_each_phy + +Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") +Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mac.c | 137 +++++------------- + 1 file changed, 35 insertions(+), 102 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index a7a5ac8b7d265..e276cd1dc0cee 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev) + static int + mt7996_mac_restart(struct mt7996_dev *dev) + { +- struct mt7996_phy *phy2, *phy3; + struct mt76_dev *mdev = &dev->mt76; ++ struct mt7996_phy *phy; + int i, ret; + +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); +- + if (dev->hif2) { + mt76_wr(dev, MT_INT1_MASK_CSR, 0x0); + mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0); +@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev) + mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0); + } + +- set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); ++ mt7996_for_each_phy(dev, phy) ++ set_bit(MT76_RESET, &phy->mt76->state); + wake_up(&dev->mt76.mcu.wait); +- if (phy2) +- set_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- set_bit(MT76_RESET, &phy3->mt76->state); + + /* lock/unlock all queues to ensure that no tx is pending */ +- mt76_txq_schedule_all(&dev->mphy); +- if (phy2) +- mt76_txq_schedule_all(phy2->mt76); +- if (phy3) +- mt76_txq_schedule_all(phy3->mt76); ++ mt7996_for_each_phy(dev, phy) ++ mt76_txq_schedule_all(phy->mt76); + + /* disable all tx/rx napi */ + mt76_worker_disable(&dev->mt76.tx_worker); +@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev) + goto out; + + mt7996_mac_init(dev); +- mt7996_init_txpower(&dev->phy); +- mt7996_init_txpower(phy2); +- mt7996_init_txpower(phy3); ++ mt7996_for_each_phy(dev, phy) ++ mt7996_init_txpower(phy); + ret = mt7996_txbf_init(dev); ++ if (ret) ++ goto out; + +- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) { +- ret = mt7996_run(&dev->phy); +- if (ret) +- goto out; +- } +- +- if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) { +- ret = mt7996_run(phy2); +- if (ret) +- goto out; +- } ++ mt7996_for_each_phy(dev, phy) { ++ if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state)) ++ continue; + +- if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) { +- ret = mt7996_run(phy3); ++ ret = mt7996_run(&dev->phy); + if (ret) + goto out; + } + + out: + /* reset done */ +- clear_bit(MT76_RESET, &dev->mphy.state); +- if (phy2) +- clear_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- clear_bit(MT76_RESET, &phy3->mt76->state); ++ mt7996_for_each_phy(dev, phy) ++ clear_bit(MT76_RESET, &phy->mt76->state); + + napi_enable(&dev->mt76.tx_napi); + local_bh_disable(); +@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev) + static void + mt7996_mac_full_reset(struct mt7996_dev *dev) + { +- struct mt7996_phy *phy2, *phy3; ++ struct ieee80211_hw *hw = mt76_hw(dev); ++ struct mt7996_phy *phy; + int i; + +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); + dev->recovery.hw_full_reset = true; + + wake_up(&dev->mt76.mcu.wait); +- ieee80211_stop_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_stop_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_stop_queues(phy3->mt76->hw); ++ ieee80211_stop_queues(hw); + + cancel_work_sync(&dev->wed_rro.work); +- cancel_delayed_work_sync(&dev->mphy.mac_work); +- if (phy2) +- cancel_delayed_work_sync(&phy2->mt76->mac_work); +- if (phy3) +- cancel_delayed_work_sync(&phy3->mt76->mac_work); ++ mt7996_for_each_phy(dev, phy) ++ cancel_delayed_work_sync(&phy->mt76->mac_work); + + mutex_lock(&dev->mt76.mutex); + for (i = 0; i < 10; i++) { +@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev) + dev_err(dev->mt76.dev, "chip full reset failed\n"); + + ieee80211_restart_hw(mt76_hw(dev)); +- if (phy2) +- ieee80211_restart_hw(phy2->mt76->hw); +- if (phy3) +- ieee80211_restart_hw(phy3->mt76->hw); +- + ieee80211_wake_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_wake_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_wake_queues(phy3->mt76->hw); + + dev->recovery.hw_full_reset = false; +- ieee80211_queue_delayed_work(mt76_hw(dev), +- &dev->mphy.mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy2) +- ieee80211_queue_delayed_work(phy2->mt76->hw, +- &phy2->mt76->mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy3) +- ieee80211_queue_delayed_work(phy3->mt76->hw, +- &phy3->mt76->mac_work, ++ mt7996_for_each_phy(dev, phy) ++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, + MT7996_WATCHDOG_TIME); + } + + void mt7996_mac_reset_work(struct work_struct *work) + { +- struct mt7996_phy *phy2, *phy3; ++ struct ieee80211_hw *hw; + struct mt7996_dev *dev; ++ struct mt7996_phy *phy; + int i; + + dev = container_of(work, struct mt7996_dev, reset_work); +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); ++ hw = mt76_hw(dev); + + /* chip full reset */ + if (dev->recovery.restart) { +@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work) + return; + + dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.", +- wiphy_name(dev->mt76.hw->wiphy)); ++ wiphy_name(hw->wiphy)); + + if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2)) + mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2); +@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work) + mtk_wed_device_stop(&dev->mt76.mmio.wed); + + ieee80211_stop_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_stop_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_stop_queues(phy3->mt76->hw); + + set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); + wake_up(&dev->mt76.mcu.wait); + + cancel_work_sync(&dev->wed_rro.work); +- cancel_delayed_work_sync(&dev->mphy.mac_work); +- if (phy2) { +- set_bit(MT76_RESET, &phy2->mt76->state); +- cancel_delayed_work_sync(&phy2->mt76->mac_work); +- } +- if (phy3) { +- set_bit(MT76_RESET, &phy3->mt76->state); +- cancel_delayed_work_sync(&phy3->mt76->mac_work); ++ mt7996_for_each_phy(dev, phy) { ++ set_bit(MT76_RESET, &phy->mt76->state); ++ cancel_delayed_work_sync(&phy->mt76->mac_work); + } ++ + mt76_worker_disable(&dev->mt76.tx_worker); + mt76_for_each_q_rx(&dev->mt76, i) { + if (mtk_wed_device_active(&dev->mt76.mmio.wed) && +@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work) + } + + clear_bit(MT76_MCU_RESET, &dev->mphy.state); +- clear_bit(MT76_RESET, &dev->mphy.state); +- if (phy2) +- clear_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- clear_bit(MT76_RESET, &phy3->mt76->state); ++ mt7996_for_each_phy(dev, phy) ++ clear_bit(MT76_RESET, &phy->mt76->state); + + mt76_for_each_q_rx(&dev->mt76, i) { + if (mtk_wed_device_active(&dev->mt76.mmio.wed) && +@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work) + napi_schedule(&dev->mt76.tx_napi); + local_bh_enable(); + +- ieee80211_wake_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_wake_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_wake_queues(phy3->mt76->hw); ++ ieee80211_wake_queues(hw); + + mutex_unlock(&dev->mt76.mutex); + + mt7996_update_beacons(dev); + +- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy2) +- ieee80211_queue_delayed_work(phy2->mt76->hw, +- &phy2->mt76->mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy3) +- ieee80211_queue_delayed_work(phy3->mt76->hw, +- &phy3->mt76->mac_work, ++ mt7996_for_each_phy(dev, phy) ++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, + MT7996_WATCHDOG_TIME); + dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.", + wiphy_name(dev->mt76.hw->wiphy)); +-- +2.51.0 + diff --git a/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch b/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch new file mode 100644 index 0000000000..a15553a052 --- /dev/null +++ b/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch @@ -0,0 +1,105 @@ +From 12935b6800c9c89fe7b62aa78075b4b0b7147a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 00:14:37 +0200 +Subject: wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback + +From: Lorenzo Bianconi + +[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ] + +Do not always use deflink_id in link_sta_rc_update mac80211 +callback but use the proper link_id provided by mac80211. + +Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/main.c | 43 ++++++++++++------- + 1 file changed, 28 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 1394155a68ce7..92ddb35ea8747 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -1655,19 +1655,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw, + } + } + +-static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta) ++static void mt7996_link_rate_ctrl_update(void *data, ++ struct mt7996_sta_link *msta_link) + { +- struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta *msta = msta_link->sta; + struct mt7996_dev *dev = msta->vif->deflink.phy->dev; +- struct mt7996_sta_link *msta_link; + u32 *changed = data; + +- rcu_read_lock(); +- +- msta_link = rcu_dereference(msta->link[msta->deflink_id]); +- if (!msta_link) +- goto out; +- + spin_lock_bh(&dev->mt76.sta_poll_lock); + + msta_link->changed |= *changed; +@@ -1675,8 +1669,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta) + list_add_tail(&msta_link->rc_list, &dev->sta_rc_list); + + spin_unlock_bh(&dev->mt76.sta_poll_lock); +-out: +- rcu_read_unlock(); + } + + static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw, +@@ -1684,11 +1676,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw, + struct ieee80211_link_sta *link_sta, + u32 changed) + { +- struct mt7996_dev *dev = mt7996_hw_dev(hw); + struct ieee80211_sta *sta = link_sta->sta; ++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta_link *msta_link; + +- mt7996_link_rate_ctrl_update(&changed, sta); +- ieee80211_queue_work(hw, &dev->rc_work); ++ rcu_read_lock(); ++ ++ msta_link = rcu_dereference(msta->link[link_sta->link_id]); ++ if (msta_link) { ++ struct mt7996_dev *dev = mt7996_hw_dev(hw); ++ ++ mt7996_link_rate_ctrl_update(&changed, msta_link); ++ ieee80211_queue_work(hw, &dev->rc_work); ++ } ++ ++ rcu_read_unlock(); ++} ++ ++static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta) ++{ ++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta_link *msta_link; ++ u32 *changed = data; ++ ++ msta_link = rcu_dereference(msta->link[msta->deflink_id]); ++ if (msta_link) ++ mt7996_link_rate_ctrl_update(&changed, msta_link); + } + + static int +@@ -1709,7 +1722,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT + * then multiple MCS setting (MCS 4,5,6) is not supported. + */ +- ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update, ++ ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update, + &changed); + ieee80211_queue_work(hw, &dev->rc_work); + +-- +2.51.0 + diff --git a/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..cb8c3b57bb --- /dev/null +++ b/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From caaba2618a45ceca6f70fbe3f52065aa4661b56f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 8085a1ae4bdbb..a57c72d6533c4 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch b/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch new file mode 100644 index 0000000000..341c5ea269 --- /dev/null +++ b/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch @@ -0,0 +1,67 @@ +From e1ceaf1d26f0a0cd8da64de849a90fda67613950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 23:08:24 +0300 +Subject: wifi: rtw88: Lock rtwdev->mutex before setting the LED + +From: Bitterblue Smith + +[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ] + +Some users report that the LED blinking breaks AP mode somehow. Most +likely the LED code and the dynamic mechanism are trying to access the +hardware registers at the same time. Fix it by locking rtwdev->mutex +before setting the LED and unlocking it after. + +Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking") +Closes: https://github.com/lwfinger/rtw88/issues/305 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c +index 25aa6cbaa7286..7f9ace351a5b7 100644 +--- a/drivers/net/wireless/realtek/rtw88/led.c ++++ b/drivers/net/wireless/realtek/rtw88/led.c +@@ -6,13 +6,23 @@ + #include "debug.h" + #include "led.h" + +-static int rtw_led_set_blocking(struct led_classdev *led, +- enum led_brightness brightness) ++static void rtw_led_set(struct led_classdev *led, ++ enum led_brightness brightness) + { + struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev); + ++ mutex_lock(&rtwdev->mutex); ++ + rtwdev->chip->ops->led_set(led, brightness); + ++ mutex_unlock(&rtwdev->mutex); ++} ++ ++static int rtw_led_set_blocking(struct led_classdev *led, ++ enum led_brightness brightness) ++{ ++ rtw_led_set(led, brightness); ++ + return 0; + } + +@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev) + return; + + if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) +- led->brightness_set = rtwdev->chip->ops->led_set; ++ led->brightness_set = rtw_led_set; + else + led->brightness_set_blocking = rtw_led_set_blocking; + +-- +2.51.0 + diff --git a/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch b/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch new file mode 100644 index 0000000000..2bee022941 --- /dev/null +++ b/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch @@ -0,0 +1,111 @@ +From 96a3944040eea2b6d1c858c1b480d8e3b1d4ffd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 21:46:02 +0300 +Subject: wifi: rtw88: Use led->brightness_set_blocking for PCI too + +From: Bitterblue Smith + +[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ] + +Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting +the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by +using the brightness_set_blocking member of struct led_classdev for +PCI devices too. This one is allowed to sleep. + +bad: scheduling from the idle thread! +nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary) +nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE +nix kernel: Hardware name: [REDACTED] +nix kernel: Call Trace: +nix kernel: +nix kernel: dump_stack_lvl+0x63/0x90 +nix kernel: dequeue_task_idle+0x2d/0x50 +nix kernel: __schedule+0x191/0x1310 +nix kernel: ? xas_load+0x11/0xd0 +nix kernel: schedule+0x2b/0xe0 +nix kernel: schedule_preempt_disabled+0x19/0x30 +nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0 +nix kernel: rtw_led_set+0x27/0x60 [rtw_core] +nix kernel: led_blink_set_nosleep+0x56/0xb0 +nix kernel: led_trigger_blink+0x49/0x80 +nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] +nix kernel: call_timer_fn+0x2f/0x140 +nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] +nix kernel: __run_timers+0x21a/0x2b0 +nix kernel: run_timer_softirq+0x8e/0x100 +nix kernel: handle_softirqs+0xea/0x2c0 +nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5 +nix kernel: __irq_exit_rcu+0xdc/0x100 +nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90 +nix kernel: +nix kernel: +nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20 +nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450 +nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0> +nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246 +nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 +nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000 +nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400 +nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003 +nix kernel: ? cpuidle_enter_state+0xbc/0x450 +nix kernel: cpuidle_enter+0x32/0x50 +nix kernel: do_idle+0x1b1/0x210 +nix kernel: cpu_startup_entry+0x2d/0x30 +nix kernel: start_secondary+0x118/0x140 +nix kernel: common_startup_64+0x13e/0x141 +nix kernel: + +Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED") +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c +index 7f9ace351a5b7..4cc62e49d1679 100644 +--- a/drivers/net/wireless/realtek/rtw88/led.c ++++ b/drivers/net/wireless/realtek/rtw88/led.c +@@ -6,8 +6,8 @@ + #include "debug.h" + #include "led.h" + +-static void rtw_led_set(struct led_classdev *led, +- enum led_brightness brightness) ++static int rtw_led_set(struct led_classdev *led, ++ enum led_brightness brightness) + { + struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev); + +@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led, + rtwdev->chip->ops->led_set(led, brightness); + + mutex_unlock(&rtwdev->mutex); +-} +- +-static int rtw_led_set_blocking(struct led_classdev *led, +- enum led_brightness brightness) +-{ +- rtw_led_set(led, brightness); + + return 0; + } +@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev) + if (!rtwdev->chip->ops->led_set) + return; + +- if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) +- led->brightness_set = rtw_led_set; +- else +- led->brightness_set_blocking = rtw_led_set_blocking; ++ led->brightness_set_blocking = rtw_led_set; + + snprintf(rtwdev->led_name, sizeof(rtwdev->led_name), + "rtw88-%s", dev_name(rtwdev->dev)); +-- +2.51.0 + diff --git a/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch new file mode 100644 index 0000000000..d57b5e2b9e --- /dev/null +++ b/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch @@ -0,0 +1,149 @@ +From cbbc56d667df5e484d700b66d89225c4c9bbb9b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:50 +0300 +Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run() + +From: Fedor Pchelkin + +[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ] + +Lockdep gives a splat [1] when ser_hdl_work item is executed. It is +scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a +wiphy lock inside. However, this workqueue can be flushed when e.g. +closing the interface and wiphy lock is already taken in that case. + +Choosing wiphy_work_queue() for SER is likely not suitable. Back on to +the global workqueue. + +[1]: + + WARNING: possible circular locking dependency detected + 6.17.0-rc2 #17 Not tainted + ------------------------------------------------------ + kworker/u32:1/61 is trying to acquire lock: + ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] + + but task is already holding lock: + ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: + process_one_work+0x7c6/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + -> #1 ((wq_completion)phy0){+.+.}-{0:0}: + touch_wq_lockdep_map+0x8e/0x180 + __flush_workqueue+0x129/0x10d0 + ieee80211_stop_device+0xa8/0x110 + ieee80211_do_stop+0x14ce/0x2880 + ieee80211_stop+0x13a/0x2c0 + __dev_close_many+0x18f/0x510 + __dev_change_flags+0x25f/0x670 + netif_change_flags+0x7b/0x160 + do_setlink.isra.0+0x1640/0x35d0 + rtnl_newlink+0xd8c/0x1d30 + rtnetlink_rcv_msg+0x700/0xb80 + netlink_rcv_skb+0x11d/0x350 + netlink_unicast+0x49a/0x7a0 + netlink_sendmsg+0x759/0xc20 + ____sys_sendmsg+0x812/0xa00 + ___sys_sendmsg+0xf7/0x180 + __sys_sendmsg+0x11f/0x1b0 + do_syscall_64+0xbb/0x360 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + other info that might help us debug this: + + Chain exists of: + &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&ser->ser_hdl_work)); + lock((wq_completion)phy0); + lock((work_completion)(&ser->ser_hdl_work)); + lock(&rdev->wiphy.mtx); + + *** DEADLOCK *** + + 2 locks held by kworker/u32:1/61: + #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 + #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + stack backtrace: + CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 + Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] + Call Trace: + + dump_stack_lvl+0x5d/0x80 + print_circular_bug.cold+0x178/0x1be + check_noncircular+0x14c/0x170 + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 869ab22a79681..803c88d37ec37 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch b/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch new file mode 100644 index 0000000000..de6a4f3d0c --- /dev/null +++ b/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch @@ -0,0 +1,39 @@ +From a6b298b22af29727562c33bbe32f21b428ef68a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:49 +0300 +Subject: wifi: rtw89: fix leak in rtw89_core_send_nullfunc() + +From: Fedor Pchelkin + +[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ] + +If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated +skb is leaked. Free it on the error handling path. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index b506afaaa3ec9..725f668308b8e 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3389,6 +3389,7 @@ static int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, + rtwsta_link = rtwsta->links[rtwvif_link->link_id]; + if (unlikely(!rtwsta_link)) { + ret = -ENOLINK; ++ dev_kfree_skb_any(skb); + goto out; + } + +-- +2.51.0 + diff --git a/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..7fca1aac38 --- /dev/null +++ b/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 9e09c5e5e76f1bb0480722f36d5a266d2faaf00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 77d8f49b92bdd..f59ae7186940a 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-6.17/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch b/queue-6.17/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch new file mode 100644 index 0000000000..75a1a63b69 --- /dev/null +++ b/queue-6.17/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch @@ -0,0 +1,60 @@ +From 3f8d7dcfa81fdc4d7b6d4a21dcf9dbecc92666b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:39:17 +0800 +Subject: accel/amdxdna: Use int instead of u32 to store error codes + +From: Qianfeng Rong + +[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ] + +Change the 'ret' variable from u32 to int to store -EINVAL. Storing the +negative error codes in unsigned type, doesn't cause an issue at runtime +but it's ugly as pants. + +Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may +trigger a GCC warning when the -Wsign-conversion flag is enabled. + +Fixes: aac243092b70 ("accel/amdxdna: Add command execution") +Signed-off-by: Qianfeng Rong +Reviewed-by: Lizhi Hou +Signed-off-by: Lizhi Hou +Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/aie2_ctx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c +index 2cff5419bd2fa..cda964ba33cd7 100644 +--- a/drivers/accel/amdxdna/aie2_ctx.c ++++ b/drivers/accel/amdxdna/aie2_ctx.c +@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size) + { + struct amdxdna_sched_job *job = handle; + struct amdxdna_gem_obj *cmd_abo; +- u32 ret = 0; ++ int ret = 0; + u32 status; + + cmd_abo = job->cmd_bo; +@@ -222,7 +222,7 @@ static int + aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size) + { + struct amdxdna_sched_job *job = handle; +- u32 ret = 0; ++ int ret = 0; + u32 status; + + if (unlikely(!data)) +@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size) + u32 fail_cmd_status; + u32 fail_cmd_idx; + u32 cmd_status; +- u32 ret = 0; ++ int ret = 0; + + cmd_abo = job->cmd_bo; + if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) { +-- +2.51.0 + diff --git a/queue-6.17/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.17/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..91210eaef1 --- /dev/null +++ b/queue-6.17/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 9cde184d33b6f62ba95605202f8893efd1347f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index ae035b93da087..3eb56b77cb6d9 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.17/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..1f59d4056c --- /dev/null +++ b/queue-6.17/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From fa97bb57b0bd6d42e278502b407a6b3168bb1999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 2c2dc559e0f8d..d0fc045a8d310 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-6.17/acpica-apply-acpi_nonstring.patch b/queue-6.17/acpica-apply-acpi_nonstring.patch new file mode 100644 index 0000000000..4597c208b6 --- /dev/null +++ b/queue-6.17/acpica-apply-acpi_nonstring.patch @@ -0,0 +1,63 @@ +From 52541511e1ff4c3f7a6fdf776cbe4d161efa1271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 21:55:35 +0200 +Subject: ACPICA: Apply ACPI_NONSTRING + +From: Ahmed Salem + +[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ] + +Add ACPI_NONSTRING for destination char arrays without a terminating NUL +character. + +This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") +where a few more destination arrays were missed. + +Link: https://github.com/acpica/acpica/commit/f359e5ed +Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING") +Signed-off-by: Ahmed Salem +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/acpi/actbl.h | 2 +- + tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h +index 243097a3da636..8a67d4ea6e3fe 100644 +--- a/include/acpi/actbl.h ++++ b/include/acpi/actbl.h +@@ -73,7 +73,7 @@ struct acpi_table_header { + char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM identification */ + char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM table identification */ + u32 oem_revision; /* OEM revision number */ +- char asl_compiler_id[ACPI_NAMESEG_SIZE]; /* ASCII ASL compiler vendor ID */ ++ char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; /* ASCII ASL compiler vendor ID */ + u32 asl_compiler_revision; /* ASL compiler version */ + }; + +diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c +index 9741e7503591c..de93067a5da32 100644 +--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c ++++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c +@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory) + { + void *table_dir; + u32 instance; +- char temp_name[ACPI_NAMESEG_SIZE]; ++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; + char *filename; + acpi_status status = AE_OK; + +@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname, + { + void *table_dir; + u32 current_instance = 0; +- char temp_name[ACPI_NAMESEG_SIZE]; ++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; + char table_filename[PATH_MAX]; + char *filename; + acpi_status status; +-- +2.51.0 + diff --git a/queue-6.17/acpica-fix-largest-possible-resource-descriptor-inde.patch b/queue-6.17/acpica-fix-largest-possible-resource-descriptor-inde.patch new file mode 100644 index 0000000000..3056df84cc --- /dev/null +++ b/queue-6.17/acpica-fix-largest-possible-resource-descriptor-inde.patch @@ -0,0 +1,42 @@ +From cbfd46a690eae599f06b9506c8d7cf518a7f341d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 22:03:16 +0200 +Subject: ACPICA: Fix largest possible resource descriptor index + +From: Dmitry Antipov + +[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ] + +ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually +used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). + +Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be +clamped incorrectly and resulting value may issue an out-of-bounds +access for 'acpi_gbl_resource_types' array. Compile tested only. + +Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") +Link: https://github.com/acpica/acpica/commit/cf00116c +Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 +Signed-off-by: Dmitry Antipov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/aclocal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 0c41f0097e8d7..f98640086f4ef 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -1141,7 +1141,7 @@ struct acpi_port_info { + #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 + #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 + #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 +-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 ++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 + + /***************************************************************************** + * +-- +2.51.0 + diff --git a/queue-6.17/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.17/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..cc547f44d2 --- /dev/null +++ b/queue-6.17/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From 8004f7c8be38b92445a47cfbb4dba382e6ac0f75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index 9d95ecb299aed..a99acd1125e74 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-6.17/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch b/queue-6.17/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch new file mode 100644 index 0000000000..7fa9e6ed15 --- /dev/null +++ b/queue-6.17/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch @@ -0,0 +1,80 @@ +From 87c39a99bc32406e8f6a43d9cf59a9cd288eab1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 17:28:51 +0200 +Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on + PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ] + +snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts +via spin_lock_irq(). This also implicitly disables the handling of +softirqs such as TIMER_SOFTIRQ. +On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not +disable them. That means a timer can be invoked during spin_lock_irq() +on the same CPU. Due to synchronisations reasons local_bh_disable() has +a per-CPU lock named softirq_ctrl.lock which synchronizes individual +softirq against each other. +syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is +acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This +is a possible deadlock. + +The softirq_ctrl.lock can not be made part of spin_lock_irq() as this +would lead to too much synchronisation against individual threads on the +system. To avoid the possible deadlock, softirqs must be manually +disabled before the lock is acquired. + +Disable softirqs before the lock is acquired on PREEMPT_RT. + +Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com +Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_native.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 1eab940fa2e5a..68bee40c9adaf 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group) + } + + /* define group lock helpers */ +-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \ ++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \ + static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \ + { \ +- if (nonatomic) \ ++ if (nonatomic) { \ + mutex_ ## mutex_action(&group->mutex); \ +- else \ +- spin_ ## action(&group->lock); \ +-} +- +-DEFINE_PCM_GROUP_LOCK(lock, lock); +-DEFINE_PCM_GROUP_LOCK(unlock, unlock); +-DEFINE_PCM_GROUP_LOCK(lock_irq, lock); +-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock); ++ } else { \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \ ++ local_bh_disable(); \ ++ spin_ ## action(&group->lock); \ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \ ++ local_bh_enable(); \ ++ } \ ++} ++ ++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock); ++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock); ++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock); + + /** + * snd_pcm_stream_lock - Lock the PCM stream +-- +2.51.0 + diff --git a/queue-6.17/arch-copy_thread-pass-clone_flags-as-u64.patch b/queue-6.17/arch-copy_thread-pass-clone_flags-as-u64.patch new file mode 100644 index 0000000000..f7333dd36d --- /dev/null +++ b/queue-6.17/arch-copy_thread-pass-clone_flags-as-u64.patch @@ -0,0 +1,413 @@ +From 0c861e3c908dbe96d38b80107505ece7ca6c36cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 15:09:52 +0200 +Subject: arch: copy_thread: pass clone_flags as u64 + +From: Simon Schuster + +[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ] + +With the introduction of clone3 in commit 7f192e3cd316 ("fork: add +clone3") the effective bit width of clone_flags on all architectures was +increased from 32-bit to 64-bit, with a new type of u64 for the flags. +However, for most consumers of clone_flags the interface was not +changed from the previous type of unsigned long. + +While this works fine as long as none of the new 64-bit flag bits +(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still +undesirable in terms of the principle of least surprise. + +Thus, this commit fixes all relevant interfaces of the copy_thread +function that is called from copy_process to consistently pass +clone_flags as u64, so that no truncation to 32-bit integers occurs on +32-bit architectures. + +Signed-off-by: Simon Schuster +Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com +Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread") +Acked-by: Guo Ren (Alibaba Damo Academy) +Acked-by: Andreas Larsson # sparc +Acked-by: David Hildenbrand +Acked-by: Geert Uytterhoeven # m68k +Reviewed-by: Arnd Bergmann +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/process.c | 2 +- + arch/arc/kernel/process.c | 2 +- + arch/arm/kernel/process.c | 2 +- + arch/arm64/kernel/process.c | 2 +- + arch/csky/kernel/process.c | 2 +- + arch/hexagon/kernel/process.c | 2 +- + arch/loongarch/kernel/process.c | 2 +- + arch/m68k/kernel/process.c | 2 +- + arch/microblaze/kernel/process.c | 2 +- + arch/mips/kernel/process.c | 2 +- + arch/nios2/kernel/process.c | 2 +- + arch/openrisc/kernel/process.c | 2 +- + arch/parisc/kernel/process.c | 2 +- + arch/powerpc/kernel/process.c | 2 +- + arch/riscv/kernel/process.c | 2 +- + arch/s390/kernel/process.c | 2 +- + arch/sh/kernel/process_32.c | 2 +- + arch/sparc/kernel/process_32.c | 2 +- + arch/sparc/kernel/process_64.c | 2 +- + arch/um/kernel/process.c | 2 +- + arch/x86/include/asm/fpu/sched.h | 2 +- + arch/x86/include/asm/shstk.h | 4 ++-- + arch/x86/kernel/fpu/core.c | 2 +- + arch/x86/kernel/process.c | 2 +- + arch/x86/kernel/shstk.c | 2 +- + arch/xtensa/kernel/process.c | 2 +- + 26 files changed, 27 insertions(+), 27 deletions(-) + +diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c +index 582d96548385d..06522451f018f 100644 +--- a/arch/alpha/kernel/process.c ++++ b/arch/alpha/kernel/process.c +@@ -231,7 +231,7 @@ flush_thread(void) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + extern void ret_from_fork(void); +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index 186ceab661eb0..8166d09087130 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void); + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *c_regs; /* child's pt_regs */ +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index e16ed102960cb..d7aa95225c70b 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long stack_start = args->stack; + unsigned long tls = args->tls; + struct thread_info *thread = task_thread_info(p); +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 96482a1412c6a..fba7ca102a8c4 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -409,7 +409,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork"); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long stack_start = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c +index 0c6e4b17fe00f..a7a90340042a5 100644 +--- a/arch/csky/kernel/process.c ++++ b/arch/csky/kernel/process.c +@@ -32,7 +32,7 @@ void flush_thread(void){} + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct switch_stack *childstack; +diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c +index 2a77bfd756945..15b4992bfa298 100644 +--- a/arch/hexagon/kernel/process.c ++++ b/arch/hexagon/kernel/process.c +@@ -52,7 +52,7 @@ void arch_cpu_idle(void) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c +index 3582f591bab28..efd9edf65603c 100644 +--- a/arch/loongarch/kernel/process.c ++++ b/arch/loongarch/kernel/process.c +@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + unsigned long childksp; + unsigned long tls = args->tls; + unsigned long usp = args->stack; +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + struct pt_regs *childregs, *regs = current_pt_regs(); + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE; +diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c +index fda7eac23f872..f5a07a70e9385 100644 +--- a/arch/m68k/kernel/process.c ++++ b/arch/m68k/kernel/process.c +@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct fork_frame { +diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c +index 56342e11442d2..6cbf642d7b801 100644 +--- a/arch/microblaze/kernel/process.c ++++ b/arch/microblaze/kernel/process.c +@@ -54,7 +54,7 @@ void flush_thread(void) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 02aa6a04a21da..29191fa1801e2 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c +index f84021303f6a8..151404139085c 100644 +--- a/arch/nios2/kernel/process.c ++++ b/arch/nios2/kernel/process.c +@@ -101,7 +101,7 @@ void flush_thread(void) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index eef99fee2110c..73ffb9fa3118b 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void); + int + copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *userregs; +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index ed93bd8c15453..e64ab5d2a40d6 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init); + int + copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *cregs = &(p->thread.regs); +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 855e098865032..eb23966ac0a9f 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + f = ret_from_kernel_user_thread; + } else { + struct pt_regs *regs = current_pt_regs(); +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + + /* Copy registers */ +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index a0a40889d79a5..31a392993cb45 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c +index f55f09cda6f88..b107dbca4ed7d 100644 +--- a/arch/s390/kernel/process.c ++++ b/arch/s390/kernel/process.c +@@ -106,7 +106,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long new_stackp = args->stack; + unsigned long tls = args->tls; + struct fake_frame +diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c +index 92b6649d49295..62f753a85b89c 100644 +--- a/arch/sh/kernel/process_32.c ++++ b/arch/sh/kernel/process_32.c +@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c +index 9c7c662cb5659..5a28c0e91bf15 100644 +--- a/arch/sparc/kernel/process_32.c ++++ b/arch/sparc/kernel/process_32.c +@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void); + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct thread_info *ti = task_thread_info(p); +diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c +index 529adfecd58ca..25781923788a0 100644 +--- a/arch/sparc/kernel/process_64.c ++++ b/arch/sparc/kernel/process_64.c +@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs) + */ + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct thread_info *t = task_thread_info(p); +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 1be644de9e41e..9c9c66dc45f05 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -143,7 +143,7 @@ static void fork_handler(void) + + int copy_thread(struct task_struct * p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + void (*handler)(void); +diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h +index c060549c6c940..89004f4ca208d 100644 +--- a/arch/x86/include/asm/fpu/sched.h ++++ b/arch/x86/include/asm/fpu/sched.h +@@ -11,7 +11,7 @@ + + extern void save_fpregs_to_fpstate(struct fpu *fpu); + extern void fpu__drop(struct task_struct *tsk); +-extern int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal, ++extern int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal, + unsigned long shstk_addr); + extern void fpu_flush_thread(void); + +diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h +index ba6f2fe438488..0f50e01259430 100644 +--- a/arch/x86/include/asm/shstk.h ++++ b/arch/x86/include/asm/shstk.h +@@ -16,7 +16,7 @@ struct thread_shstk { + + long shstk_prctl(struct task_struct *task, int option, unsigned long arg2); + void reset_thread_features(void); +-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags, ++unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags, + unsigned long stack_size); + void shstk_free(struct task_struct *p); + int setup_signal_shadow_stack(struct ksignal *ksig); +@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option, + unsigned long arg2) { return -EINVAL; } + static inline void reset_thread_features(void) {} + static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p, +- unsigned long clone_flags, ++ u64 clone_flags, + unsigned long stack_size) { return 0; } + static inline void shstk_free(struct task_struct *p) {} + static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; } +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index aefd412a23dc2..1f71cc135e9ad 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -631,7 +631,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp) + } + + /* Clone current's FPU state on fork */ +-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal, ++int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal, + unsigned long ssp) + { + /* +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 1b7960cf6eb0c..e3a3987b0c4fb 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs, + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long sp = args->stack; + unsigned long tls = args->tls; + struct inactive_task_frame *frame; +diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c +index 2ddf23387c7ef..5eba6c5a67757 100644 +--- a/arch/x86/kernel/shstk.c ++++ b/arch/x86/kernel/shstk.c +@@ -191,7 +191,7 @@ void reset_thread_features(void) + current->thread.features_locked = 0; + } + +-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags, ++unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags, + unsigned long stack_size) + { + struct thread_shstk *shstk = &tsk->thread.shstk; +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index 7bd66677f7b6d..94d43f44be131 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + + int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) + { +- unsigned long clone_flags = args->flags; ++ u64 clone_flags = args->flags; + unsigned long usp_thread_fn = args->stack; + unsigned long tls = args->tls; + struct pt_regs *childregs = task_pt_regs(p); +-- +2.51.0 + diff --git a/queue-6.17/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.17/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..3f1c33687b --- /dev/null +++ b/queue-6.17/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 5115b6921c8721095cf3bbce169c985f84b19257 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e23b868340965..7e6c94f8edeef 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -904,7 +904,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCKx settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -980,7 +980,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch b/queue-6.17/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch new file mode 100644 index 0000000000..927b7adf09 --- /dev/null +++ b/queue-6.17/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch @@ -0,0 +1,43 @@ +From e5c1b06a55f546a40be83779303ff557f192db39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 23:59:57 +0200 +Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer + property + +From: Jihed Chaibi + +[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ] + +The dtbs_check validation for am335x-cm-t335.dtb flags an error +for an unevaluated 'num-serializer' property in the mcasp0 node. + +This property is obsolete; it is not defined in the davinci-mcasp-audio +schema and is not used by the corresponding (or any) driver. + +Remove this unused property to fix the schema validation warning. + +Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +index 06767ea164b59..ece7f7854f6aa 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +@@ -483,8 +483,6 @@ &mcasp1 { + + op-mode = <0>; /* MCASP_IIS_MODE */ + tdm-slots = <2>; +- /* 16 serializers */ +- num-serializer = <16>; + serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ + 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 + >; +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-renesas-porter-fix-can-pin-group.patch b/queue-6.17/arm-dts-renesas-porter-fix-can-pin-group.patch new file mode 100644 index 0000000000..6c159c48a5 --- /dev/null +++ b/queue-6.17/arm-dts-renesas-porter-fix-can-pin-group.patch @@ -0,0 +1,36 @@ +From 08673aee545f571191aea6f52246016e01a8163f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 15:49:48 +0200 +Subject: ARM: dts: renesas: porter: Fix CAN pin group + +From: Geert Uytterhoeven + +[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ] + +According to the schematics, the CAN transceiver is connected to pins +GP7_3 and GP7_4, which correspond to CAN0 data group B. + +Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index f518eadd8b9cd..81b3c5d74e9b3 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -289,7 +289,7 @@ vin0_pins: vin0 { + }; + + can0_pins: can0 { +- groups = "can0_data"; ++ groups = "can0_data_b"; + function = "can0"; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch b/queue-6.17/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch new file mode 100644 index 0000000000..c3923a0ccc --- /dev/null +++ b/queue-6.17/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch @@ -0,0 +1,42 @@ +From 46194a23e76b99a641ac74a2cfcbf26732870e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 00:51:15 +0200 +Subject: ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property + +From: Jihed Chaibi + +[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ] + +The stm32-i2s binding inherits from the standard audio-graph-port +schema for its 'port' subnode, audio-graph-port requires the use +of the 'dai-format' property. The stm32mp151c-plyaqm dts file was +using the non-standard name 'format'. + +Correct the property name to 'dai-format' to fix the dtbs_check +validation error. + +Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts +index 39a3211c61337..55fe916740d7c 100644 +--- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts ++++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts +@@ -239,7 +239,7 @@ &i2s1 { + + i2s1_port: port { + i2s1_endpoint: endpoint { +- format = "i2s"; ++ dai-format = "i2s"; + mclk-fs = <256>; + remote-endpoint = <&codec_endpoint>; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch b/queue-6.17/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch new file mode 100644 index 0000000000..fee655a156 --- /dev/null +++ b/queue-6.17/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch @@ -0,0 +1,42 @@ +From e189352fe83b86ae4657af8fbf2ca1e4064af3a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:25:30 +0200 +Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in + DTS to use correct boolean syntax + +From: Jihed Chaibi + +[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ] + +The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree +schema, was incorrectly assigned a value (<1>) in the DTS file, causing +a validation error: "size (4) error for type flag". The driver uses +of_property_read_bool(), expecting a boolean. Remove the value to fix +the dtbs_check error. + +Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/ +Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +index ae2e8dffbe049..ea47f9960c356 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +@@ -269,7 +269,7 @@ &tps { + vcc7-supply = <&vbat>; + vccio-supply = <&vbat>; + +- ti,en-ck32k-xtal = <1>; ++ ti,en-ck32k-xtal; + + regulators { + vrtc_reg: regulator@0 { +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch b/queue-6.17/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch new file mode 100644 index 0000000000..74b2a1f8af --- /dev/null +++ b/queue-6.17/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch @@ -0,0 +1,41 @@ +From 59396fc27abfcab6e6d212628c7babcbca8bb432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:50:52 +0200 +Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on + property to use correct boolean syntax in DTS + +From: Jihed Chaibi + +[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ] + +The ti,keep-vref-on property, defined as a boolean flag in the Device +Tree schema, was incorrectly assigned a value (<1>) in the DTS file, +causing a validation error: "size (4) error for type flag". Remove +the value to match the schema and ensure compatibility with the driver +using device_property_read_bool(). This fixes the dtbs_check error. + +Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +index a7f99ae0c1fe9..78c657429f641 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +@@ -65,7 +65,7 @@ ads7846@0 { + ti,debounce-max = /bits/ 16 <10>; + ti,debounce-tol = /bits/ 16 <5>; + ti,debounce-rep = /bits/ 16 <1>; +- ti,keep-vref-on = <1>; ++ ti,keep-vref-on; + ti,settle-delay-usec = /bits/ 16 <150>; + + wakeup-source; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch new file mode 100644 index 0000000000..4794003fda --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch @@ -0,0 +1,41 @@ +From 5c33bf816b87f0fd2de44cb37a001a29175c609c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 02:10:55 +0800 +Subject: arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset + setting + +From: Chen-Yu Tsai + +[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ] + +The external Ethernet PHY has a reset pin that is connected to the SoC. +It is missing from the original submission. + +Add it to complete the description. + +Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +index 553ad774ed13d..43251042d1bd5 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +@@ -75,6 +75,9 @@ &mdio0 { + ext_rgmii_phy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; ++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */ ++ reset-assert-us = <10000>; ++ reset-deassert-us = <150000>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-leds.patch b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-leds.patch new file mode 100644 index 0000000000..1fea11a250 --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-add-leds.patch @@ -0,0 +1,68 @@ +From e17267805ed68996a916e0716fa24aebd183565e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 01:59:27 +0800 +Subject: arm64: dts: allwinner: a527: cubie-a5e: Add LEDs + +From: Chen-Yu Tsai + +[ Upstream commit 4184f0190792aea06553af963741a24cc9b47689 ] + +The Radxa Cubie A5E has a 3-color LED. The green and blue LEDs are wired +to GPIO pins on the SoC, and the green one is lit by default to serve as +a power indicator. The red LED is wired to the M.2 slot. + +Add device nodes for the green and blue LEDs. + +A default "heartbeat" trigger is set for the green power LED, though in +practice it might be better if it were inverted, i.e. lit most of the +time. + +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250812175927.2199219-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Stable-dep-of: 9f01e1e14e71 ("arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal") +Signed-off-by: Sasha Levin +--- + .../dts/allwinner/sun55i-a527-cubie-a5e.dts | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +index 43251042d1bd5..d4cee22221045 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +@@ -6,6 +6,7 @@ + #include "sun55i-a523.dtsi" + + #include ++#include + + / { + model = "Radxa Cubie A5E"; +@@ -27,6 +28,24 @@ ext_osc32k: ext-osc32k-clk { + clock-output-names = "ext_osc32k"; + }; + ++ leds { ++ compatible = "gpio-leds"; ++ ++ power-led { ++ function = LED_FUNCTION_POWER; ++ color = ; ++ gpios = <&r_pio 0 4 GPIO_ACTIVE_LOW>; /* PL4 */ ++ default-state = "on"; ++ linux,default-trigger = "heartbeat"; ++ }; ++ ++ use-led { ++ function = LED_FUNCTION_ACTIVITY; ++ color = ; ++ gpios = <&r_pio 0 5 GPIO_ACTIVE_LOW>; /* PL5 */ ++ }; ++ }; ++ + reg_vcc5v: vcc5v { + /* board wide 5V supply from the USB-C connector */ + compatible = "regulator-fixed"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-drop-external-32..patch b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-drop-external-32..patch new file mode 100644 index 0000000000..8d33e177ab --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-a527-cubie-a5e-drop-external-32..patch @@ -0,0 +1,48 @@ +From 26c27e9034e9200ec6a98a59cc35afc42b159659 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:24:48 +0800 +Subject: arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz + crystal + +From: Chen-Yu Tsai + +[ Upstream commit 9f01e1e14e71defefcb4d6823b8476a15f3cf04a ] + +The Radxa Cubie A5E has empty pads for a 32.768 KHz crystal, but it is +left unpopulated, as per the schematics and seen on board images. A dead +give away is the RTC's LOSC auto switch register showing the external +OSC to be abnormal. + +Drop the external crystal from the device tree. It was not referenced +anyway. + +Fixes: c2520cd032ae ("arm64: dts: allwinner: a523: add Radxa A5E support") +Reviewed-by: Jernej Skrabec +Link: https://patch.msgid.link/20250913102450.3935943-1-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +index d4cee22221045..514c221a7a866 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts +@@ -21,13 +21,6 @@ chosen { + stdout-path = "serial0:115200n8"; + }; + +- ext_osc32k: ext-osc32k-clk { +- #clock-cells = <0>; +- compatible = "fixed-clock"; +- clock-frequency = <32768>; +- clock-output-names = "ext_osc32k"; +- }; +- + leds { + compatible = "gpio-leds"; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch b/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch new file mode 100644 index 0000000000..fe1830bf52 --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch @@ -0,0 +1,41 @@ +From 1af0bd3da5c5b19f781190d45a6181e659872e3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 02:10:57 +0800 +Subject: arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset + setting + +From: Chen-Yu Tsai + +[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ] + +The external Ethernet PHY has a reset pin that is connected to the SoC. +It is missing from the original submission. + +Add it to complete the description. + +Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +index b9eeb6753e9e3..e7713678208d4 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +@@ -85,6 +85,9 @@ &mdio0 { + ext_rgmii_phy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; ++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */ ++ reset-assert-us = <10000>; ++ reset-deassert-us = <150000>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch b/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch new file mode 100644 index 0000000000..ff8d39e7a2 --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch @@ -0,0 +1,48 @@ +From 187d60fc889d3f56bbea7de51227c3a4cb8cccb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:24:49 +0800 +Subject: arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal + +From: Chen-Yu Tsai + +[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ] + +When the board was added, its external 32.768 KHz crystal was described +but not hooked up correctly. This meant the device had to fall back to +the SoC's internal oscillator or divide a 32 KHz clock from the main +oscillator, neither of which are accurate for the RTC. As a result the +RTC clock will drift badly. + +Hook the crystal up to the RTC block and request the correct clock rate. + +Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +index e7713678208d4..4e71055fbd159 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts +@@ -309,6 +309,14 @@ &r_pio { + vcc-pm-supply = <®_aldo3>; + }; + ++&rtc { ++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>, ++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>; ++ clock-names = "bus", "hosc", "ahb", "ext-osc32k"; ++ assigned-clocks = <&rtc CLK_OSC32K>; ++ assigned-clock-rates = <32768>; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pb_pins>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-allwinner-t527-orangepi-4a-hook-up-externa.patch b/queue-6.17/arm64-dts-allwinner-t527-orangepi-4a-hook-up-externa.patch new file mode 100644 index 0000000000..4f79c7d6e1 --- /dev/null +++ b/queue-6.17/arm64-dts-allwinner-t527-orangepi-4a-hook-up-externa.patch @@ -0,0 +1,49 @@ +From aa2be5f096a19672711a884e0be7972e478ed68b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:24:50 +0800 +Subject: arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k + crystal + +From: Chen-Yu Tsai + +[ Upstream commit bd1ce7ef6aef4ee7349eb3124166e712693650ce ] + +When the board was added, its external 32.768 KHz crystal was described +but not hooked up correctly. This meant the device had to fall back to +the SoC's internal oscillator or divide a 32 KHz clock from the main +oscillator, neither of which are accurate for the RTC. As a result the +RTC clock will drift badly. + +Hook the crystal up to the RTC block and request the correct clock rate. + +Fixes: de713ccb9934 ("arm64: dts: allwinner: t527: Add OrangePi 4A board") +Acked-by: Jernej Skrabec +Link: https://patch.msgid.link/20250913102450.3935943-3-wens@kernel.org +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts +index d07bb9193b438..b5483bd7b8d5d 100644 +--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts ++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts +@@ -346,6 +346,14 @@ &r_pio { + vcc-pm-supply = <®_bldo2>; + }; + ++&rtc { ++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>, ++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>; ++ clock-names = "bus", "hosc", "ahb", "ext-osc32k"; ++ assigned-clocks = <&rtc CLK_OSC32K>; ++ assigned-clock-rates = <32768>; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pb_pins>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-apple-add-ethernet0-alias-for-j375-templat.patch b/queue-6.17/arm64-dts-apple-add-ethernet0-alias-for-j375-templat.patch new file mode 100644 index 0000000000..47e7d4c7ac --- /dev/null +++ b/queue-6.17/arm64-dts-apple-add-ethernet0-alias-for-j375-templat.patch @@ -0,0 +1,36 @@ +From b565ef12d0714e76cfe1226015926dcb674b44b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 21:38:45 +0200 +Subject: arm64: dts: apple: Add ethernet0 alias for J375 template + +From: Janne Grunau + +[ Upstream commit 6313115c55f44f7bee3f469c91d3de60d724eabd ] + +The alias is used by the boot loader to fill the MAC address. + +Fixes: aaa1d42a4ce3 ("arm64: dts: apple: Add J375 devicetrees") +Reviewed-by: Neal Gompa +Signed-off-by: Janne Grunau +Reviewed-by: Sven Peter +Signed-off-by: Sven Peter +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t600x-j375.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +index ed38acc0dfc36..c0fb93ae72f4d 100644 +--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi ++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +@@ -12,6 +12,7 @@ + / { + aliases { + bluetooth0 = &bluetooth0; ++ ethernet0 = ðernet0; + serial0 = &serial0; + wifi0 = &wifi0; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-apple-t600x-add-bluetooth-device-nodes.patch b/queue-6.17/arm64-dts-apple-t600x-add-bluetooth-device-nodes.patch new file mode 100644 index 0000000000..c4bdb8d934 --- /dev/null +++ b/queue-6.17/arm64-dts-apple-t600x-add-bluetooth-device-nodes.patch @@ -0,0 +1,162 @@ +From 630b3a2a775e62db19525d9e3d84a1573d037540 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:46 +0200 +Subject: arm64: dts: apple: t600x: Add bluetooth device nodes + +From: Hector Martin + +[ Upstream commit c34e2ec6a84ea3f7a01d8fcd3073f858c4f47605 ] + +Add bluetooth PCIe device nodes to specify per device brcm,board-type +and provide the bootloader filled "local-bd-address" and calibration +data. + +Signed-off-by: Hector Martin +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-3-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++ + arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 8 ++++++++ + arch/arm64/boot/dts/apple/t600x-j375.dtsi | 8 ++++++++ + 8 files changed, 40 insertions(+) + +diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts +index ac35870ca129c..1430b91ff1b15 100644 +--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts ++++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts +@@ -20,3 +20,7 @@ / { + &wifi0 { + brcm,board-type = "apple,maldives"; + }; ++ ++&bluetooth0 { ++ brcm,board-type = "apple,maldives"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts +index 77d6d8c14d741..da0cbe7d96736 100644 +--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts ++++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts +@@ -20,3 +20,7 @@ / { + &wifi0 { + brcm,board-type = "apple,madagascar"; + }; ++ ++&bluetooth0 { ++ brcm,board-type = "apple,madagascar"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts +index 0a5655792a8f1..c37097dcfdb30 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts +@@ -20,3 +20,7 @@ / { + &wifi0 { + brcm,board-type = "apple,maldives"; + }; ++ ++&bluetooth0 { ++ brcm,board-type = "apple,maldives"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts +index 9c215531ea543..3bc6e0c3294cf 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts +@@ -20,3 +20,7 @@ / { + &wifi0 { + brcm,board-type = "apple,madagascar"; + }; ++ ++&bluetooth0 { ++ brcm,board-type = "apple,madagascar"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts +index 88ca2037556ce..2e7c23714d4d0 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts +@@ -20,3 +20,7 @@ / { + &wifi0 { + brcm,board-type = "apple,okinawa"; + }; ++ ++&bluetooth0 { ++ brcm,board-type = "apple,okinawa"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts +index f56d13b37eaff..2b7f80119618a 100644 +--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts ++++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts +@@ -42,6 +42,10 @@ &wifi0 { + brcm,board-type = "apple,okinawa"; + }; + ++&bluetooth0 { ++ brcm,board-type = "apple,okinawa"; ++}; ++ + /* delete unused always-on power-domains on die 1 */ + + /delete-node/ &ps_atc2_usb_aon_die1; +diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi +index b699672a5543c..c0aac59a6fae4 100644 +--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi ++++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi +@@ -13,6 +13,7 @@ + + / { + aliases { ++ bluetooth0 = &bluetooth0; + serial0 = &serial0; + wifi0 = &wifi0; + }; +@@ -105,6 +106,13 @@ wifi0: wifi@0,0 { + local-mac-address = [00 10 18 00 00 10]; + apple,antenna-sku = "XX"; + }; ++ ++ bluetooth0: bluetooth@0,1 { ++ compatible = "pci14e4,5f71"; ++ reg = <0x10100 0x0 0x0 0x0 0x0>; ++ /* To be filled by the loader */ ++ local-bd-address = [00 00 00 00 00 00]; ++ }; + }; + + &port01 { +diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +index 95560bf3798bf..ed38acc0dfc36 100644 +--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi ++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +@@ -11,6 +11,7 @@ + + / { + aliases { ++ bluetooth0 = &bluetooth0; + serial0 = &serial0; + wifi0 = &wifi0; + }; +@@ -90,6 +91,13 @@ wifi0: wifi@0,0 { + local-mac-address = [00 10 18 00 00 10]; + apple,antenna-sku = "XX"; + }; ++ ++ bluetooth0: bluetooth@0,1 { ++ compatible = "pci14e4,5f71"; ++ reg = <0x10100 0x0 0x0 0x0 0x0>; ++ /* To be filled by the loader */ ++ local-bd-address = [00 00 00 00 00 00]; ++ }; + }; + + &port01 { +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-apple-t600x-add-missing-wifi-properties.patch b/queue-6.17/arm64-dts-apple-t600x-add-missing-wifi-properties.patch new file mode 100644 index 0000000000..d3cd77b9c0 --- /dev/null +++ b/queue-6.17/arm64-dts-apple-t600x-add-missing-wifi-properties.patch @@ -0,0 +1,141 @@ +From 05a4b4206a3d82969a2dccde7fae9f42ea9b4675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:45 +0200 +Subject: arm64: dts: apple: t600x: Add missing WiFi properties + +From: Hector Martin + +[ Upstream commit 3050713d84f58d2e4ba463c5474092fa6738c527 ] + +Add compatible and antenna-sku properties to the shared node and +brcm,board-type property to individuall board device trees. + +Signed-off-by: Hector Martin +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-2-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++ + arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++ + arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 2 ++ + arch/arm64/boot/dts/apple/t600x-j375.dtsi | 2 ++ + 8 files changed, 28 insertions(+) + +diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts +index c9e192848fe3f..ac35870ca129c 100644 +--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts ++++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts +@@ -16,3 +16,7 @@ / { + compatible = "apple,j314s", "apple,t6000", "apple,arm-platform"; + model = "Apple MacBook Pro (14-inch, M1 Pro, 2021)"; + }; ++ ++&wifi0 { ++ brcm,board-type = "apple,maldives"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts +index ff1803ce23001..77d6d8c14d741 100644 +--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts ++++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts +@@ -16,3 +16,7 @@ / { + compatible = "apple,j316s", "apple,t6000", "apple,arm-platform"; + model = "Apple MacBook Pro (16-inch, M1 Pro, 2021)"; + }; ++ ++&wifi0 { ++ brcm,board-type = "apple,madagascar"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts +index 1761d15b98c12..0a5655792a8f1 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts +@@ -16,3 +16,7 @@ / { + compatible = "apple,j314c", "apple,t6001", "apple,arm-platform"; + model = "Apple MacBook Pro (14-inch, M1 Max, 2021)"; + }; ++ ++&wifi0 { ++ brcm,board-type = "apple,maldives"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts +index 750e9beeffc0a..9c215531ea543 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts +@@ -16,3 +16,7 @@ / { + compatible = "apple,j316c", "apple,t6001", "apple,arm-platform"; + model = "Apple MacBook Pro (16-inch, M1 Max, 2021)"; + }; ++ ++&wifi0 { ++ brcm,board-type = "apple,madagascar"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts +index 62ea437b58b25..88ca2037556ce 100644 +--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts ++++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts +@@ -16,3 +16,7 @@ / { + compatible = "apple,j375c", "apple,t6001", "apple,arm-platform"; + model = "Apple Mac Studio (M1 Max, 2022)"; + }; ++ ++&wifi0 { ++ brcm,board-type = "apple,okinawa"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts +index 3365429bdc8be..f56d13b37eaff 100644 +--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts ++++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts +@@ -38,6 +38,10 @@ hpm5: usb-pd@3a { + }; + }; + ++&wifi0 { ++ brcm,board-type = "apple,okinawa"; ++}; ++ + /* delete unused always-on power-domains on die 1 */ + + /delete-node/ &ps_atc2_usb_aon_die1; +diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi +index 22ebc78e120bf..b699672a5543c 100644 +--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi ++++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi +@@ -99,9 +99,11 @@ &port00 { + /* WLAN */ + bus-range = <1 1>; + wifi0: wifi@0,0 { ++ compatible = "pci14e4,4433"; + reg = <0x10000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 10]; ++ apple,antenna-sku = "XX"; + }; + }; + +diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +index d5b985ad56793..95560bf3798bf 100644 +--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi ++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi +@@ -84,9 +84,11 @@ &port00 { + /* WLAN */ + bus-range = <1 1>; + wifi0: wifi@0,0 { ++ compatible = "pci14e4,4433"; + reg = <0x10000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 10]; ++ apple,antenna-sku = "XX"; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch b/queue-6.17/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch new file mode 100644 index 0000000000..142eb3ef5e --- /dev/null +++ b/queue-6.17/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch @@ -0,0 +1,65 @@ +From 1e830fe8fbcaa7a1f8c6bb03ff99e875b18a5c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:44 +0200 +Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map + +From: Janne Grunau + +[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ] + +PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused +and disabled. Linux' PCI subsystem assigns the ethernet nic from +`port02` to bus 02. This results into assigning `pcie0_dart_1` from the +disabled port as iommu. The `pcie0_dart_1` instance is disabled and +probably fused off (it is on the M2 Pro Mac mini which has a disabled +PCIe port as well). +Without iommu the ethernet nic is not expected work. +Adjusts the "bus-range" and the PCIe devices "reg" property to PCI +subsystem's bus number. + +Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 152f95fd49a21..7089ccf3ce556 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -21,6 +21,14 @@ aliases { + }; + }; + ++/* ++ * Adjust pcie0's iommu-map to account for the disabled port01. ++ */ ++&pcie0 { ++ iommu-map = <0x100 &pcie0_dart_0 1 1>, ++ <0x200 &pcie0_dart_2 1 1>; ++}; ++ + &bluetooth0 { + brcm,board-type = "apple,santorini"; + }; +@@ -36,10 +44,10 @@ &wifi0 { + */ + + &port02 { +- bus-range = <3 3>; ++ bus-range = <2 2>; + status = "okay"; + ethernet0: ethernet@0,0 { +- reg = <0x30000 0x0 0x0 0x0 0x0>; ++ reg = <0x20000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch b/queue-6.17/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch new file mode 100644 index 0000000000..f5c9739ec5 --- /dev/null +++ b/queue-6.17/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch @@ -0,0 +1,50 @@ +From 70782909d7d2d916ba4012342743ce4828460df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:45 +0200 +Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator + +From: Annette Kobou + +[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ] + +The regulator uses the wrong GPIO. Fix this. + +Signed-off-by: Annette Kobou +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 89e97c604bd3e..9a9e5d0daf3ba 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -33,7 +33,9 @@ pwm-beeper { + + reg_vcc_panel: regulator-vcc-panel { + compatible = "regulator-fixed"; +- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_reg_vcc_panel>; ++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <3300000>; +@@ -161,3 +163,11 @@ &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; + }; ++ ++&iomuxc { ++ pinctrl_reg_vcc_panel: regvccpanelgrp { ++ fsl,pins = < ++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */ ++ >; ++ }; ++}; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch b/queue-6.17/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch new file mode 100644 index 0000000000..7b58d4a4cf --- /dev/null +++ b/queue-6.17/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch @@ -0,0 +1,62 @@ +From b6ad19c4b7f6ff337695a77cc1f9914e86c0577e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 12:05:46 +0200 +Subject: arm64: dts: imx93-kontron: Fix USB port assignment + +From: Frieder Schrempf + +[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ] + +The assignment of the USB ports is wrong and needs to be swapped. +The OTG (USB-C) port is on the first port and the host port with +the onboard hub is on the second port. + +Signed-off-by: Frieder Schrempf +Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +index 9a9e5d0daf3ba..c3d2ddd887fdf 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts +@@ -137,6 +137,16 @@ &tpm6 { + }; + + &usbotg1 { ++ adp-disable; ++ hnp-disable; ++ srp-disable; ++ disable-over-current; ++ dr_mode = "otg"; ++ usb-role-switch; ++ status = "okay"; ++}; ++ ++&usbotg2 { + #address-cells = <1>; + #size-cells = <0>; + disable-over-current; +@@ -149,16 +159,6 @@ usb1@1 { + }; + }; + +-&usbotg2 { +- adp-disable; +- hnp-disable; +- srp-disable; +- disable-over-current; +- dr_mode = "otg"; +- usb-role-switch; +- status = "okay"; +-}; +- + &usdhc2 { + vmmc-supply = <®_vdd_3v3>; + status = "okay"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch b/queue-6.17/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch new file mode 100644 index 0000000000..739e3f97c7 --- /dev/null +++ b/queue-6.17/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch @@ -0,0 +1,47 @@ +From 1b39207187f4bf91db1809e4ee64ba723a03e727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 09:25:31 +0800 +Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid + +From: Joy Zou + +[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ] + +According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87, +and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them. + +Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes") +Signed-off-by: Joy Zou +Signed-off-by: Peng Fan +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi +index 8296888bce594..4521da02d1695 100644 +--- a/arch/arm64/boot/dts/freescale/imx95.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi +@@ -913,7 +913,7 @@ lpuart7: serial@42690000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART7>; + clock-names = "ipg"; +- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>; ++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 { + interrupts = ; + clocks = <&scmi_clk IMX95_CLK_LPUART8>; + clock-names = "ipg"; +- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>; ++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch b/queue-6.17/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch new file mode 100644 index 0000000000..7e70728bc7 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch @@ -0,0 +1,68 @@ +From ec6067343c8e8cf267c68bb7dcfd87f1073a7af8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:52 +0200 +Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node + names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ] + +The node names for "pmic", "regulators", "rtc", and "keys" are +dictated by the PMIC MFD binding: change those to adhere to it. + +Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +index d89858c73ab1b..243afbffa21fd 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +@@ -6,12 +6,12 @@ + #include + + &pwrap { +- pmic: mt6331 { ++ pmic: pmic { + compatible = "mediatek,mt6331"; + interrupt-controller; + #interrupt-cells = <2>; + +- mt6331regulator: mt6331regulator { ++ mt6331regulator: regulators { + compatible = "mediatek,mt6331-regulator"; + + mt6331_vdvfs11_reg: buck-vdvfs11 { +@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { + }; + + mt6331_vdig18_reg: ldo-vdig18 { +- regulator-name = "dvdd18_dig"; ++ regulator-name = "vdig18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-ramp-delay = <0>; +@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { + }; + }; + +- mt6331rtc: mt6331rtc { ++ mt6331rtc: rtc { + compatible = "mediatek,mt6331-rtc"; + }; + +- mt6331keys: mt6331keys { ++ mt6331keys: keys { + compatible = "mediatek,mt6331-keys"; + power { + linux,keycodes = ; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch b/queue-6.17/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch new file mode 100644 index 0000000000..542ba135c9 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch @@ -0,0 +1,40 @@ +From c9ee08a0eed5de797787a892c5e722ae52d82531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:56 +0200 +Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value + +From: AngeloGioacchino Del Regno + +[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ] + +Change the latch-ck value from 0x14 to 4: as only bits [0-3] are +actually used, the final value that gets written to the register +field for DAT_LATCH_CK_SEL is just 0x4. + +This also fixes dtbs_check warnings. + +Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +index 91de920c22457..03cc48321a3f4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts ++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +@@ -212,7 +212,7 @@ proximity@48 { + + &mmc0 { + /* eMMC controller */ +- mediatek,latch-ck = <0x14>; /* hs400 */ ++ mediatek,latch-ck = <4>; /* hs400 */ + mediatek,hs200-cmd-int-delay = <1>; + mediatek,hs400-cmd-int-delay = <1>; + mediatek,hs400-ds-dly3 = <0x1a>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt7986a-fix-pci-express-t-phy-nod.patch b/queue-6.17/arm64-dts-mediatek-mt7986a-fix-pci-express-t-phy-nod.patch new file mode 100644 index 0000000000..5cfde81835 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt7986a-fix-pci-express-t-phy-nod.patch @@ -0,0 +1,58 @@ +From 803f02763e2cbb2b5d28cefcc3a3bbb8af8003ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:59 +0200 +Subject: arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address + +From: AngeloGioacchino Del Regno + +[ Upstream commit 6b3fff78c13f1a2ba5a355a101fa1ca0a13054ad ] + +The PCIe TPHY is under the soc bus, which provides MMIO, and all +nodes under that must use the bus, otherwise those would clearly +be out of place. + +Add ranges to the PCIe tphy and assign the address to the main +node to silence a dtbs_check warning, and fix the children to +use the MMIO range of t-phy. + +Fixes: 963c3b0c47ec ("arm64: dts: mediatek: fix t-phy unit name") +Fixes: 918aed7abd2d ("arm64: dts: mt7986: add pcie related device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-24-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index 559990dcd1d17..3211905b6f86d 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -428,16 +428,16 @@ pcie_intc: interrupt-controller { + }; + }; + +- pcie_phy: t-phy { ++ pcie_phy: t-phy@11c00000 { + compatible = "mediatek,mt7986-tphy", + "mediatek,generic-tphy-v2"; +- ranges; +- #address-cells = <2>; +- #size-cells = <2>; ++ ranges = <0 0 0x11c00000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + status = "disabled"; + +- pcie_port: pcie-phy@11c00000 { +- reg = <0 0x11c00000 0 0x20000>; ++ pcie_port: pcie-phy@0 { ++ reg = <0 0x20000>; + clocks = <&clk40m>; + clock-names = "ref"; + #phy-cells = <1>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8183-fix-out-of-range-pull-valu.patch b/queue-6.17/arm64-dts-mediatek-mt8183-fix-out-of-range-pull-valu.patch new file mode 100644 index 0000000000..50aca77153 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8183-fix-out-of-range-pull-valu.patch @@ -0,0 +1,152 @@ +From 3c788a7656d147413917b00bae27dfafd1ca4e01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 12:11:52 -0500 +Subject: arm64: dts: mediatek: mt8183: Fix out of range pull values + +From: Rob Herring (Arm) + +[ Upstream commit 0aeb7ed4bcb244862a35f880053cd64d28c6fb04 ] + +A value of 10 is not valid for "mediatek,pull-down-adv" and +"mediatek,pull-up-adv" properties which have defined values of 0-3. It +appears the "10" was written as a binary value. The driver only looks at +the lowest 2 bits, so the value "10" decimal works out the same as if +"2" was used. + +Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") +Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board") +Signed-off-by: Rob Herring (Arm) +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250722171152.58923-2-robh@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 14 +++++++------- + arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 14 +++++++------- + 2 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 400c61d110356..fff93e26eb760 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -580,7 +580,7 @@ pins-cmd-dat { + pins-clk { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins-rst { +@@ -609,13 +609,13 @@ pins-cmd-dat { + pins-clk { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins-ds { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins-rst { +@@ -633,13 +633,13 @@ pins-cmd-dat { + , + ; + input-enable; +- mediatek,pull-up-adv = <10>; ++ mediatek,pull-up-adv = <2>; + }; + + pins-clk { + pinmux = ; + input-enable; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + }; + +@@ -652,13 +652,13 @@ pins-cmd-dat { + ; + drive-strength = <6>; + input-enable; +- mediatek,pull-up-adv = <10>; ++ mediatek,pull-up-adv = <2>; + }; + + pins-clk { + pinmux = ; + drive-strength = <8>; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + input-enable; + }; + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts +index dbdee604edab4..7c3010889ae73 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts +@@ -324,7 +324,7 @@ pins_cmd_dat { + pins_clk { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins_rst { +@@ -353,13 +353,13 @@ pins_cmd_dat { + pins_clk { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins_ds { + pinmux = ; + drive-strength = ; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins_rst { +@@ -377,13 +377,13 @@ pins_cmd_dat { + , + ; + input-enable; +- mediatek,pull-up-adv = <10>; ++ mediatek,pull-up-adv = <2>; + }; + + pins_clk { + pinmux = ; + input-enable; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + }; + + pins_pmu { +@@ -401,13 +401,13 @@ pins_cmd_dat { + ; + drive-strength = <6>; + input-enable; +- mediatek,pull-up-adv = <10>; ++ mediatek,pull-up-adv = <2>; + }; + + pins_clk { + pinmux = ; + drive-strength = <8>; +- mediatek,pull-down-adv = <10>; ++ mediatek,pull-down-adv = <2>; + input-enable; + }; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch b/queue-6.17/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch new file mode 100644 index 0000000000..2c665794d4 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch @@ -0,0 +1,70 @@ +From c8c9b96f4ca87967afbca9a9ced3eee65defa3a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 17:01:34 +0800 +Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model + +From: Chen-Yu Tsai + +[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ] + +The touchscreen controller used with the original Krabby design is the +Elan eKTH6918, which is in the same family as eKTH6915, but supporting +a larger screen size with more sense lines. + +OTOH, the touchscreen controller that actually shipped on the Tentacruel +devices is the Elan eKTH6A12NAY. A compatible string was added for it +specifically because it has different power sequencing timings. + +Fix up the touchscreen nodes for both these. This also includes adding +a previously missing reset line. Also add "no-reset-on-power-off" since +the power is always on, and putting it in reset would consume more +power. + +Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++---- + .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +index 7c971198fa956..72a2a2bff0a93 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi +@@ -71,14 +71,14 @@ &i2c1 { + i2c-scl-internal-delay-ns = <10000>; + + touchscreen: touchscreen@10 { +- compatible = "hid-over-i2c"; ++ compatible = "elan,ekth6915"; + reg = <0x10>; + interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&touchscreen_pins>; +- post-power-on-delay-ms = <10>; +- hid-descr-addr = <0x0001>; +- vdd-supply = <&pp3300_s3>; ++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>; ++ vcc33-supply = <&pp3300_s3>; ++ no-reset-on-power-off; + }; + }; + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +index 26d3451a5e47c..24d9ede63eaa2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts +@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP) + CROS_STD_MAIN_KEYMAP + >; + }; ++ ++&touchscreen { ++ compatible = "elan,ekth6a12nay"; ++}; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8188-change-efuse-fallback-comp.patch b/queue-6.17/arm64-dts-mediatek-mt8188-change-efuse-fallback-comp.patch new file mode 100644 index 0000000000..681bdf81bb --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8188-change-efuse-fallback-comp.patch @@ -0,0 +1,45 @@ +From e2445c3f2e65439fc4354c3ffa87ccfe96e64f1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 14:34:30 +0800 +Subject: arm64: dts: mediatek: mt8188: Change efuse fallback compatible to + mt8186 + +From: Chen-Yu Tsai + +[ Upstream commit c881d1c37b2c159d908203dba5c4920bc776046f ] + +The efuse block in the MT8188 contains the GPU speed bin cell, and like +the MT8186 one, has the same conversion scheme to work with the GPU OPP +binding. This was reflected in a corresponding change to the efuse DT +binding. + +Change the fallback compatible of the MT8188's efuse block from the +generic one to the MT8186 one. This also makes GPU DVFS work properly. + +Fixes: d39aacd1021a ("arm64: dts: mediatek: mt8188: add lvts definitions") +Fixes: 50e7592cb696 ("arm64: dts: mediatek: mt8188: Add GPU speed bin NVMEM cells") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250610063431.2955757-3-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8188.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8188.dtsi b/arch/arm64/boot/dts/mediatek/mt8188.dtsi +index 202478407727e..90c388f1890f5 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8188.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8188.dtsi +@@ -2183,7 +2183,7 @@ imp_iic_wrap_en: clock-controller@11ec2000 { + }; + + efuse: efuse@11f20000 { +- compatible = "mediatek,mt8188-efuse", "mediatek,efuse"; ++ compatible = "mediatek,mt8188-efuse", "mediatek,mt8186-efuse"; + reg = <0 0x11f20000 0 0x1000>; + #address-cells = <1>; + #size-cells = <1>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.17/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch new file mode 100644 index 0000000000..20efb852a0 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch @@ -0,0 +1,50 @@ +From dd94f00efb8603288339f17c0917ac1f74685acf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 17:59:59 +0800 +Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from + pcie0 + +From: Guoqing Jiang + +[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ] + +When test suspend resume with 6.8 based kernel, system can't resume +and I got below error which can be also reproduced with 6.16 rc6+ +kernel. + +mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) +mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110 +mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110 + +After investigation, looks pcie0 has the same problem as pcie1 as +decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195: +Remove suspend-breaking reset from pcie1"). + +Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") +Signed-off-by: Guoqing Jiang +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Macpaul Lin +Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 8877953ce292b..ab0b2f606eb43 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1588,9 +1588,6 @@ pcie0: pcie@112f0000 { + + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc0 0>, +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch b/queue-6.17/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch new file mode 100644 index 0000000000..57c661a3dd --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch @@ -0,0 +1,105 @@ +From ee94d8f3d6c4642d88145b441f02869485c18f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:13 +0200 +Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator + nodes + +From: AngeloGioacchino Del Regno + +[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ] + +All of the MT6360 regulator nodes were wrong and would not probe +because the regulator names are supposed to be lower case, but +they are upper case in this devicetree. + +Change all nodes to be lower case to get working regulators. + +Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +index 4985b65925a9e..d16f545cbbb27 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts +@@ -352,7 +352,7 @@ regulator { + LDO_VIN2-supply = <&vsys>; + LDO_VIN3-supply = <&vsys>; + +- mt6360_buck1: BUCK1 { ++ mt6360_buck1: buck1 { + regulator-name = "emi_vdd2"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <1800000>; +@@ -362,7 +362,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_buck2: BUCK2 { ++ mt6360_buck2: buck2 { + regulator-name = "emi_vddq"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1300000>; +@@ -372,7 +372,7 @@ MT6360_OPMODE_LP + regulator-always-on; + }; + +- mt6360_ldo1: LDO1 { ++ mt6360_ldo1: ldo1 { + regulator-name = "mt6360_ldo1"; /* Test point */ + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3600000>; +@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo2: LDO2 { ++ mt6360_ldo2: ldo2 { + regulator-name = "panel1_p1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo3: LDO3 { ++ mt6360_ldo3: ldo3 { + regulator-name = "vmc_pmu"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo5: LDO5 { ++ mt6360_ldo5: ldo5 { + regulator-name = "vmch_pmu"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo6: LDO6 { ++ mt6360_ldo6: ldo6 { + regulator-name = "mt6360_ldo6"; /* Test point */ + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <2100000>; +@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 { + MT6360_OPMODE_LP>; + }; + +- mt6360_ldo7: LDO7 { ++ mt6360_ldo7: ldo7 { + regulator-name = "emi_vmddr_en"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.17/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..2e2384fbe4 --- /dev/null +++ b/queue-6.17/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From 084db61cca1c70989d91c9938ebf4553f380d9de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-renesas-r9a09g047e57-smarc-fix-gpio-key-s-.patch b/queue-6.17/arm64-dts-renesas-r9a09g047e57-smarc-fix-gpio-key-s-.patch new file mode 100644 index 0000000000..9930fd76da --- /dev/null +++ b/queue-6.17/arm64-dts-renesas-r9a09g047e57-smarc-fix-gpio-key-s-.patch @@ -0,0 +1,48 @@ +From 79ae7e999c13a28c493d4492d93f5ff7c9fb66de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Aug 2025 15:51:30 +0100 +Subject: arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio key's pin control + node + +From: Biju Das + +[ Upstream commit 3e5df910b592d47734b6dcd03d57498d4766bf6c ] + +Adding pin control node to the child won't parse the pins during driver +bind. Fix the issue by moving it to parent node. + +This issue is observed while adding Schmitt input enable for PS0 pin on +later patch. Currently the reset value of the PIN is set to NMI function +and hence there is no breakage. + +Fixes: 9e95446b0cf9 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250817145135.166591-2-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts +index 1e67f0a2a945c..9f6716fa10860 100644 +--- a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts ++++ b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts +@@ -90,10 +90,10 @@ &i2c0 { + }; + + &keys { +- key-sleep { +- pinctrl-0 = <&nmi_pins>; +- pinctrl-names = "default"; ++ pinctrl-0 = <&nmi_pins>; ++ pinctrl-names = "default"; + ++ key-sleep { + interrupts-extended = <&icu 0 IRQ_TYPE_EDGE_FALLING>; + linux,code = ; + label = "SLEEP"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.17/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch new file mode 100644 index 0000000000..abdfe67b3e --- /dev/null +++ b/queue-6.17/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch @@ -0,0 +1,43 @@ +From facc6f88f14e4ef29a4e40b10a7c75d1cfd19286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 13:19:53 +0100 +Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 + +From: Biju Das + +[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ] + +On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we +are deleting a wrong and nonexistent node. Fixing the wrong node would +invoke a dtb warning message, as channel0 is a required property. +Disable CAN-FD channel0 instead of deleting the node. + +Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 345b779e4f601..f3d7eff0d2f2a 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -48,7 +48,10 @@ sound_card { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch b/queue-6.17/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch new file mode 100644 index 0000000000..979bf27049 --- /dev/null +++ b/queue-6.17/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch @@ -0,0 +1,42 @@ +From f1926178758cf8a6655281436f82c37c33318f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 01:58:11 +0200 +Subject: arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on + EVTB1 + +From: Marek Vasut + +[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ] + +Invert the polarity of microSD voltage selector on Retronix R-Car V4H +Sparrow Hawk board. The voltage selector was not populated on prototype +EVTA1 boards, and is implemented slightly different on EVTB1 boards. As +the EVTA1 boards are from a limited run and generally not available, +update the DT to make it compatible with EVTB1 microSD voltage selector. + +Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") +Signed-off-by: Marek Vasut +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +index 9ba23129e65ec..18411dfb524fd 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +@@ -185,7 +185,7 @@ vcc_sdhi: regulator-vcc-sdhi { + regulator-max-microvolt = <3300000>; + gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>; + gpios-states = <1>; +- states = <3300000 0>, <1800000 1>; ++ states = <1800000 0>, <3300000 1>; + }; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch b/queue-6.17/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch new file mode 100644 index 0000000000..ef1d36c384 --- /dev/null +++ b/queue-6.17/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch @@ -0,0 +1,45 @@ +From 1c48dbf5f0f41b6494540a918bd92cf511652a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 21:28:04 +0200 +Subject: arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1 + +From: Marek Vasut + +[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ] + +The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply +for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the +change in IO voltage. Since the VDDQ18_25_AVB power rail is shared, +all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to +be configured the same way. As the EVTA1 boards are from a limited run +and generally not available, update the DT to make it compatible with +EVTB1 IO voltage settings. + +Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") +Signed-off-by: Marek Vasut +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +index 18411dfb524fd..2c1ab75e4d910 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts +@@ -556,6 +556,10 @@ pins-mii { + drive-strength = <21>; + }; + ++ pins-vddq18-25-avb { ++ pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0"; ++ power-source = <1800>; ++ }; + }; + + /* Page 28 / CANFD_IF */ +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-add-rtc-on-rk3576-evb1-v10.patch b/queue-6.17/arm64-dts-rockchip-add-rtc-on-rk3576-evb1-v10.patch new file mode 100644 index 0000000000..0e80cd1e9e --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-add-rtc-on-rk3576-evb1-v10.patch @@ -0,0 +1,67 @@ +From 97790638fa9f6ce1e2b1961539b37a411dd8cc8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 00:30:23 +0400 +Subject: arm64: dts: rockchip: Add RTC on rk3576-evb1-v10 + +From: Alexey Charkov + +[ Upstream commit 0adaae77862932a19cc14c086d7fd15ec0ef7703 ] + +Add the I2C connected RTC chip to the Rockchip RK3576 EVB1 board. + +Apart from the realtime clock functionality, it also provides a 32 kHz +clock source for the onboard WiFi chip. + +Tested-by: Pavel Zhovner +Signed-off-by: Alexey Charkov +Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-1-d13c83422971@gmail.com +Signed-off-by: Heiko Stuebner +Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board") +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3576-evb1-v10.dts | 22 +++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +index 56527c56830e3..bfefd37a1ab8c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +@@ -680,6 +680,22 @@ regulator-state-mem { + }; + }; + ++&i2c2 { ++ status = "okay"; ++ ++ hym8563: rtc@51 { ++ compatible = "haoyu,hym8563"; ++ reg = <0x51>; ++ clock-output-names = "hym8563"; ++ interrupt-parent = <&gpio0>; ++ interrupts = ; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&rtc_int>; ++ wakeup-source; ++ #clock-cells = <0>; ++ }; ++}; ++ + &mdio0 { + rgmii_phy0: phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; +@@ -708,6 +724,12 @@ &pcie1 { + }; + + &pinctrl { ++ hym8563 { ++ rtc_int: rtc-int { ++ rockchip,pins = <0 RK_PA0 RK_FUNC_GPIO &pcfg_pull_up>; ++ }; ++ }; ++ + usb { + usb_host_pwren: usb-host-pwren { + rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-add-wifi-on-rk3576-evb1-v10.patch b/queue-6.17/arm64-dts-rockchip-add-wifi-on-rk3576-evb1-v10.patch new file mode 100644 index 0000000000..565531710f --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-add-wifi-on-rk3576-evb1-v10.patch @@ -0,0 +1,126 @@ +From 6b864b0f4300a4d2aa880eab2bfc07563b103feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 00:30:24 +0400 +Subject: arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10 + +From: Alexey Charkov + +[ Upstream commit ebf8183ad08afc4fcabe1379a5098354829d950d ] + +Add device tree nodes to enable the onboard Ampak AP6275P WiFi chip +connected over a PCIe link on Rockchip RK3576 EVB1. + +It takes an external 32 kHz clock from the RTC chip and requires the +WIFI_REG_ON signal to be enabled before the bus is enumerated to +initialize properly. + +Tested-by: Pavel Zhovner +Signed-off-by: Alexey Charkov +Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-2-d13c83422971@gmail.com +Signed-off-by: Heiko Stuebner +Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board") +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3576-evb1-v10.dts | 58 +++++++++++++++++++ + 1 file changed, 58 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +index bfefd37a1ab8c..3007e0179611b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +@@ -232,6 +232,20 @@ vcc_ufs_s0: regulator-vcc-ufs-s0 { + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc_sys>; + }; ++ ++ vcc_wifi_reg_on: regulator-wifi-reg-on { ++ compatible = "regulator-fixed"; ++ enable-active-high; ++ gpios = <&gpio1 RK_PC6 GPIO_ACTIVE_HIGH>; ++ pinctrl-0 = <&wifi_reg_on>; ++ pinctrl-names = "default"; ++ regulator-name = "wifi_reg_on"; ++ regulator-always-on; ++ regulator-boot-on; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ vin-supply = <&vcc_1v8_s3>; ++ }; + }; + + &cpu_l0 { +@@ -242,6 +256,10 @@ &cpu_b0 { + cpu-supply = <&vdd_cpu_big_s0>; + }; + ++&combphy0_ps { ++ status = "okay"; ++}; ++ + &combphy1_psu { + status = "okay"; + }; +@@ -712,6 +730,30 @@ rgmii_phy1: phy@1 { + }; + }; + ++&pcie0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pcie0_rst>; ++ reset-gpios = <&gpio2 RK_PB4 GPIO_ACTIVE_HIGH>; ++ vpcie3v3-supply = <&vcc_3v3_s3>; ++ status = "okay"; ++ ++ pcie@0,0 { ++ reg = <0x0 0 0 0 0>; ++ bus-range = <0x0 0xf>; ++ device_type = "pci"; ++ ranges; ++ #address-cells = <3>; ++ #size-cells = <2>; ++ ++ wifi: wifi@0,0 { ++ compatible = "pci14e4,449d"; ++ reg = <0x10000 0 0 0 0>; ++ clocks = <&hym8563>; ++ clock-names = "lpo"; ++ }; ++ }; ++}; ++ + &pcie1 { + reset-gpios = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>; + vpcie3v3-supply = <&vcc3v3_pcie1>; +@@ -730,6 +772,12 @@ rtc_int: rtc-int { + }; + }; + ++ pcie0 { ++ pcie0_rst: pcie0-rst { ++ rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + usb { + usb_host_pwren: usb-host-pwren { + rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>; +@@ -743,6 +791,16 @@ usbc0_int: usbc0-int { + rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; ++ ++ wifi { ++ wifi_reg_on: wifi-reg-on { ++ rockchip,pins = <1 RK_PC6 RK_FUNC_GPIO &pcfg_pull_up>; ++ }; ++ ++ wifi_wake_host: wifi-wake-host { ++ rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_down>; ++ }; ++ }; + }; + + &sdmmc { +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-fix-network-on-rk3576-evb1-board.patch b/queue-6.17/arm64-dts-rockchip-fix-network-on-rk3576-evb1-board.patch new file mode 100644 index 0000000000..575016022f --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-fix-network-on-rk3576-evb1-board.patch @@ -0,0 +1,110 @@ +From c54a6686066361074e6bb027bc9ee0cb5ed6929b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 15:54:51 +0200 +Subject: arm64: dts: rockchip: Fix network on rk3576 evb1 board + +From: Sebastian Reichel + +[ Upstream commit 843367c7ed196bd0806c8776cba108aaf6923b82 ] + +The RK3576 EVB1 has a RTL8211F PHY for each GMAC interface with +a dedicated reset line and the 25MHz clock provided by the SoC. +The current description results in non-working Ethernet as the +clocks are only enabled by the PHY driver, but probing the right +PHY driver currently requires that the PHY ID register can be read +for automatic identification. + +This fixes up the network description to get the network functionality +working reliably and cleans up usage of deprecated DT properties while +at it. + +Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board") +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20250910-rk3576-evb-network-v1-1-68ed4df272a2@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3576-evb1-v10.dts | 38 ++++++++++++++----- + 1 file changed, 28 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +index 3007e0179611b..012c21b58a5a1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts +@@ -275,9 +275,6 @@ ð0m0_rx_bus2 + ð0m0_rgmii_clk + ð0m0_rgmii_bus + ðm0_clk0_25m_out>; +- snps,reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; +- snps,reset-active-low; +- snps,reset-delays-us = <0 20000 100000>; + tx_delay = <0x21>; + status = "okay"; + }; +@@ -293,9 +290,6 @@ ð1m0_rx_bus2 + ð1m0_rgmii_clk + ð1m0_rgmii_bus + ðm0_clk1_25m_out>; +- snps,reset-gpio = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>; +- snps,reset-active-low; +- snps,reset-delays-us = <0 20000 100000>; + tx_delay = <0x20>; + status = "okay"; + }; +@@ -715,18 +709,32 @@ hym8563: rtc@51 { + }; + + &mdio0 { +- rgmii_phy0: phy@1 { +- compatible = "ethernet-phy-ieee802.3-c22"; ++ rgmii_phy0: ethernet-phy@1 { ++ compatible = "ethernet-phy-id001c.c916"; + reg = <0x1>; + clocks = <&cru REFCLKO25M_GMAC0_OUT>; ++ assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>; ++ assigned-clock-rates = <25000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&rgmii_phy0_rst>; ++ reset-assert-us = <20000>; ++ reset-deassert-us = <100000>; ++ reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; + }; + }; + + &mdio1 { +- rgmii_phy1: phy@1 { +- compatible = "ethernet-phy-ieee802.3-c22"; ++ rgmii_phy1: ethernet-phy@1 { ++ compatible = "ethernet-phy-id001c.c916"; + reg = <0x1>; + clocks = <&cru REFCLKO25M_GMAC1_OUT>; ++ assigned-clocks = <&cru REFCLKO25M_GMAC1_OUT>; ++ assigned-clock-rates = <25000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&rgmii_phy1_rst>; ++ reset-assert-us = <20000>; ++ reset-deassert-us = <100000>; ++ reset-gpios = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>; + }; + }; + +@@ -772,6 +780,16 @@ rtc_int: rtc-int { + }; + }; + ++ network { ++ rgmii_phy0_rst: rgmii-phy0-rst { ++ rockchip,pins = <2 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ ++ rgmii_phy1_rst: rgmii-phy1-rst { ++ rockchip,pins = <3 RK_PA3 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + pcie0 { + pcie0_rst: pcie0-rst { + rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch b/queue-6.17/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch new file mode 100644 index 0000000000..b32e2fd88b --- /dev/null +++ b/queue-6.17/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch @@ -0,0 +1,65 @@ +From 412ca986e7b4e889faef864cf51cc2503cc479c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 22:01:11 +0530 +Subject: arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU + R5F cores + +From: Beleswar Padhi + +[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ] + +The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi +for its MCU domain, but it does not override the firmware-name property +for its R5F cores. This causes the wrong firmware binaries to be +referenced. + +Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the +firmware-name property with correct names for J742s2. + +Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family") +Signed-off-by: Beleswar Padhi +Reviewed-by: Udit Kumar +Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++ + arch/arm64/boot/dts/ti/k3-j742s2.dtsi | 1 + + 2 files changed, 18 insertions(+) + create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi + +diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi +new file mode 100644 +index 0000000000000..61db2348d6a47 +--- /dev/null ++++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi +@@ -0,0 +1,17 @@ ++// SPDX-License-Identifier: GPL-2.0-only OR MIT ++/* ++ * Device Tree Source for J742S2 SoC Family ++ * ++ * TRM: https://www.ti.com/lit/pdf/spruje3 ++ * ++ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/ ++ * ++ */ ++ ++&mcu_r5fss0_core0 { ++ firmware-name = "j742s2-mcu-r5f0_0-fw"; ++}; ++ ++&mcu_r5fss0_core1 { ++ firmware-name = "j742s2-mcu-r5f0_1-fw"; ++}; +diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi +index 7a72f82f56d68..d265df1abade1 100644 +--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi +@@ -96,3 +96,4 @@ cpu3: cpu@3 { + }; + + #include "k3-j742s2-main.dtsi" ++#include "k3-j742s2-mcu-wakeup.dtsi" +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-ti-k3-pinctrl-fix-the-bug-in-existing-macr.patch b/queue-6.17/arm64-dts-ti-k3-pinctrl-fix-the-bug-in-existing-macr.patch new file mode 100644 index 0000000000..cd964bc407 --- /dev/null +++ b/queue-6.17/arm64-dts-ti-k3-pinctrl-fix-the-bug-in-existing-macr.patch @@ -0,0 +1,46 @@ +From bd6bdbda25d6ca3e5e709608285d70c7a93657c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 10:11:08 +0530 +Subject: arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros + +From: Akashdeep Kaur + +[ Upstream commit 2e79ee4d64e9ba4a3fc90e91dfd715407efab16d ] + +Currently, DS_IO_OVERRIDE_EN_SHIFT macro is not defined anywhere but +used for defining other macro. +Replace this undefined macro with valid macro. Rename the existing macro +to reflect the actual behavior. + +Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros") + +Reviewed-by: Kendall Willis +Reviewed-by: Dhruva Gole +Reviewed-by: Vignesh Raghavendra +Signed-off-by: Akashdeep Kaur +Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros") +Link: https://patch.msgid.link/20250909044108.2541534-5-a-kaur@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-pinctrl.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-pinctrl.h b/arch/arm64/boot/dts/ti/k3-pinctrl.h +index c0f09be8d3f94..146b780f3bd4a 100644 +--- a/arch/arm64/boot/dts/ti/k3-pinctrl.h ++++ b/arch/arm64/boot/dts/ti/k3-pinctrl.h +@@ -55,8 +55,8 @@ + + #define PIN_DS_FORCE_DISABLE (0 << FORCE_DS_EN_SHIFT) + #define PIN_DS_FORCE_ENABLE (1 << FORCE_DS_EN_SHIFT) +-#define PIN_DS_IO_OVERRIDE_DISABLE (0 << DS_IO_OVERRIDE_EN_SHIFT) +-#define PIN_DS_IO_OVERRIDE_ENABLE (1 << DS_IO_OVERRIDE_EN_SHIFT) ++#define PIN_DS_ISO_OVERRIDE_DISABLE (0 << ISO_OVERRIDE_EN_SHIFT) ++#define PIN_DS_ISO_OVERRIDE_ENABLE (1 << ISO_OVERRIDE_EN_SHIFT) + #define PIN_DS_OUT_ENABLE (0 << DS_OUT_DIS_SHIFT) + #define PIN_DS_OUT_DISABLE (1 << DS_OUT_DIS_SHIFT) + #define PIN_DS_OUT_VALUE_ZERO (0 << DS_OUT_VAL_SHIFT) +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-ti-k3-rename-rproc-reserved-mem-nodes-to-m.patch b/queue-6.17/arm64-dts-ti-k3-rename-rproc-reserved-mem-nodes-to-m.patch new file mode 100644 index 0000000000..dee0576fd7 --- /dev/null +++ b/queue-6.17/arm64-dts-ti-k3-rename-rproc-reserved-mem-nodes-to-m.patch @@ -0,0 +1,2229 @@ +From cbbcd71b4c72a1c55a92d7d5ebbbc9bdfd176f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 19:58:05 +0530 +Subject: arm64: dts: ti: k3: Rename rproc reserved-mem nodes to 'memory@addr' + +From: Beleswar Padhi + +[ Upstream commit aee0678597c63e5427e91b2e49a6c5ed4951f277 ] + +Currently, the reserved memory carveouts used by remote processors are +named like 'rproc-name--memory-region@addr'. While it is +descriptive, the node label already serves that purpose. Rename reserved +memory nodes to generic 'memory@addr' to align with the device tree +specifications. This is done for all TI K3 based boards. + +Signed-off-by: Beleswar Padhi +Reviewed-by: Francesco Dolcini +Link: https://patch.msgid.link/20250908142826.1828676-14-b-padhi@ti.com +Signed-off-by: Nishanth Menon +Stable-dep-of: 79a1778c7819 ("Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations"") +Signed-off-by: Sasha Levin +--- + .../boot/dts/ti/k3-am62-phycore-som.dtsi | 10 ++-- + .../boot/dts/ti/k3-am62-pocketbeagle2.dts | 6 +-- + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- + .../arm64/boot/dts/ti/k3-am625-beagleplay.dts | 2 +- + .../boot/dts/ti/k3-am62a-phycore-som.dtsi | 12 ++--- + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 12 ++--- + arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 14 +++--- + arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +- + arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 8 ++-- + .../arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 8 ++-- + .../boot/dts/ti/k3-am64-phycore-som.dtsi | 22 ++++----- + arch/arm64/boot/dts/ti/k3-am642-evm.dts | 22 ++++----- + arch/arm64/boot/dts/ti/k3-am642-sk.dts | 22 ++++----- + arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi | 16 +++---- + .../arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi | 18 +++---- + .../boot/dts/ti/k3-am65-iot2050-common.dtsi | 10 ++-- + .../arm64/boot/dts/ti/k3-am654-base-board.dts | 10 ++-- + .../arm64/boot/dts/ti/k3-am67a-beagley-ai.dts | 22 ++++----- + .../boot/dts/ti/k3-am68-phycore-som.dtsi | 34 ++++++------- + arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi | 34 ++++++------- + arch/arm64/boot/dts/ti/k3-am69-sk.dts | 48 +++++++++---------- + arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi | 18 +++---- + .../boot/dts/ti/k3-j721e-beagleboneai64.dts | 38 +++++++-------- + arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 38 +++++++-------- + arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi | 38 +++++++-------- + arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi | 34 ++++++------- + arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 22 ++++----- + arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 4 +- + .../dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 44 ++++++++--------- + 29 files changed, 285 insertions(+), 285 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi +index 10e6b5c08619e..737ff54c3cd2f 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi +@@ -46,31 +46,31 @@ ramoops@9c700000 { + pmsg-size = <0x8000>; + }; + +- rtos_ipc_memory_region: ipc-memories@9c800000 { ++ rtos_ipc_memory_region: memory@9c800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c800000 0x00 0x00300000>; + no-map; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 { ++ mcu_m4fss_dma_memory_region: memory@9cb00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cb00000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@9cc00000 { ++ mcu_m4fss_memory_region: memory@9cc00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cc00000 0x00 0xe00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9da00000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 { ++ wkup_r5fss0_core0_memory_region: memory@9db00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9db00000 0x00 0xc00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts +index 2e4cf65ee3239..1c95947430d3e 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts +@@ -54,13 +54,13 @@ linux,cma { + linux,cma-default; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 { ++ mcu_m4fss_dma_memory_region: memory@9cb00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cb00000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@9cc00000 { ++ mcu_m4fss_memory_region: memory@9cc00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cc00000 0x00 0xe00000>; + no-map; +@@ -78,7 +78,7 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9db00000 0x00 0xc00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +index bc2289d747745..2b8b2c76e9946 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +@@ -206,7 +206,7 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9db00000 0x00 0xc00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts +index 72b09f9c69d8c..7028d9835c4a8 100644 +--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts ++++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts +@@ -83,7 +83,7 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9db00000 0x00 0xc00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi +index 5dc5d2cb20ccd..175fa5048a0bc 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi +@@ -59,37 +59,37 @@ linux,cma { + linux,cma-default; + }; + +- c7x_0_dma_memory_region: c7x-dma-memory@99800000 { ++ c7x_0_dma_memory_region: memory@99800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99800000 0x00 0x100000>; + no-map; + }; + +- c7x_0_memory_region: c7x-memory@99900000 { ++ c7x_0_memory_region: memory@99900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99900000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b800000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 { ++ mcu_r5fss0_core0_memory_region: memory@9b900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b900000 0x00 0xf00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c800000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 { ++ wkup_r5fss0_core0_memory_region: memory@9c900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c900000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +index bceead5e288e6..4761c3dc2d8e6 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +@@ -53,37 +53,37 @@ linux,cma { + linux,cma-default; + }; + +- c7x_0_dma_memory_region: c7x-dma-memory@99800000 { ++ c7x_0_dma_memory_region: memory@99800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99800000 0x00 0x100000>; + no-map; + }; + +- c7x_0_memory_region: c7x-memory@99900000 { ++ c7x_0_memory_region: memory@99900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99900000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b800000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 { ++ mcu_r5fss0_core0_memory_region: memory@9b900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b900000 0x00 0xf00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c800000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 { ++ wkup_r5fss0_core0_memory_region: memory@9c900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c900000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts +index daea18b0bc61c..19a7ca7ee173a 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts +@@ -58,37 +58,37 @@ secure_tfa_ddr: tfa@80000000 { + no-map; + }; + +- c7x_0_dma_memory_region: c7x-dma-memory@99800000 { ++ c7x_0_dma_memory_region: memory@99800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99800000 0x00 0x100000>; + no-map; + }; + +- c7x_0_memory_region: c7x-memory@99900000 { ++ c7x_0_memory_region: memory@99900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x99900000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b800000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 { ++ mcu_r5fss0_core0_memory_region: memory@9b900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b900000 0x00 0xf00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c800000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 { ++ wkup_r5fss0_core0_memory_region: memory@9c900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c900000 0x00 0xf00000>; + no-map; +@@ -100,7 +100,7 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a0000000 { ++ rtos_ipc_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x01000000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi +index a2fdc6741da2c..3963dbc1faeff 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi +@@ -162,7 +162,7 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 { ++ wkup_r5fss0_core0_memory_region: memory@9c900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c900000 0x00 0x01e00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +index 899da7896563b..2e081c329d6c2 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +@@ -49,25 +49,25 @@ reserved-memory { + #size-cells = <2>; + ranges; + +- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@9b800000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b800000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@9b900000 { ++ mcu_r5fss0_core0_memory_region: memory@9b900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9b900000 0x00 0xf00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c800000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-memory@9c900000 { ++ wkup_r5fss0_core0_memory_region: memory@9c900000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9c900000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi +index 13e1d36123d51..8eed8be2e8bad 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi +@@ -58,25 +58,25 @@ linux,cma { + linux,cma-default; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 { ++ mcu_m4fss_dma_memory_region: memory@9cb00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cb00000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@9cc00000 { ++ mcu_m4fss_memory_region: memory@9cc00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9cc00000 0x00 0xe00000>; + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9da00000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 { ++ wkup_r5fss0_core0_memory_region: memory@9db00000 { + compatible = "shared-dma-pool"; + reg = <0x00 0x9db00000 0x00 0xc00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi +index d9d491b12c33a..97ad433e49394 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi +@@ -41,67 +41,67 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ main_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ main_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss1_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss1_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 { ++ mcu_m4fss_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@a4100000 { ++ mcu_m4fss_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x00800000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-evm.dts b/arch/arm64/boot/dts/ti/k3-am642-evm.dts +index e01866372293b..ccb04a3d97c9a 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-evm.dts +@@ -53,67 +53,67 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ main_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ main_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss1_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss1_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 { ++ mcu_m4fss_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@a4100000 { ++ mcu_m4fss_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x00800000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-sk.dts b/arch/arm64/boot/dts/ti/k3-am642-sk.dts +index 1deaa0be0085c..1982608732ee2 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-sk.dts +@@ -51,67 +51,67 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ main_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ main_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss1_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss1_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 { ++ mcu_m4fss_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- mcu_m4fss_memory_region: m4f-memory@a4100000 { ++ mcu_m4fss_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x00800000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi +index a5cec9a075109..dfe570e0b7071 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi +@@ -115,49 +115,49 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ main_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ main_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss1_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss1_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi +index 828d815d6bdfc..a8d5144ab1b33 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi +@@ -31,55 +31,55 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ main_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ main_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss1_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss1_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x00800000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi +index e5136ed947651..211eb9d93159d 100644 +--- a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi +@@ -47,31 +47,31 @@ secure_ddr: secure-ddr@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0 0xa0000000 0 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0 0xa0100000 0 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0 0xa1000000 0 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0 0xa1100000 0 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a2000000 { ++ rtos_ipc_memory_region: memory@a2000000 { + reg = <0x00 0xa2000000 0x00 0x00200000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts +index e589690c7c821..dac36ca77a30e 100644 +--- a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts +@@ -50,31 +50,31 @@ secure_ddr: secure-ddr@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0 0xa0000000 0 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0 0xa0100000 0 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0 0xa1000000 0 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0 0xa1100000 0 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a2000000 { ++ rtos_ipc_memory_region: memory@a2000000 { + reg = <0x00 0xa2000000 0x00 0x00100000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts +index bf9b23df1da2a..859294b9a2f31 100644 +--- a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts ++++ b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts +@@ -50,67 +50,67 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ wkup_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 { ++ mcu_r5fss0_core0_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 { ++ c7x_0_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- c7x_0_memory_region: c7x-memory@a3100000 { ++ c7x_0_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 { ++ c7x_1_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- c7x_1_memory_region: c7x-memory@a4100000 { ++ c7x_1_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x1c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi +index fd715fee8170e..71f56f0f5363c 100644 +--- a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi +@@ -49,103 +49,103 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a6000000 { ++ c71_0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a6100000 { ++ c71_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c71_1_dma_memory_region: c71-dma-memory@a7000000 { ++ c71_1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c71_1_memory_region: c71-memory@a7100000 { ++ c71_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a8000000 { ++ rtos_ipc_memory_region: memory@a8000000 { + reg = <0x00 0xa8000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi +index 4ca2d4e2fb9b0..ecc7b3a100d00 100644 +--- a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi +@@ -27,103 +27,103 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a6000000 { ++ c71_0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a6100000 { ++ c71_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c71_1_dma_memory_region: c71-dma-memory@a7000000 { ++ c71_1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c71_1_memory_region: c71-memory@a7100000 { ++ c71_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a8000000 { ++ rtos_ipc_memory_region: memory@a8000000 { + reg = <0x00 0xa8000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts +index 612ac27643d2c..922866b96e66a 100644 +--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts +@@ -49,145 +49,145 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 { ++ main_r5fss2_core0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss2_core0_memory_region: r5f-memory@a6100000 { ++ main_r5fss2_core0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 { ++ main_r5fss2_core1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss2_core1_memory_region: r5f-memory@a7100000 { ++ main_r5fss2_core1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a8000000 { ++ c71_0_dma_memory_region: memory@a8000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a8100000 { ++ c71_0_memory_region: memory@a8100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8100000 0x00 0xf00000>; + no-map; + }; + +- c71_1_dma_memory_region: c71-dma-memory@a9000000 { ++ c71_1_dma_memory_region: memory@a9000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa9000000 0x00 0x100000>; + no-map; + }; + +- c71_1_memory_region: c71-memory@a9100000 { ++ c71_1_memory_region: memory@a9100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa9100000 0x00 0xf00000>; + no-map; + }; + +- c71_2_dma_memory_region: c71-dma-memory@aa000000 { ++ c71_2_dma_memory_region: memory@aa000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xaa000000 0x00 0x100000>; + no-map; + }; + +- c71_2_memory_region: c71-memory@aa100000 { ++ c71_2_memory_region: memory@aa100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xaa100000 0x00 0xf00000>; + no-map; + }; + +- c71_3_dma_memory_region: c71-dma-memory@ab000000 { ++ c71_3_dma_memory_region: memory@ab000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xab000000 0x00 0x100000>; + no-map; + }; + +- c71_3_memory_region: c71-memory@ab100000 { ++ c71_3_memory_region: memory@ab100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xab100000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi +index 291ab9bb414d7..e8cec315e381b 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi +@@ -29,55 +29,55 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a4000000 { ++ rtos_ipc_memory_region: memory@a4000000 { + reg = <0x00 0xa4000000 0x00 0x00800000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts +index fb899c99753ec..6a1b32169678e 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts +@@ -51,115 +51,115 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c66_0_dma_memory_region: c66-dma-memory@a6000000 { ++ c66_0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c66_0_memory_region: c66-memory@a6100000 { ++ c66_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c66_1_dma_memory_region: c66-dma-memory@a7000000 { ++ c66_1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c66_1_memory_region: c66-memory@a7100000 { ++ c66_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a8000000 { ++ c71_0_dma_memory_region: memory@a8000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a8100000 { ++ c71_0_memory_region: memory@a8100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@aa000000 { ++ rtos_ipc_memory_region: memory@aa000000 { + reg = <0x00 0xaa000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +index ffef3d1cfd553..d1b0257048de2 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +@@ -48,115 +48,115 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c66_0_dma_memory_region: c66-dma-memory@a6000000 { ++ c66_0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c66_0_memory_region: c66-memory@a6100000 { ++ c66_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c66_1_dma_memory_region: c66-dma-memory@a7000000 { ++ c66_1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c66_1_memory_region: c66-memory@a7100000 { ++ c66_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a8000000 { ++ c71_0_dma_memory_region: memory@a8000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a8100000 { ++ c71_0_memory_region: memory@a8100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@aa000000 { ++ rtos_ipc_memory_region: memory@aa000000 { + reg = <0x00 0xaa000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi +index 0722f6361cc8b..ef11a5fb6ad56 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi +@@ -29,115 +29,115 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c66_1_dma_memory_region: c66-dma-memory@a6000000 { ++ c66_1_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c66_0_memory_region: c66-memory@a6100000 { ++ c66_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c66_0_dma_memory_region: c66-dma-memory@a7000000 { ++ c66_0_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c66_1_memory_region: c66-memory@a7100000 { ++ c66_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a8000000 { ++ c71_0_dma_memory_region: memory@a8000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a8100000 { ++ c71_0_memory_region: memory@a8100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@aa000000 { ++ rtos_ipc_memory_region: memory@aa000000 { + reg = <0x00 0xaa000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi +index 54fc5c4f8c3f5..391e8e3ac2680 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi +@@ -31,103 +31,103 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a6000000 { ++ c71_0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a6100000 { ++ c71_0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- c71_1_dma_memory_region: c71-dma-memory@a7000000 { ++ c71_1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- c71_1_memory_region: c71-memory@a7100000 { ++ c71_1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a8000000 { ++ rtos_ipc_memory_region: memory@a8000000 { + reg = <0x00 0xa8000000 0x00 0x01c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts +index 9d8abfa9afd27..4cfe5c88e48f5 100644 +--- a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts +@@ -52,67 +52,67 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ wkup_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 { ++ mcu_r5fss0_core0_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 { ++ c7x_0_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- c7x_0_memory_region: c7x-memory@a3100000 { ++ c7x_0_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 { ++ c7x_1_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- c7x_1_memory_region: c7x-memory@a4100000 { ++ c7x_1_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- rtos_ipc_memory_region: ipc-memories@a5000000 { ++ rtos_ipc_memory_region: memory@a5000000 { + reg = <0x00 0xa5000000 0x00 0x1c00000>; + alignment = <0x1000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts +index a84bde08f85e4..2ed1ec6d53c88 100644 +--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts +@@ -28,13 +28,13 @@ reserved_memory: reserved-memory { + #address-cells = <2>; + #size-cells = <2>; + +- c71_3_dma_memory_region: c71-dma-memory@ab000000 { ++ c71_3_dma_memory_region: memory@ab000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xab000000 0x00 0x100000>; + no-map; + }; + +- c71_3_memory_region: c71-memory@ab100000 { ++ c71_3_memory_region: memory@ab100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xab100000 0x00 0xf00000>; + no-map; +diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi +index fa656b7b13a1d..877b50991ee69 100644 +--- a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi +@@ -35,133 +35,133 @@ secure_ddr: optee@9e800000 { + no-map; + }; + +- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 { ++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 { ++ mcu_r5fss0_core0_memory_region: memory@a0100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa0100000 0x00 0xf00000>; + no-map; + }; + +- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 { ++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1000000 0x00 0x100000>; + no-map; + }; + +- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 { ++ mcu_r5fss0_core1_memory_region: memory@a1100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa1100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 { ++ main_r5fss0_core0_dma_memory_region: memory@a2000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core0_memory_region: r5f-memory@a2100000 { ++ main_r5fss0_core0_memory_region: memory@a2100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa2100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 { ++ main_r5fss0_core1_dma_memory_region: memory@a3000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss0_core1_memory_region: r5f-memory@a3100000 { ++ main_r5fss0_core1_memory_region: memory@a3100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa3100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 { ++ main_r5fss1_core0_dma_memory_region: memory@a4000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core0_memory_region: r5f-memory@a4100000 { ++ main_r5fss1_core0_memory_region: memory@a4100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa4100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 { ++ main_r5fss1_core1_dma_memory_region: memory@a5000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss1_core1_memory_region: r5f-memory@a5100000 { ++ main_r5fss1_core1_memory_region: memory@a5100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa5100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 { ++ main_r5fss2_core0_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss2_core0_memory_region: r5f-memory@a6100000 { ++ main_r5fss2_core0_memory_region: memory@a6100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6100000 0x00 0xf00000>; + no-map; + }; + +- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 { ++ main_r5fss2_core1_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; + }; + +- main_r5fss2_core1_memory_region: r5f-memory@a7100000 { ++ main_r5fss2_core1_memory_region: memory@a7100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7100000 0x00 0xf00000>; + no-map; + }; + +- c71_0_dma_memory_region: c71-dma-memory@a8000000 { ++ c71_0_dma_memory_region: memory@a8000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8000000 0x00 0x100000>; + no-map; + }; + +- c71_0_memory_region: c71-memory@a8100000 { ++ c71_0_memory_region: memory@a8100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa8100000 0x00 0xf00000>; + no-map; + }; + +- c71_1_dma_memory_region: c71-dma-memory@a9000000 { ++ c71_1_dma_memory_region: memory@a9000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa9000000 0x00 0x100000>; + no-map; + }; + +- c71_1_memory_region: c71-memory@a9100000 { ++ c71_1_memory_region: memory@a9100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa9100000 0x00 0xf00000>; + no-map; + }; + +- c71_2_dma_memory_region: c71-dma-memory@aa000000 { ++ c71_2_dma_memory_region: memory@aa000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xaa000000 0x00 0x100000>; + no-map; + }; + +- c71_2_memory_region: c71-memory@aa100000 { ++ c71_2_memory_region: memory@aa100000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xaa100000 0x00 0xf00000>; + no-map; +-- +2.51.0 + diff --git a/queue-6.17/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.17/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..f6600fbfa4 --- /dev/null +++ b/queue-6.17/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From 830999f17be0c2a47f32424e3cbfe1dbf23ce8e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 62594e7966ab0..b384d38654e65 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -47,7 +47,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-6.17/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.17/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..94678511b1 --- /dev/null +++ b/queue-6.17/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From f3d4497997ef924d2d3ba5848f00d0ab44ccda2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 0f3b8f44e7011..bc846558480e4 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-6.17/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.17/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..2e9a7b3b05 --- /dev/null +++ b/queue-6.17/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From 87a1f6665e35a635d844fb9e3a7d8a49d268eee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 67c62844ca2a9..604a35d380e9a 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-6.17/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch b/queue-6.17/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch new file mode 100644 index 0000000000..593cffc49c --- /dev/null +++ b/queue-6.17/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch @@ -0,0 +1,42 @@ +From e41e52799321482f8fdc87d6beeb326b0ea4951c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 10:48:53 +0800 +Subject: ASoC: Intel: hda-sdw-bpt: set persistent_buffer false +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ] + +The persistent_buffer agreement is false when hda_cl_prepare() is +called. We should use the same value when hda_cl_cleanup() is called. + +Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA") +Signed-off-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-sdw-bpt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c +index 1327f1cad0bcd..ff5abccf0d88b 100644 +--- a/sound/soc/sof/intel/hda-sdw-bpt.c ++++ b/sound/soc/sof/intel/hda-sdw-bpt.c +@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream + u32 mask; + int ret; + +- ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream); ++ ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream); + if (ret < 0) { + dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n", + __func__); +-- +2.51.0 + diff --git a/queue-6.17/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch b/queue-6.17/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch new file mode 100644 index 0000000000..66d6349c80 --- /dev/null +++ b/queue-6.17/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch @@ -0,0 +1,41 @@ +From f09777265746d76f9e9e871e9c0e08c3b5bbfc16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:02:35 +0100 +Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback + +From: Richard Fitzgerald + +[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ] + +In create_sdw_dailink() check that sof_end->codec_info->add_sidecar +is not NULL before calling it. + +The original code assumed that if include_sidecar is true, the codec +on that link has an add_sidecar callback. But there could be other +codecs on the same link that do not have an add_sidecar callback. + +Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices") +Signed-off-by: Richard Fitzgerald +Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 28f03a5f29f74..c013e31d098e7 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card, + (*codec_conf)++; + } + +- if (sof_end->include_sidecar) { ++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) { + ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf); + if (ret) + return ret; +-- +2.51.0 + diff --git a/queue-6.17/asoc-qcom-sc8280xp-use-sa8775p-subdir-for-qcs9100-qc.patch b/queue-6.17/asoc-qcom-sc8280xp-use-sa8775p-subdir-for-qcs9100-qc.patch new file mode 100644 index 0000000000..f0b9665a4b --- /dev/null +++ b/queue-6.17/asoc-qcom-sc8280xp-use-sa8775p-subdir-for-qcs9100-qc.patch @@ -0,0 +1,44 @@ +From 9a8fd8f49114d061cbd7b45cf2917c2230cad447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 22:34:02 +0300 +Subject: ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 + +From: Dmitry Baryshkov + +[ Upstream commit ba0c67d3c4b0ce5ec5e6de35e6433b22eecb1f6a ] + +All firmware for the Lemans platform aka QCS9100 aka QCS9075 is for +historical reasons located in the qcom/sa8775p/ subdir inside +linux-firmware. The only exceptions to this rule are audio topology +files. While it's not too late, change the subdir to point to the +sa8775p/ subdir, so that all firmware for that platform is present at +the same location. + +Fixes: 5b5bf5922f4c ("ASoC: qcom: sc8280xp: Add sound card support for QCS9100 and QCS9075") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20250924-lemans-evk-topo-v2-1-7d44909a5758@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/sc8280xp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c +index 288ccd7f8866a..6847ae4acbd18 100644 +--- a/sound/soc/qcom/sc8280xp.c ++++ b/sound/soc/qcom/sc8280xp.c +@@ -191,8 +191,8 @@ static const struct of_device_id snd_sc8280xp_dt_match[] = { + {.compatible = "qcom,qcm6490-idp-sndcard", "qcm6490"}, + {.compatible = "qcom,qcs6490-rb3gen2-sndcard", "qcs6490"}, + {.compatible = "qcom,qcs8275-sndcard", "qcs8300"}, +- {.compatible = "qcom,qcs9075-sndcard", "qcs9075"}, +- {.compatible = "qcom,qcs9100-sndcard", "qcs9100"}, ++ {.compatible = "qcom,qcs9075-sndcard", "sa8775p"}, ++ {.compatible = "qcom,qcs9100-sndcard", "sa8775p"}, + {.compatible = "qcom,sc8280xp-sndcard", "sc8280xp"}, + {.compatible = "qcom,sm8450-sndcard", "sm8450"}, + {.compatible = "qcom,sm8550-sndcard", "sm8550"}, +-- +2.51.0 + diff --git a/queue-6.17/asoc-sof-ipc4-pcm-fix-incorrect-comparison-with-numb.patch b/queue-6.17/asoc-sof-ipc4-pcm-fix-incorrect-comparison-with-numb.patch new file mode 100644 index 0000000000..a68d38ccf3 --- /dev/null +++ b/queue-6.17/asoc-sof-ipc4-pcm-fix-incorrect-comparison-with-numb.patch @@ -0,0 +1,52 @@ +From c03e96ed6cc8ad5d30f5071f609e6d06012ec7ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 17:05:25 +0100 +Subject: ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of + tdm_slots + +From: Richard Fitzgerald + +[ Upstream commit 62a7b3bbb6b873fdcc85a37efbd0102d66c8a73e ] + +In ipc4_ssp_dai_config_pcm_params_match() when comparing params_channels() +against hw_config->tdm_slots the comparison should be a <= not a ==. + +The number of TDM slots must be enough for the number of required channels. +But it can be greater. There are various reason why a I2S/TDM link has more +TDM slots than a particular audio stream needs. + +The original comparison would fail on systems that had more TDM slots. + +Signed-off-by: Richard Fitzgerald +Fixes: 8a07944a77e9 ("ASoC: SOF: ipc4-pcm: Look for best matching hw_config for SSP") +Link: https://patch.msgid.link/20250819160525.423416-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-pcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c +index 374dc10d10fd5..86f7377fb92fa 100644 +--- a/sound/soc/sof/ipc4-pcm.c ++++ b/sound/soc/sof/ipc4-pcm.c +@@ -639,14 +639,14 @@ static int ipc4_ssp_dai_config_pcm_params_match(struct snd_sof_dev *sdev, + + if (params_rate(params) == le32_to_cpu(hw_config->fsync_rate) && + params_width(params) == le32_to_cpu(hw_config->tdm_slot_width) && +- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) { ++ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) { + current_config = le32_to_cpu(hw_config->id); + partial_match = false; + /* best match found */ + break; + } else if (current_config < 0 && + params_rate(params) == le32_to_cpu(hw_config->fsync_rate) && +- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) { ++ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) { + current_config = le32_to_cpu(hw_config->id); + partial_match = true; + /* keep looking for better match */ +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-check-invalid-nr_requests-in-queue_requests_s.patch b/queue-6.17/blk-mq-check-invalid-nr_requests-in-queue_requests_s.patch new file mode 100644 index 0000000000..58cd59fd17 --- /dev/null +++ b/queue-6.17/blk-mq-check-invalid-nr_requests-in-queue_requests_s.patch @@ -0,0 +1,145 @@ +From b06f21a47e6b1dc8a7fc88e7d8df6612588555ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:38 +0800 +Subject: blk-mq: check invalid nr_requests in queue_requests_store() + +From: Yu Kuai + +[ Upstream commit b46d4c447db76e36906ed59ebb9b3ef8f3383322 ] + +queue_requests_store() is the only caller of +blk_mq_update_nr_requests(), and blk_mq_update_nr_requests() is the +only caller of blk_mq_tag_update_depth(), however, they all have +checkings for nr_requests input by user. + +Make code cleaner by moving all the checkings to the top function: + +1) nr_requests > reserved tags; +2) if there is elevator, 4 <= nr_requests <= 2048; +3) if elevator is none, 4 <= nr_requests <= tag_set->queue_depth; + +Meanwhile, case 2 is the only case tags can grow and -ENOMEM might be +returned. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-mq-tag.c | 16 +--------------- + block/blk-mq.c | 8 ++------ + block/blk-mq.h | 2 +- + block/blk-sysfs.c | 13 +++++++++++++ + 4 files changed, 17 insertions(+), 22 deletions(-) + +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index 5cffa5668d0c3..725210f27471c 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -584,14 +584,10 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) + } + + int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, +- struct blk_mq_tags **tagsptr, unsigned int tdepth, +- bool can_grow) ++ struct blk_mq_tags **tagsptr, unsigned int tdepth) + { + struct blk_mq_tags *tags = *tagsptr; + +- if (tdepth <= tags->nr_reserved_tags) +- return -EINVAL; +- + /* + * If we are allowed to grow beyond the original size, allocate + * a new set of tags before freeing the old one. +@@ -600,16 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + struct blk_mq_tag_set *set = hctx->queue->tag_set; + struct blk_mq_tags *new; + +- if (!can_grow) +- return -EINVAL; +- +- /* +- * We need some sort of upper limit, set it high enough that +- * no valid use cases should require more. +- */ +- if (tdepth > MAX_SCHED_RQ) +- return -EINVAL; +- + /* + * Only the sbitmap needs resizing since we allocated the max + * initially. +diff --git a/block/blk-mq.c b/block/blk-mq.c +index f5e713224d819..a81ef562014d6 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4932,9 +4932,6 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + int ret = 0; + unsigned long i; + +- if (q->nr_requests == nr) +- return 0; +- + blk_mq_quiesce_queue(q); + + queue_for_each_hw_ctx(q, hctx, i) { +@@ -4946,10 +4943,9 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + */ + if (hctx->sched_tags) { + ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags, +- nr, true); ++ nr); + } else { +- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr, +- false); ++ ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr); + } + if (ret) + goto out; +diff --git a/block/blk-mq.h b/block/blk-mq.h +index affb2e14b56e3..2b3ade60c90b2 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -171,7 +171,7 @@ void blk_mq_put_tag(struct blk_mq_tags *tags, struct blk_mq_ctx *ctx, + unsigned int tag); + void blk_mq_put_tags(struct blk_mq_tags *tags, int *tag_array, int nr_tags); + int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, +- struct blk_mq_tags **tags, unsigned int depth, bool can_grow); ++ struct blk_mq_tags **tags, unsigned int depth); + void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, + unsigned int size); + void blk_mq_tag_update_sched_shared_tags(struct request_queue *q); +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 4a7f1a349998b..b61e956a868e7 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -78,12 +78,25 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count) + + memflags = blk_mq_freeze_queue(q); + mutex_lock(&q->elevator_lock); ++ ++ if (nr == q->nr_requests) ++ goto unlock; ++ + if (nr < BLKDEV_MIN_RQ) + nr = BLKDEV_MIN_RQ; + ++ if (nr <= q->tag_set->reserved_tags || ++ (q->elevator && nr > MAX_SCHED_RQ) || ++ (!q->elevator && nr > q->tag_set->queue_depth)) { ++ ret = -EINVAL; ++ goto unlock; ++ } ++ + err = blk_mq_update_nr_requests(disk->queue, nr); + if (err) + ret = err; ++ ++unlock: + mutex_unlock(&q->elevator_lock); + blk_mq_unfreeze_queue(q, memflags); + return ret; +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.17/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..32ced6f32c --- /dev/null +++ b/queue-6.17/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From a85c5b0ef6a7d30c89a778061a78456613c4a968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 24656980f4431..5c399ac562eae 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-cleanup-shared-tags-case-in-blk_mq_update_nr_.patch b/queue-6.17/blk-mq-cleanup-shared-tags-case-in-blk_mq_update_nr_.patch new file mode 100644 index 0000000000..1e541ced91 --- /dev/null +++ b/queue-6.17/blk-mq-cleanup-shared-tags-case-in-blk_mq_update_nr_.patch @@ -0,0 +1,105 @@ +From 1aabc76a426066f50dc1b2880fe06626264b21b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:40 +0800 +Subject: blk-mq: cleanup shared tags case in blk_mq_update_nr_requests() + +From: Yu Kuai + +[ Upstream commit 7f2799c546dba9e12f9ff4d07936601e416c640d ] + +For shared tags case, all hctx->sched_tags/tags are the same, it doesn't +make sense to call into blk_mq_tag_update_depth() multiple times for the +same tags. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-mq-tag.c | 7 ------- + block/blk-mq.c | 43 ++++++++++++++++++++++--------------------- + 2 files changed, 22 insertions(+), 28 deletions(-) + +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index 725210f27471c..aed84c5d5c2b2 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -596,13 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + struct blk_mq_tag_set *set = hctx->queue->tag_set; + struct blk_mq_tags *new; + +- /* +- * Only the sbitmap needs resizing since we allocated the max +- * initially. +- */ +- if (blk_mq_is_shared_tags(set->flags)) +- return 0; +- + new = blk_mq_alloc_map_and_rqs(set, hctx->queue_num, tdepth); + if (!new) + return -ENOMEM; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index a81ef562014d6..bcb7495893a09 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4934,34 +4934,35 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + + blk_mq_quiesce_queue(q); + +- queue_for_each_hw_ctx(q, hctx, i) { +- if (!hctx->tags) +- continue; +- /* +- * If we're using an MQ scheduler, just update the scheduler +- * queue depth. This is similar to what the old code would do. +- */ +- if (hctx->sched_tags) { +- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags, +- nr); +- } else { +- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr); +- } +- if (ret) +- goto out; +- } +- +- q->nr_requests = nr; +- if (q->elevator && q->elevator->type->ops.depth_updated) +- q->elevator->type->ops.depth_updated(q); +- + if (blk_mq_is_shared_tags(set->flags)) { + if (q->elevator) + blk_mq_tag_update_sched_shared_tags(q); + else + blk_mq_tag_resize_shared_tags(set, nr); ++ } else { ++ queue_for_each_hw_ctx(q, hctx, i) { ++ if (!hctx->tags) ++ continue; ++ /* ++ * If we're using an MQ scheduler, just update the ++ * scheduler queue depth. This is similar to what the ++ * old code would do. ++ */ ++ if (hctx->sched_tags) ++ ret = blk_mq_tag_update_depth(hctx, ++ &hctx->sched_tags, nr); ++ else ++ ret = blk_mq_tag_update_depth(hctx, ++ &hctx->tags, nr); ++ if (ret) ++ goto out; ++ } + } + ++ q->nr_requests = nr; ++ if (q->elevator && q->elevator->type->ops.depth_updated) ++ q->elevator->type->ops.depth_updated(q); ++ + out: + blk_mq_unquiesce_queue(q); + +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-convert-to-serialize-updating-nr_requests-wit.patch b/queue-6.17/blk-mq-convert-to-serialize-updating-nr_requests-wit.patch new file mode 100644 index 0000000000..8670b79aab --- /dev/null +++ b/queue-6.17/blk-mq-convert-to-serialize-updating-nr_requests-wit.patch @@ -0,0 +1,104 @@ +From 8d44fb78b7eddd3c3780060d37d4cd100f6f0235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:39 +0800 +Subject: blk-mq: convert to serialize updating nr_requests with + update_nr_hwq_lock + +From: Yu Kuai + +[ Upstream commit 626ff4f8ebcb7207f01e7810acb85812ccf06bd8 ] + +request_queue->nr_requests can be changed by: + +a) switch elevator by updating nr_hw_queues +b) switch elevator by elevator sysfs attribute +c) configue queue sysfs attribute nr_requests + +Current lock order is: + +1) update_nr_hwq_lock, case a,b +2) freeze_queue +3) elevator_lock, case a,b,c + +And update nr_requests is seriablized by elevator_lock() already, +however, in the case c, we'll have to allocate new sched_tags if +nr_requests grow, and do this with elevator_lock held and queue +freezed has the risk of deadlock. + +Hence use update_nr_hwq_lock instead, make it possible to allocate +memory if tags grow, meanwhile also prevent nr_requests to be changed +concurrently. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index b61e956a868e7..163264e4ec629 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -68,6 +68,7 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count) + int ret, err; + unsigned int memflags; + struct request_queue *q = disk->queue; ++ struct blk_mq_tag_set *set = q->tag_set; + + if (!queue_is_mq(q)) + return -EINVAL; +@@ -76,8 +77,11 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count) + if (ret < 0) + return ret; + +- memflags = blk_mq_freeze_queue(q); +- mutex_lock(&q->elevator_lock); ++ /* ++ * Serialize updating nr_requests with concurrent queue_requests_store() ++ * and switching elevator. ++ */ ++ down_write(&set->update_nr_hwq_lock); + + if (nr == q->nr_requests) + goto unlock; +@@ -85,20 +89,31 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count) + if (nr < BLKDEV_MIN_RQ) + nr = BLKDEV_MIN_RQ; + +- if (nr <= q->tag_set->reserved_tags || ++ /* ++ * Switching elevator is protected by update_nr_hwq_lock: ++ * - read lock is held from elevator sysfs attribute; ++ * - write lock is held from updating nr_hw_queues; ++ * Hence it's safe to access q->elevator here with write lock held. ++ */ ++ if (nr <= set->reserved_tags || + (q->elevator && nr > MAX_SCHED_RQ) || +- (!q->elevator && nr > q->tag_set->queue_depth)) { ++ (!q->elevator && nr > set->queue_depth)) { + ret = -EINVAL; + goto unlock; + } + ++ memflags = blk_mq_freeze_queue(q); ++ mutex_lock(&q->elevator_lock); ++ + err = blk_mq_update_nr_requests(disk->queue, nr); + if (err) + ret = err; + +-unlock: + mutex_unlock(&q->elevator_lock); + blk_mq_unfreeze_queue(q, memflags); ++ ++unlock: ++ up_write(&set->update_nr_hwq_lock); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-fix-elevator-depth_updated-method.patch b/queue-6.17/blk-mq-fix-elevator-depth_updated-method.patch new file mode 100644 index 0000000000..949b3998f7 --- /dev/null +++ b/queue-6.17/blk-mq-fix-elevator-depth_updated-method.patch @@ -0,0 +1,275 @@ +From 8e4b94cbbc4679163dfb0679351e62ef5db0e11a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:06:11 +0800 +Subject: blk-mq: fix elevator depth_updated method + +From: Yu Kuai + +[ Upstream commit 7d337eef4affc5e26e0570513168c69ddbc40f92 ] + +Current depth_updated has some problems: + +1) depth_updated() will be called for each hctx, while all elevators +will update async_depth for the disk level, this is not related to hctx; +2) In blk_mq_update_nr_requests(), if previous hctx update succeed and +this hctx update failed, q->nr_requests will not be updated, while +async_depth is already updated with new nr_reqeuests in previous +depth_updated(); +3) All elevators are using q->nr_requests to calculate async_depth now, +however, q->nr_requests is still the old value when depth_updated() is +called from blk_mq_update_nr_requests(); + +Those problems are first from error path, then mq-deadline, and recently +for bfq and kyber, fix those problems by: + +- pass in request_queue instead of hctx; +- move depth_updated() after q->nr_requests is updated in + blk_mq_update_nr_requests(); +- add depth_updated() call inside init_sched() method to initialize + async_depth; +- remove init_hctx() method for mq-deadline and bfq that is useless now; + +Fixes: 77f1e0a52d26 ("bfq: update internal depth state when queue depth changes") +Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code") +Fixes: 42e6c6ce03fd ("lib/sbitmap: convert shallow_depth from one word to the whole sbitmap") +Signed-off-by: Yu Kuai +Reviewed-by: Hannes Reinecke +Reviewed-by: Li Nan +Reviewed-by: Nilay Shroff +Link: https://lore.kernel.org/r/20250821060612.1729939-2-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 22 +++++----------------- + block/blk-mq-sched.h | 11 +++++++++++ + block/blk-mq.c | 23 ++++++++++++----------- + block/elevator.h | 2 +- + block/kyber-iosched.c | 19 +++++++++---------- + block/mq-deadline.c | 16 +++------------- + 6 files changed, 41 insertions(+), 52 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 50e51047e1fe5..4a8d3d96bfe49 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -7109,9 +7109,10 @@ void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg) + * See the comments on bfq_limit_depth for the purpose of + * the depths set in the function. Return minimum shallow depth we'll use. + */ +-static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt) ++static void bfq_depth_updated(struct request_queue *q) + { +- unsigned int nr_requests = bfqd->queue->nr_requests; ++ struct bfq_data *bfqd = q->elevator->elevator_data; ++ unsigned int nr_requests = q->nr_requests; + + /* + * In-word depths if no bfq_queue is being weight-raised: +@@ -7143,21 +7144,8 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt) + bfqd->async_depths[1][0] = max((nr_requests * 3) >> 4, 1U); + /* no more than ~37% of tags for sync writes (~20% extra tags) */ + bfqd->async_depths[1][1] = max((nr_requests * 6) >> 4, 1U); +-} +- +-static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx) +-{ +- struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; +- struct blk_mq_tags *tags = hctx->sched_tags; + +- bfq_update_depths(bfqd, &tags->bitmap_tags); +- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1); +-} +- +-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index) +-{ +- bfq_depth_updated(hctx); +- return 0; ++ blk_mq_set_min_shallow_depth(q, 1); + } + + static void bfq_exit_queue(struct elevator_queue *e) +@@ -7369,6 +7357,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_queue *eq) + goto out_free; + bfq_init_root_group(bfqd->root_group, bfqd); + bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group); ++ bfq_depth_updated(q); + + /* We dispatch from request queue wide instead of hw queue */ + blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q); +@@ -7628,7 +7617,6 @@ static struct elevator_type iosched_bfq_mq = { + .request_merged = bfq_request_merged, + .has_work = bfq_has_work, + .depth_updated = bfq_depth_updated, +- .init_hctx = bfq_init_hctx, + .init_sched = bfq_init_queue, + .exit_sched = bfq_exit_queue, + }, +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index b554e1d559508..fe83187f41db4 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -92,4 +92,15 @@ static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx) + return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state); + } + ++static inline void blk_mq_set_min_shallow_depth(struct request_queue *q, ++ unsigned int depth) ++{ ++ struct blk_mq_hw_ctx *hctx; ++ unsigned long i; ++ ++ queue_for_each_hw_ctx(q, hctx, i) ++ sbitmap_queue_min_shallow_depth(&hctx->sched_tags->bitmap_tags, ++ depth); ++} ++ + #endif +diff --git a/block/blk-mq.c b/block/blk-mq.c +index ba3a4b77f5786..9055cd6247004 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4951,20 +4951,21 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + false); + } + if (ret) +- break; +- if (q->elevator && q->elevator->type->ops.depth_updated) +- q->elevator->type->ops.depth_updated(hctx); ++ goto out; + } +- if (!ret) { +- q->nr_requests = nr; +- if (blk_mq_is_shared_tags(set->flags)) { +- if (q->elevator) +- blk_mq_tag_update_sched_shared_tags(q); +- else +- blk_mq_tag_resize_shared_tags(set, nr); +- } ++ ++ q->nr_requests = nr; ++ if (q->elevator && q->elevator->type->ops.depth_updated) ++ q->elevator->type->ops.depth_updated(q); ++ ++ if (blk_mq_is_shared_tags(set->flags)) { ++ if (q->elevator) ++ blk_mq_tag_update_sched_shared_tags(q); ++ else ++ blk_mq_tag_resize_shared_tags(set, nr); + } + ++out: + blk_mq_unquiesce_queue(q); + + return ret; +diff --git a/block/elevator.h b/block/elevator.h +index adc5c157e17e5..c4d20155065e8 100644 +--- a/block/elevator.h ++++ b/block/elevator.h +@@ -37,7 +37,7 @@ struct elevator_mq_ops { + void (*exit_sched)(struct elevator_queue *); + int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int); + void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int); +- void (*depth_updated)(struct blk_mq_hw_ctx *); ++ void (*depth_updated)(struct request_queue *); + + bool (*allow_merge)(struct request_queue *, struct request *, struct bio *); + bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int); +diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c +index 70cbc7b2deb40..18efd6ef2a2b9 100644 +--- a/block/kyber-iosched.c ++++ b/block/kyber-iosched.c +@@ -399,6 +399,14 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q) + return ERR_PTR(ret); + } + ++static void kyber_depth_updated(struct request_queue *q) ++{ ++ struct kyber_queue_data *kqd = q->elevator->elevator_data; ++ ++ kqd->async_depth = q->nr_requests * KYBER_ASYNC_PERCENT / 100U; ++ blk_mq_set_min_shallow_depth(q, kqd->async_depth); ++} ++ + static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq) + { + struct kyber_queue_data *kqd; +@@ -413,6 +421,7 @@ static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq) + + eq->elevator_data = kqd; + q->elevator = eq; ++ kyber_depth_updated(q); + + return 0; + } +@@ -440,15 +449,6 @@ static void kyber_ctx_queue_init(struct kyber_ctx_queue *kcq) + INIT_LIST_HEAD(&kcq->rq_list[i]); + } + +-static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx) +-{ +- struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data; +- struct blk_mq_tags *tags = hctx->sched_tags; +- +- kqd->async_depth = hctx->queue->nr_requests * KYBER_ASYNC_PERCENT / 100U; +- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth); +-} +- + static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) + { + struct kyber_hctx_data *khd; +@@ -493,7 +493,6 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) + khd->batching = 0; + + hctx->sched_data = khd; +- kyber_depth_updated(hctx); + + return 0; + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index b9b7cdf1d3c98..2e689b2c40213 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -507,22 +507,12 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + } + + /* Called by blk_mq_update_nr_requests(). */ +-static void dd_depth_updated(struct blk_mq_hw_ctx *hctx) ++static void dd_depth_updated(struct request_queue *q) + { +- struct request_queue *q = hctx->queue; + struct deadline_data *dd = q->elevator->elevator_data; +- struct blk_mq_tags *tags = hctx->sched_tags; + + dd->async_depth = q->nr_requests; +- +- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1); +-} +- +-/* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */ +-static int dd_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) +-{ +- dd_depth_updated(hctx); +- return 0; ++ blk_mq_set_min_shallow_depth(q, 1); + } + + static void dd_exit_sched(struct elevator_queue *e) +@@ -587,6 +577,7 @@ static int dd_init_sched(struct request_queue *q, struct elevator_queue *eq) + blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q); + + q->elevator = eq; ++ dd_depth_updated(q); + return 0; + } + +@@ -1048,7 +1039,6 @@ static struct elevator_type mq_deadline = { + .has_work = dd_has_work, + .init_sched = dd_init_sched, + .exit_sched = dd_exit_sched, +- .init_hctx = dd_init_hctx, + }, + + #ifdef CONFIG_BLK_DEBUG_FS +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-fix-potential-deadlock-while-nr_requests-grow.patch b/queue-6.17/blk-mq-fix-potential-deadlock-while-nr_requests-grow.patch new file mode 100644 index 0000000000..b9e45b4558 --- /dev/null +++ b/queue-6.17/blk-mq-fix-potential-deadlock-while-nr_requests-grow.patch @@ -0,0 +1,156 @@ +From 87f0c67499efb618b8bc8bdf80973f640b63bd4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:43 +0800 +Subject: blk-mq: fix potential deadlock while nr_requests grown + +From: Yu Kuai + +[ Upstream commit b86433721f46d934940528f28d49c1dedb690df1 ] + +Allocate and free sched_tags while queue is freezed can deadlock[1], +this is a long term problem, hence allocate memory before freezing +queue and free memory after queue is unfreezed. + +[1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ +Fixes: e3a2b3f931f5 ("blk-mq: allow changing of queue depth through sysfs") + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 22 +++++++++------------- + block/blk-mq.h | 5 ++++- + block/blk-sysfs.c | 29 +++++++++++++++++++++-------- + 3 files changed, 34 insertions(+), 22 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 1bafbdced7bd5..f8a8a23b90402 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4925,11 +4925,13 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) + } + EXPORT_SYMBOL(blk_mq_free_tag_set); + +-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) ++struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q, ++ struct elevator_tags *et, ++ unsigned int nr) + { + struct blk_mq_tag_set *set = q->tag_set; ++ struct elevator_tags *old_et = NULL; + struct blk_mq_hw_ctx *hctx; +- int ret = 0; + unsigned long i; + + blk_mq_quiesce_queue(q); +@@ -4964,24 +4966,18 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + } + } else { + /* Non-shared sched tags, and tags grow */ +- queue_for_each_hw_ctx(q, hctx, i) { +- if (!hctx->sched_tags) +- continue; +- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags, +- nr); +- if (ret) +- goto out; +- } ++ queue_for_each_hw_ctx(q, hctx, i) ++ hctx->sched_tags = et->tags[i]; ++ old_et = q->elevator->et; ++ q->elevator->et = et; + } + + q->nr_requests = nr; + if (q->elevator && q->elevator->type->ops.depth_updated) + q->elevator->type->ops.depth_updated(q); + +-out: + blk_mq_unquiesce_queue(q); +- +- return ret; ++ return old_et; + } + + /* +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 731f4578d9a84..6c9d03625ba12 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -6,6 +6,7 @@ + #include "blk-stat.h" + + struct blk_mq_tag_set; ++struct elevator_tags; + + struct blk_mq_ctxs { + struct kobject kobj; +@@ -45,7 +46,9 @@ void blk_mq_submit_bio(struct bio *bio); + int blk_mq_poll(struct request_queue *q, blk_qc_t cookie, struct io_comp_batch *iob, + unsigned int flags); + void blk_mq_exit_queue(struct request_queue *q); +-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr); ++struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q, ++ struct elevator_tags *tags, ++ unsigned int nr); + void blk_mq_wake_waiters(struct request_queue *q); + bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *, + bool); +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 163264e4ec629..9b03261b3e042 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -64,11 +64,12 @@ static ssize_t queue_requests_show(struct gendisk *disk, char *page) + static ssize_t + queue_requests_store(struct gendisk *disk, const char *page, size_t count) + { +- unsigned long nr; +- int ret, err; +- unsigned int memflags; + struct request_queue *q = disk->queue; + struct blk_mq_tag_set *set = q->tag_set; ++ struct elevator_tags *et = NULL; ++ unsigned int memflags; ++ unsigned long nr; ++ int ret; + + if (!queue_is_mq(q)) + return -EINVAL; +@@ -102,16 +103,28 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count) + goto unlock; + } + ++ if (!blk_mq_is_shared_tags(set->flags) && q->elevator && ++ nr > q->elevator->et->nr_requests) { ++ /* ++ * Tags will grow, allocate memory before freezing queue to ++ * prevent deadlock. ++ */ ++ et = blk_mq_alloc_sched_tags(set, q->nr_hw_queues, nr); ++ if (!et) { ++ ret = -ENOMEM; ++ goto unlock; ++ } ++ } ++ + memflags = blk_mq_freeze_queue(q); + mutex_lock(&q->elevator_lock); +- +- err = blk_mq_update_nr_requests(disk->queue, nr); +- if (err) +- ret = err; +- ++ et = blk_mq_update_nr_requests(q, et, nr); + mutex_unlock(&q->elevator_lock); + blk_mq_unfreeze_queue(q, memflags); + ++ if (et) ++ blk_mq_free_sched_tags(et, set); ++ + unlock: + up_write(&set->update_nr_hwq_lock); + return ret; +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-remove-useless-checkings-in-blk_mq_update_nr_.patch b/queue-6.17/blk-mq-remove-useless-checkings-in-blk_mq_update_nr_.patch new file mode 100644 index 0000000000..4c224043a1 --- /dev/null +++ b/queue-6.17/blk-mq-remove-useless-checkings-in-blk_mq_update_nr_.patch @@ -0,0 +1,55 @@ +From 65bfd5d449da4c6f82ed95be4742e6f47a812f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:37 +0800 +Subject: blk-mq: remove useless checkings in blk_mq_update_nr_requests() + +From: Yu Kuai + +[ Upstream commit 8bd7195fea6d9662aa3b32498a3828bfd9b63185 ] + +1) queue_requests_store() is the only caller of +blk_mq_update_nr_requests(), where queue is already freezed, no need to +check mq_freeze_depth; +2) q->tag_set must be set for request based device, and queue_is_mq() is +already checked in blk_mq_queue_attr_visible(), no need to check +q->tag_set. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 19b50110376c6..f5e713224d819 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4929,21 +4929,14 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + { + struct blk_mq_tag_set *set = q->tag_set; + struct blk_mq_hw_ctx *hctx; +- int ret; ++ int ret = 0; + unsigned long i; + +- if (WARN_ON_ONCE(!q->mq_freeze_depth)) +- return -EINVAL; +- +- if (!set) +- return -EINVAL; +- + if (q->nr_requests == nr) + return 0; + + blk_mq_quiesce_queue(q); + +- ret = 0; + queue_for_each_hw_ctx(q, hctx, i) { + if (!hctx->tags) + continue; +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-sched-add-new-parameter-nr_requests-in-blk_mq.patch b/queue-6.17/blk-mq-sched-add-new-parameter-nr_requests-in-blk_mq.patch new file mode 100644 index 0000000000..e8361e0bd2 --- /dev/null +++ b/queue-6.17/blk-mq-sched-add-new-parameter-nr_requests-in-blk_mq.patch @@ -0,0 +1,118 @@ +From 59b21d7c278ea71427d22f7ac6f857e709210b51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:42 +0800 +Subject: blk-mq-sched: add new parameter nr_requests in + blk_mq_alloc_sched_tags() + +From: Yu Kuai + +[ Upstream commit 6293e336f6d7d3f3415346ce34993b3398846166 ] + +This helper only support to allocate the default number of requests, +add a new parameter to support specific number of requests. + +Prepare to fix potential deadlock in the case nr_requests grow. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-mq-sched.c | 14 +++++--------- + block/blk-mq-sched.h | 2 +- + block/blk-mq.h | 11 +++++++++++ + block/elevator.c | 3 ++- + 4 files changed, 19 insertions(+), 11 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index e2ce4a28e6c9e..d06bb137a7437 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -454,7 +454,7 @@ void blk_mq_free_sched_tags_batch(struct xarray *et_table, + } + + struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set, +- unsigned int nr_hw_queues) ++ unsigned int nr_hw_queues, unsigned int nr_requests) + { + unsigned int nr_tags; + int i; +@@ -470,13 +470,8 @@ struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set, + nr_tags * sizeof(struct blk_mq_tags *), gfp); + if (!et) + return NULL; +- /* +- * Default to double of smaller one between hw queue_depth and +- * 128, since we don't split into sync/async like the old code +- * did. Additionally, this is a per-hw queue depth. +- */ +- et->nr_requests = 2 * min_t(unsigned int, set->queue_depth, +- BLKDEV_DEFAULT_RQ); ++ ++ et->nr_requests = nr_requests; + et->nr_hw_queues = nr_hw_queues; + + if (blk_mq_is_shared_tags(set->flags)) { +@@ -521,7 +516,8 @@ int blk_mq_alloc_sched_tags_batch(struct xarray *et_table, + * concurrently. + */ + if (q->elevator) { +- et = blk_mq_alloc_sched_tags(set, nr_hw_queues); ++ et = blk_mq_alloc_sched_tags(set, nr_hw_queues, ++ blk_mq_default_nr_requests(set)); + if (!et) + goto out_unwind; + if (xa_insert(et_table, q->id, et, gfp)) +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index fe83187f41db4..8e21a6b1415d9 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -24,7 +24,7 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e); + void blk_mq_sched_free_rqs(struct request_queue *q); + + struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set, +- unsigned int nr_hw_queues); ++ unsigned int nr_hw_queues, unsigned int nr_requests); + int blk_mq_alloc_sched_tags_batch(struct xarray *et_table, + struct blk_mq_tag_set *set, unsigned int nr_hw_queues); + void blk_mq_free_sched_tags(struct elevator_tags *et, +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 2b3ade60c90b2..731f4578d9a84 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -109,6 +109,17 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(blk_opf_t opf, + return ctx->hctxs[blk_mq_get_hctx_type(opf)]; + } + ++/* ++ * Default to double of smaller one between hw queue_depth and ++ * 128, since we don't split into sync/async like the old code ++ * did. Additionally, this is a per-hw queue depth. ++ */ ++static inline unsigned int blk_mq_default_nr_requests( ++ struct blk_mq_tag_set *set) ++{ ++ return 2 * min_t(unsigned int, set->queue_depth, BLKDEV_DEFAULT_RQ); ++} ++ + /* + * sysfs helpers + */ +diff --git a/block/elevator.c b/block/elevator.c +index fe96c6f4753ca..e2ebfbf107b3a 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -669,7 +669,8 @@ static int elevator_change(struct request_queue *q, struct elv_change_ctx *ctx) + lockdep_assert_held(&set->update_nr_hwq_lock); + + if (strncmp(ctx->name, "none", 4)) { +- ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues); ++ ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues, ++ blk_mq_default_nr_requests(set)); + if (!ctx->et) + return -ENOMEM; + } +-- +2.51.0 + diff --git a/queue-6.17/blk-mq-split-bitmap-grow-and-resize-case-in-blk_mq_u.patch b/queue-6.17/blk-mq-split-bitmap-grow-and-resize-case-in-blk_mq_u.patch new file mode 100644 index 0000000000..eb7fc542c4 --- /dev/null +++ b/queue-6.17/blk-mq-split-bitmap-grow-and-resize-case-in-blk_mq_u.patch @@ -0,0 +1,82 @@ +From 1b1def4a10e818e49c5a3ea60c9a7eb196ca0f68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:04:41 +0800 +Subject: blk-mq: split bitmap grow and resize case in + blk_mq_update_nr_requests() + +From: Yu Kuai + +[ Upstream commit e63200404477456ec60c62dd8b3b1092aba2e211 ] + +No functional changes are intended, make code cleaner and prepare to fix +the grow case in following patches. + +Signed-off-by: Yu Kuai +Reviewed-by: Nilay Shroff +Signed-off-by: Jens Axboe +Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown") +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 39 +++++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index bcb7495893a09..1bafbdced7bd5 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4935,25 +4935,40 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr) + blk_mq_quiesce_queue(q); + + if (blk_mq_is_shared_tags(set->flags)) { ++ /* ++ * Shared tags, for sched tags, we allocate max initially hence ++ * tags can't grow, see blk_mq_alloc_sched_tags(). ++ */ + if (q->elevator) + blk_mq_tag_update_sched_shared_tags(q); + else + blk_mq_tag_resize_shared_tags(set, nr); +- } else { ++ } else if (!q->elevator) { ++ /* ++ * Non-shared hardware tags, nr is already checked from ++ * queue_requests_store() and tags can't grow. ++ */ + queue_for_each_hw_ctx(q, hctx, i) { + if (!hctx->tags) + continue; +- /* +- * If we're using an MQ scheduler, just update the +- * scheduler queue depth. This is similar to what the +- * old code would do. +- */ +- if (hctx->sched_tags) +- ret = blk_mq_tag_update_depth(hctx, +- &hctx->sched_tags, nr); +- else +- ret = blk_mq_tag_update_depth(hctx, +- &hctx->tags, nr); ++ sbitmap_queue_resize(&hctx->tags->bitmap_tags, ++ nr - hctx->tags->nr_reserved_tags); ++ } ++ } else if (nr <= q->elevator->et->nr_requests) { ++ /* Non-shared sched tags, and tags don't grow. */ ++ queue_for_each_hw_ctx(q, hctx, i) { ++ if (!hctx->sched_tags) ++ continue; ++ sbitmap_queue_resize(&hctx->sched_tags->bitmap_tags, ++ nr - hctx->sched_tags->nr_reserved_tags); ++ } ++ } else { ++ /* Non-shared sched tags, and tags grow */ ++ queue_for_each_hw_ctx(q, hctx, i) { ++ if (!hctx->sched_tags) ++ continue; ++ ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags, ++ nr); + if (ret) + goto out; + } +-- +2.51.0 + diff --git a/queue-6.17/blk-throttle-fix-access-race-during-throttle-policy-.patch b/queue-6.17/blk-throttle-fix-access-race-during-throttle-policy-.patch new file mode 100644 index 0000000000..65dab23f74 --- /dev/null +++ b/queue-6.17/blk-throttle-fix-access-race-during-throttle-policy-.patch @@ -0,0 +1,171 @@ +From 7160d885d9668d3c314be7e3b34743ddd32e2a94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 18:24:11 +0800 +Subject: blk-throttle: fix access race during throttle policy activation + +From: Han Guangjiang + +[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ] + +On repeated cold boots we occasionally hit a NULL pointer crash in +blk_should_throtl() when throttling is consulted before the throttle +policy is fully enabled for the queue. Checking only q->td != NULL is +insufficient during early initialization, so blkg_to_pd() for the +throttle policy can still return NULL and blkg_to_tg() becomes NULL, +which later gets dereferenced. + + Unable to handle kernel NULL pointer dereference + at virtual address 0000000000000156 + ... + pc : submit_bio_noacct+0x14c/0x4c8 + lr : submit_bio_noacct+0x48/0x4c8 + sp : ffff800087f0b690 + x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 + x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 + x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 + x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff + x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff + x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c + x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 + x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 + x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 + x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a + Call trace: + submit_bio_noacct+0x14c/0x4c8 + verity_map+0x178/0x2c8 + __map_bio+0x228/0x250 + dm_submit_bio+0x1c4/0x678 + __submit_bio+0x170/0x230 + submit_bio_noacct_nocheck+0x16c/0x388 + submit_bio_noacct+0x16c/0x4c8 + submit_bio+0xb4/0x210 + f2fs_submit_read_bio+0x4c/0xf0 + f2fs_mpage_readpages+0x3b0/0x5f0 + f2fs_readahead+0x90/0xe8 + +Tighten blk_throtl_activated() to also require that the throttle policy +bit is set on the queue: + + return q->td != NULL && + test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); + +This prevents blk_should_throtl() from accessing throttle group state +until policy data has been attached to blkgs. + +Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration") +Co-developed-by: Liang Jie +Signed-off-by: Liang Jie +Signed-off-by: Han Guangjiang +Reviewed-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 6 ------ + block/blk-cgroup.h | 6 ++++++ + block/blk-throttle.c | 6 +----- + block/blk-throttle.h | 18 +++++++++++------- + 4 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index fe9ebd6a2e14d..7246fc2563152 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void) + return task_css(current, io_cgrp_id); + } + +-static bool blkcg_policy_enabled(struct request_queue *q, +- const struct blkcg_policy *pol) +-{ +- return pol && test_bit(pol->plid, q->blkcg_pols); +-} +- + static void blkg_free_workfn(struct work_struct *work) + { + struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 81868ad86330c..83367086cb6ae 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) + bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); + } + ++static inline bool blkcg_policy_enabled(struct request_queue *q, ++ const struct blkcg_policy *pol) ++{ ++ return pol && test_bit(pol->plid, q->blkcg_pols); ++} ++ + void blk_cgroup_bio_start(struct bio *bio); + void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta); + #else /* CONFIG_BLK_CGROUP */ +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 397b6a410f9e5..cfa1cd60d2c5f 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk) + INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn); + throtl_service_queue_init(&td->service_queue); + +- /* +- * Freeze queue before activating policy, to synchronize with IO path, +- * which is protected by 'q_usage_counter'. +- */ + memflags = blk_mq_freeze_queue(disk->queue); + blk_mq_quiesce_queue(disk->queue); + + q->td = td; + td->queue = q; + +- /* activate policy */ ++ /* activate policy, blk_throtl_activated() will return true */ + ret = blkcg_activate_policy(disk, &blkcg_policy_throtl); + if (ret) { + q->td = NULL; +diff --git a/block/blk-throttle.h b/block/blk-throttle.h +index 3b27755bfbff1..9d7a42c039a15 100644 +--- a/block/blk-throttle.h ++++ b/block/blk-throttle.h +@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk); + + static inline bool blk_throtl_activated(struct request_queue *q) + { +- return q->td != NULL; ++ /* ++ * q->td guarantees that the blk-throttle module is already loaded, ++ * and the plid of blk-throttle is assigned. ++ * blkcg_policy_enabled() guarantees that the policy is activated ++ * in the request_queue. ++ */ ++ return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl); + } + + static inline bool blk_should_throtl(struct bio *bio) +@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio) + struct throtl_grp *tg; + int rw = bio_data_dir(bio); + +- /* +- * This is called under bio_queue_enter(), and it's synchronized with +- * the activation of blk-throtl, which is protected by +- * blk_mq_freeze_queue(). +- */ + if (!blk_throtl_activated(bio->bi_bdev->bd_queue)) + return false; + +@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio) + + static inline bool blk_throtl_bio(struct bio *bio) + { +- ++ /* ++ * block throttling takes effect if the policy is activated ++ * in the bio's request_queue. ++ */ + if (!blk_should_throtl(bio)) + return false; + +-- +2.51.0 + diff --git a/queue-6.17/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch b/queue-6.17/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch new file mode 100644 index 0000000000..8b4d2870b1 --- /dev/null +++ b/queue-6.17/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch @@ -0,0 +1,62 @@ +From 545300ce34f0aaa57f4edcd2e136475366397e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 15:55:39 +0800 +Subject: blk-throttle: fix throtl_data leak during disk release + +From: Yu Kuai + +[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ] + +Tightening the throttle activation check in blk_throtl_activated() to +require both q->td presence and policy bit set introduced a memory leak +during disk release: + +blkg_destroy_all() clears the policy bit first during queue deactivation, +causing subsequent blk_throtl_exit() to skip throtl_data cleanup when +blk_throtl_activated() fails policy check. + +Idealy we should avoid modifying blk_throtl_exit() activation check because +it's intuitive that blk-throtl start from blk_throtl_init() and end in +blk_throtl_exit(). However, call blk_throtl_exit() before +blkg_destroy_all() will make a long term deadlock problem easier to +trigger[1], hence fix this problem by checking if q->td is NULL from +blk_throtl_exit(), and remove policy deactivation as well since it's +useless. + +[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t + +Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation") +Reported-by: Yi Zhang +Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/ +Signed-off-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-throttle.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index f510ae072868c..2c5b64b1a724a 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk) + { + struct request_queue *q = disk->queue; + +- if (!blk_throtl_activated(q)) ++ /* ++ * blkg_destroy_all() already deactivate throtl policy, just check and ++ * free throtl data. ++ */ ++ if (!q->td) + return; + + timer_delete_sync(&q->td->service_queue.pending_timer); + throtl_shutdown_wq(q); +- blkcg_deactivate_policy(disk, &blkcg_policy_throtl); + kfree(q->td); + } + +-- +2.51.0 + diff --git a/queue-6.17/block-cleanup-bio_issue.patch b/queue-6.17/block-cleanup-bio_issue.patch new file mode 100644 index 0000000000..ef36f476ef --- /dev/null +++ b/queue-6.17/block-cleanup-bio_issue.patch @@ -0,0 +1,168 @@ +From 808f4405b55b10ef2c9ed621a70c15429b386fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 14:30:41 +0800 +Subject: block: cleanup bio_issue + +From: Yu Kuai + +[ Upstream commit 1733e88874838ddebf7774440c285700865e6b08 ] + +Now that bio->bi_issue is only used by blk-iolatency to get bio issue +time, replace bio_issue with u64 time directly and remove bio_issue to +make code cleaner. + +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: 1f963bdd6420 ("block: initialize bio issue time in blk_mq_submit_bio()") +Signed-off-by: Sasha Levin +--- + block/bio.c | 2 +- + block/blk-cgroup.h | 2 +- + block/blk-iolatency.c | 14 +++---------- + block/blk.h | 42 --------------------------------------- + include/linux/blk_types.h | 7 ++----- + 5 files changed, 7 insertions(+), 60 deletions(-) + +diff --git a/block/bio.c b/block/bio.c +index 3b371a5da159e..1904683f7ab05 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -261,7 +261,7 @@ void bio_init(struct bio *bio, struct block_device *bdev, struct bio_vec *table, + bio->bi_private = NULL; + #ifdef CONFIG_BLK_CGROUP + bio->bi_blkg = NULL; +- bio->bi_issue.value = 0; ++ bio->issue_time_ns = 0; + if (bdev) + bio_associate_blkg(bio); + #ifdef CONFIG_BLK_CGROUP_IOCOST +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 83367086cb6ae..8328427e31657 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -372,7 +372,7 @@ static inline void blkg_put(struct blkcg_gq *blkg) + + static inline void blkcg_bio_issue_init(struct bio *bio) + { +- bio_issue_init(&bio->bi_issue, bio_sectors(bio)); ++ bio->issue_time_ns = blk_time_get_ns(); + } + + static inline void blkcg_use_delay(struct blkcg_gq *blkg) +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index 2f8fdecdd7a9b..554b191a68921 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -485,19 +485,11 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio) + mod_timer(&blkiolat->timer, jiffies + HZ); + } + +-static void iolatency_record_time(struct iolatency_grp *iolat, +- struct bio_issue *issue, u64 now, +- bool issue_as_root) ++static void iolatency_record_time(struct iolatency_grp *iolat, u64 start, ++ u64 now, bool issue_as_root) + { +- u64 start = bio_issue_time(issue); + u64 req_time; + +- /* +- * Have to do this so we are truncated to the correct time that our +- * issue is truncated to. +- */ +- now = __bio_issue_time(now); +- + if (now <= start) + return; + +@@ -625,7 +617,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) + * submitted, so do not account for it. + */ + if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) { +- iolatency_record_time(iolat, &bio->bi_issue, now, ++ iolatency_record_time(iolat, bio->issue_time_ns, now, + issue_as_root); + window_start = atomic64_read(&iolat->window_start); + if (now > window_start && +diff --git a/block/blk.h b/block/blk.h +index 46f566f9b1266..0268deb222688 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -680,48 +680,6 @@ static inline ktime_t blk_time_get(void) + return ns_to_ktime(blk_time_get_ns()); + } + +-/* +- * From most significant bit: +- * 1 bit: reserved for other usage, see below +- * 12 bits: original size of bio +- * 51 bits: issue time of bio +- */ +-#define BIO_ISSUE_RES_BITS 1 +-#define BIO_ISSUE_SIZE_BITS 12 +-#define BIO_ISSUE_RES_SHIFT (64 - BIO_ISSUE_RES_BITS) +-#define BIO_ISSUE_SIZE_SHIFT (BIO_ISSUE_RES_SHIFT - BIO_ISSUE_SIZE_BITS) +-#define BIO_ISSUE_TIME_MASK ((1ULL << BIO_ISSUE_SIZE_SHIFT) - 1) +-#define BIO_ISSUE_SIZE_MASK \ +- (((1ULL << BIO_ISSUE_SIZE_BITS) - 1) << BIO_ISSUE_SIZE_SHIFT) +-#define BIO_ISSUE_RES_MASK (~((1ULL << BIO_ISSUE_RES_SHIFT) - 1)) +- +-/* Reserved bit for blk-throtl */ +-#define BIO_ISSUE_THROTL_SKIP_LATENCY (1ULL << 63) +- +-static inline u64 __bio_issue_time(u64 time) +-{ +- return time & BIO_ISSUE_TIME_MASK; +-} +- +-static inline u64 bio_issue_time(struct bio_issue *issue) +-{ +- return __bio_issue_time(issue->value); +-} +- +-static inline sector_t bio_issue_size(struct bio_issue *issue) +-{ +- return ((issue->value & BIO_ISSUE_SIZE_MASK) >> BIO_ISSUE_SIZE_SHIFT); +-} +- +-static inline void bio_issue_init(struct bio_issue *issue, +- sector_t size) +-{ +- size &= (1ULL << BIO_ISSUE_SIZE_BITS) - 1; +- issue->value = ((issue->value & BIO_ISSUE_RES_MASK) | +- (blk_time_get_ns() & BIO_ISSUE_TIME_MASK) | +- ((u64)size << BIO_ISSUE_SIZE_SHIFT)); +-} +- + void bdev_release(struct file *bdev_file); + int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder, + const struct blk_holder_ops *hops, struct file *bdev_file); +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index 09b99d52fd365..f78145be77df5 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -198,10 +198,6 @@ static inline bool blk_path_error(blk_status_t error) + return true; + } + +-struct bio_issue { +- u64 value; +-}; +- + typedef __u32 __bitwise blk_opf_t; + + typedef unsigned int blk_qc_t; +@@ -242,7 +238,8 @@ struct bio { + * on release of the bio. + */ + struct blkcg_gq *bi_blkg; +- struct bio_issue bi_issue; ++ /* Time that this bio was issued. */ ++ u64 issue_time_ns; + #ifdef CONFIG_BLK_CGROUP_IOCOST + u64 bi_iocost_cost; + #endif +-- +2.51.0 + diff --git a/queue-6.17/block-factor-out-a-helper-bio_submit_split_bioset.patch b/queue-6.17/block-factor-out-a-helper-bio_submit_split_bioset.patch new file mode 100644 index 0000000000..8e97e132c7 --- /dev/null +++ b/queue-6.17/block-factor-out-a-helper-bio_submit_split_bioset.patch @@ -0,0 +1,117 @@ +From 4d33212f4033569fc8d2fa557986e1fa4b7690a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 14:30:46 +0800 +Subject: block: factor out a helper bio_submit_split_bioset() + +From: Yu Kuai + +[ Upstream commit e37b5596a19be9a150cb194ec32e78f295a3574b ] + +No functional changes are intended, some drivers like mdraid will split +bio by internal processing, prepare to unify bio split codes. + +Signed-off-by: Yu Kuai +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO") +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 59 ++++++++++++++++++++++++++++-------------- + include/linux/blkdev.h | 2 ++ + 2 files changed, 42 insertions(+), 19 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 5538356770a47..51fe4ed5b7c0b 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -104,33 +104,54 @@ static unsigned int bio_allowed_max_sectors(const struct queue_limits *lim) + return round_down(UINT_MAX, lim->logical_block_size) >> SECTOR_SHIFT; + } + ++/* ++ * bio_submit_split_bioset - Submit a bio, splitting it at a designated sector ++ * @bio: the original bio to be submitted and split ++ * @split_sectors: the sector count at which to split ++ * @bs: the bio set used for allocating the new split bio ++ * ++ * The original bio is modified to contain the remaining sectors and submitted. ++ * The caller is responsible for submitting the returned bio. ++ * ++ * If succeed, the newly allocated bio representing the initial part will be ++ * returned, on failure NULL will be returned and original bio will fail. ++ */ ++struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors, ++ struct bio_set *bs) ++{ ++ struct bio *split = bio_split(bio, split_sectors, GFP_NOIO, bs); ++ ++ if (IS_ERR(split)) { ++ bio->bi_status = errno_to_blk_status(PTR_ERR(split)); ++ bio_endio(bio); ++ return NULL; ++ } ++ ++ bio_chain(split, bio); ++ trace_block_split(split, bio->bi_iter.bi_sector); ++ WARN_ON_ONCE(bio_zone_write_plugging(bio)); ++ submit_bio_noacct(bio); ++ ++ return split; ++} ++EXPORT_SYMBOL_GPL(bio_submit_split_bioset); ++ + static struct bio *bio_submit_split(struct bio *bio, int split_sectors) + { +- if (unlikely(split_sectors < 0)) +- goto error; ++ if (unlikely(split_sectors < 0)) { ++ bio->bi_status = errno_to_blk_status(split_sectors); ++ bio_endio(bio); ++ return NULL; ++ } + + if (split_sectors) { +- struct bio *split; +- +- split = bio_split(bio, split_sectors, GFP_NOIO, ++ bio = bio_submit_split_bioset(bio, split_sectors, + &bio->bi_bdev->bd_disk->bio_split); +- if (IS_ERR(split)) { +- split_sectors = PTR_ERR(split); +- goto error; +- } +- split->bi_opf |= REQ_NOMERGE; +- bio_chain(split, bio); +- trace_block_split(split, bio->bi_iter.bi_sector); +- WARN_ON_ONCE(bio_zone_write_plugging(bio)); +- submit_bio_noacct(bio); +- return split; ++ if (bio) ++ bio->bi_opf |= REQ_NOMERGE; + } + + return bio; +-error: +- bio->bi_status = errno_to_blk_status(split_sectors); +- bio_endio(bio); +- return NULL; + } + + struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim, +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index fe1797bbec420..cc221318712e7 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -999,6 +999,8 @@ extern int blk_register_queue(struct gendisk *disk); + extern void blk_unregister_queue(struct gendisk *disk); + void submit_bio_noacct(struct bio *bio); + struct bio *bio_split_to_limits(struct bio *bio); ++struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors, ++ struct bio_set *bs); + + extern int blk_lld_busy(struct request_queue *q); + extern int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags); +-- +2.51.0 + diff --git a/queue-6.17/block-fix-ordering-of-recursive-split-io.patch b/queue-6.17/block-fix-ordering-of-recursive-split-io.patch new file mode 100644 index 0000000000..6297a4c5c6 --- /dev/null +++ b/queue-6.17/block-fix-ordering-of-recursive-split-io.patch @@ -0,0 +1,230 @@ +From 13030179ce722324faba15aa4731f4afb774949e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 14:30:55 +0800 +Subject: block: fix ordering of recursive split IO + +From: Yu Kuai + +[ Upstream commit b2f5974079d82a4761f002e80601064d4e39a81f ] + +Currently, split bio will be chained to original bio, and original bio +will be resubmitted to the tail of current->bio_list, waiting for +split bio to be issued. However, if split bio get split again, the IO +order will be messed up. This problem, on the one hand, will cause +performance degradation, especially for mdraid with large IO size; on +the other hand, will cause write errors for zoned block devices[1]. + +For example, in raid456 IO will first be split by max_sector from +md_submit_bio(), and then later be split again by chunksize for internal +handling: + +For example, assume max_sectors is 1M, and chunksize is 512k + +1) issue a 2M IO: + +bio issuing: 0+2M +current->bio_list: NULL + +2) md_submit_bio() split by max_sector: + +bio issuing: 0+1M +current->bio_list: 1M+1M + +3) chunk_aligned_read() split by chunksize: + +bio issuing: 0+512k +current->bio_list: 1M+1M -> 512k+512k + +4) after first bio issued, __submit_bio_noacct() will contuine issuing +next bio: + +bio issuing: 1M+1M +current->bio_list: 512k+512k +bio issued: 0+512k + +5) chunk_aligned_read() split by chunksize: + +bio issuing: 1M+512k +current->bio_list: 512k+512k -> 1536k+512k +bio issued: 0+512k + +6) no split afterwards, finally the issue order is: + +0+512k -> 1M+512k -> 512k+512k -> 1536k+512k + +This behaviour will cause large IO read on raid456 endup to be small +discontinuous IO in underlying disks. Fix this problem by placing split +bio to the head of current->bio_list. + +Test script: test on 8 disk raid5 with 64k chunksize +dd if=/dev/md0 of=/dev/null bs=4480k iflag=direct + +Test results: +Before this patch +1) iostat results: +Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util +md0 52430.00 3276.87 0.00 0.00 0.62 64.00 32.60 80.10 +sd* 4487.00 409.00 2054.00 31.40 0.82 93.34 3.68 71.20 +2) blktrace G stage: + 8,0 0 486445 11.357392936 843 G R 14071424 + 128 [dd] + 8,0 0 486451 11.357466360 843 G R 14071168 + 128 [dd] + 8,0 0 486454 11.357515868 843 G R 14071296 + 128 [dd] + 8,0 0 486468 11.357968099 843 G R 14072192 + 128 [dd] + 8,0 0 486474 11.358031320 843 G R 14071936 + 128 [dd] + 8,0 0 486480 11.358096298 843 G R 14071552 + 128 [dd] + 8,0 0 486490 11.358303858 843 G R 14071808 + 128 [dd] +3) io seek for sdx: +Noted io seek is the result from blktrace D stage, statistic of: +ABS((offset of next IO) - (offset + len of previous IO)) + +Read|Write seek +cnt 55175, zero cnt 25079 + >=(KB) .. <(KB) : count ratio |distribution | + 0 .. 1 : 25079 45.5% |########################################| + 1 .. 2 : 0 0.0% | | + 2 .. 4 : 0 0.0% | | + 4 .. 8 : 0 0.0% | | + 8 .. 16 : 0 0.0% | | + 16 .. 32 : 0 0.0% | | + 32 .. 64 : 12540 22.7% |##################### | + 64 .. 128 : 2508 4.5% |##### | + 128 .. 256 : 0 0.0% | | + 256 .. 512 : 10032 18.2% |################# | + 512 .. 1024 : 5016 9.1% |######### | + +After this patch: +1) iostat results: +Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util +md0 87965.00 5271.88 0.00 0.00 0.16 61.37 14.03 90.60 +sd* 6020.00 658.44 5117.00 45.95 0.44 112.00 2.68 86.50 +2) blktrace G stage: + 8,0 0 206296 5.354894072 664 G R 7156992 + 128 [dd] + 8,0 0 206305 5.355018179 664 G R 7157248 + 128 [dd] + 8,0 0 206316 5.355204438 664 G R 7157504 + 128 [dd] + 8,0 0 206319 5.355241048 664 G R 7157760 + 128 [dd] + 8,0 0 206333 5.355500923 664 G R 7158016 + 128 [dd] + 8,0 0 206344 5.355837806 664 G R 7158272 + 128 [dd] + 8,0 0 206353 5.355960395 664 G R 7158528 + 128 [dd] + 8,0 0 206357 5.356020772 664 G R 7158784 + 128 [dd] +3) io seek for sdx +Read|Write seek +cnt 28644, zero cnt 21483 + >=(KB) .. <(KB) : count ratio |distribution | + 0 .. 1 : 21483 75.0% |########################################| + 1 .. 2 : 0 0.0% | | + 2 .. 4 : 0 0.0% | | + 4 .. 8 : 0 0.0% | | + 8 .. 16 : 0 0.0% | | + 16 .. 32 : 0 0.0% | | + 32 .. 64 : 7161 25.0% |############## | + +BTW, this looks like a long term problem from day one, and large +sequential IO read is pretty common case like video playing. + +And even with this patch, in this test case IO is merged to at most 128k +is due to block layer plug limit BLK_PLUG_FLUSH_SIZE, increase such +limit can get even better performance. However, we'll figure out how to do +this properly later. + +[1] https://lore.kernel.org/all/e40b076d-583d-406b-b223-005910a9f46f@acm.org/ + +Fixes: d89d87965dcb ("When stacked block devices are in-use (e.g. md or dm), the recursive calls") +Reported-by: Tie Ren +Closes: https://lore.kernel.org/all/7dro5o7u5t64d6bgiansesjavxcuvkq5p2pok7dtwkav7b7ape@3isfr44b6352/ +Signed-off-by: Yu Kuai +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 16 ++++++++++------ + block/blk-merge.c | 2 +- + block/blk-throttle.c | 2 +- + block/blk.h | 2 +- + 4 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 03a5d4c9cbf72..14ae73eebe0d7 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -727,7 +727,7 @@ static void __submit_bio_noacct_mq(struct bio *bio) + current->bio_list = NULL; + } + +-void submit_bio_noacct_nocheck(struct bio *bio) ++void submit_bio_noacct_nocheck(struct bio *bio, bool split) + { + blk_cgroup_bio_start(bio); + +@@ -746,12 +746,16 @@ void submit_bio_noacct_nocheck(struct bio *bio) + * to collect a list of requests submited by a ->submit_bio method while + * it is active, and then process them after it returned. + */ +- if (current->bio_list) +- bio_list_add(¤t->bio_list[0], bio); +- else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) ++ if (current->bio_list) { ++ if (split) ++ bio_list_add_head(¤t->bio_list[0], bio); ++ else ++ bio_list_add(¤t->bio_list[0], bio); ++ } else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) { + __submit_bio_noacct_mq(bio); +- else ++ } else { + __submit_bio_noacct(bio); ++ } + } + + static blk_status_t blk_validate_atomic_write_op_size(struct request_queue *q, +@@ -872,7 +876,7 @@ void submit_bio_noacct(struct bio *bio) + + if (blk_throtl_bio(bio)) + return; +- submit_bio_noacct_nocheck(bio); ++ submit_bio_noacct_nocheck(bio, false); + return; + + not_supported: +diff --git a/block/blk-merge.c b/block/blk-merge.c +index c411045fcf03a..77488f11a9441 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -134,7 +134,7 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors, + if (should_fail_bio(bio)) + bio_io_error(bio); + else if (!blk_throtl_bio(bio)) +- submit_bio_noacct_nocheck(bio); ++ submit_bio_noacct_nocheck(bio, true); + + return split; + } +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index cfa1cd60d2c5f..f510ae072868c 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1224,7 +1224,7 @@ static void blk_throtl_dispatch_work_fn(struct work_struct *work) + if (!bio_list_empty(&bio_list_on_stack)) { + blk_start_plug(&plug); + while ((bio = bio_list_pop(&bio_list_on_stack))) +- submit_bio_noacct_nocheck(bio); ++ submit_bio_noacct_nocheck(bio, false); + blk_finish_plug(&plug); + } + } +diff --git a/block/blk.h b/block/blk.h +index 18cc3c2afdd4d..d9efc8693aa48 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -54,7 +54,7 @@ bool blk_queue_start_drain(struct request_queue *q); + bool __blk_freeze_queue_start(struct request_queue *q, + struct task_struct *owner); + int __bio_queue_enter(struct request_queue *q, struct bio *bio); +-void submit_bio_noacct_nocheck(struct bio *bio); ++void submit_bio_noacct_nocheck(struct bio *bio, bool split); + void bio_await_chain(struct bio *bio); + + static inline bool blk_try_enter_queue(struct request_queue *q, bool pm) +-- +2.51.0 + diff --git a/queue-6.17/block-fix-stacking-of-atomic-writes-when-atomics-are.patch b/queue-6.17/block-fix-stacking-of-atomic-writes-when-atomics-are.patch new file mode 100644 index 0000000000..815dc99cb2 --- /dev/null +++ b/queue-6.17/block-fix-stacking-of-atomic-writes-when-atomics-are.patch @@ -0,0 +1,84 @@ +From 22ec32e8a8fa85cdb92f607b96fba5bb83310848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 10:34:59 +0000 +Subject: block: fix stacking of atomic writes when atomics are not supported + +From: John Garry + +[ Upstream commit f2d8c5a2f79c28569edf4948b611052253b5e99a ] + +Atomic writes support may not always be possible when stacking devices +which support atomic writes. Such as case is a different atomic write +boundary between stacked devices (which is not supported). + +In the case that atomic writes cannot supported, the top device queue HW +limits are set to 0. + +However, in blk_stack_atomic_writes_limits(), we detect that we are +stacking the first bottom device by checking the top device +atomic_write_hw_max value == 0. This get confused with the case of atomic +writes not supported, above. + +Make the distinction between stacking the first bottom device and no +atomics supported by initializing stacked device atomic_write_hw_max = +UINT_MAX and checking that for stacking the first bottom device. + +Fixes: d7f36dc446e8 ("block: Support atomic writes limits for stacked devices") +Signed-off-by: John Garry +Reviewed-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 6760dbf130b24..8fa52914e16b0 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -56,6 +56,7 @@ void blk_set_stacking_limits(struct queue_limits *lim) + lim->max_user_wzeroes_unmap_sectors = UINT_MAX; + lim->max_hw_zone_append_sectors = UINT_MAX; + lim->max_user_discard_sectors = UINT_MAX; ++ lim->atomic_write_hw_max = UINT_MAX; + } + EXPORT_SYMBOL(blk_set_stacking_limits); + +@@ -232,6 +233,10 @@ static void blk_validate_atomic_write_limits(struct queue_limits *lim) + if (!(lim->features & BLK_FEAT_ATOMIC_WRITES)) + goto unsupported; + ++ /* UINT_MAX indicates stacked limits in initial state */ ++ if (lim->atomic_write_hw_max == UINT_MAX) ++ goto unsupported; ++ + if (!lim->atomic_write_hw_max) + goto unsupported; + +@@ -723,18 +728,14 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t, + if (!blk_atomic_write_start_sect_aligned(start, b)) + goto unsupported; + +- /* +- * If atomic_write_hw_max is set, we have already stacked 1x bottom +- * device, so check for compliance. +- */ +- if (t->atomic_write_hw_max) { ++ /* UINT_MAX indicates no stacking of bottom devices yet */ ++ if (t->atomic_write_hw_max == UINT_MAX) { ++ if (!blk_stack_atomic_writes_head(t, b)) ++ goto unsupported; ++ } else { + if (!blk_stack_atomic_writes_tail(t, b)) + goto unsupported; +- return; + } +- +- if (!blk_stack_atomic_writes_head(t, b)) +- goto unsupported; + blk_stack_atomic_writes_chunk_sectors(t); + return; + +-- +2.51.0 + diff --git a/queue-6.17/block-initialize-bio-issue-time-in-blk_mq_submit_bio.patch b/queue-6.17/block-initialize-bio-issue-time-in-blk_mq_submit_bio.patch new file mode 100644 index 0000000000..18c014cdff --- /dev/null +++ b/queue-6.17/block-initialize-bio-issue-time-in-blk_mq_submit_bio.patch @@ -0,0 +1,108 @@ +From 2fa3b8836e8379e459490d6110d1e1f0c0a6ae31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 14:30:42 +0800 +Subject: block: initialize bio issue time in blk_mq_submit_bio() + +From: Yu Kuai + +[ Upstream commit 1f963bdd6420b6080bcfd0ee84a75c96f35545a6 ] + +bio->issue_time_ns is only used by blk-iolatency, which can only be +enabled for rq-based disk, hence it's not necessary to initialize +the time for bio-based disk. + +Meanwhile, if bio is split by blk_crypto_fallback_split_bio_if_needed(), +the issue time is not initialized for new split bio, this can be fixed +as well. + +Noted the next patch will optimize better that bio issue time will +only be used when blk-iolatency is really enabled by the disk. + +Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption") +Signed-off-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.h | 6 ------ + block/blk-core.c | 1 - + block/blk-merge.c | 1 - + block/blk-mq.c | 8 ++++++++ + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 8328427e31657..1cce3294634d1 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -370,11 +370,6 @@ static inline void blkg_put(struct blkcg_gq *blkg) + if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css), \ + (p_blkg)->q))) + +-static inline void blkcg_bio_issue_init(struct bio *bio) +-{ +- bio->issue_time_ns = blk_time_get_ns(); +-} +- + static inline void blkcg_use_delay(struct blkcg_gq *blkg) + { + if (WARN_ON_ONCE(atomic_read(&blkg->use_delay) < 0)) +@@ -497,7 +492,6 @@ static inline struct blkg_policy_data *blkg_to_pd(struct blkcg_gq *blkg, + static inline struct blkcg_gq *pd_to_blkg(struct blkg_policy_data *pd) { return NULL; } + static inline void blkg_get(struct blkcg_gq *blkg) { } + static inline void blkg_put(struct blkcg_gq *blkg) { } +-static inline void blkcg_bio_issue_init(struct bio *bio) { } + static inline void blk_cgroup_bio_start(struct bio *bio) { } + static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; } + +diff --git a/block/blk-core.c b/block/blk-core.c +index a27185cd8edea..e5af6eda5a459 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -730,7 +730,6 @@ static void __submit_bio_noacct_mq(struct bio *bio) + void submit_bio_noacct_nocheck(struct bio *bio) + { + blk_cgroup_bio_start(bio); +- blkcg_bio_issue_init(bio); + + if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) { + trace_block_bio_queue(bio); +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 70d704615be52..5538356770a47 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -119,7 +119,6 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors) + goto error; + } + split->bi_opf |= REQ_NOMERGE; +- blkcg_bio_issue_init(split); + bio_chain(split, bio); + trace_block_split(split, bio->bi_iter.bi_sector); + WARN_ON_ONCE(bio_zone_write_plugging(bio)); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 9055cd6247004..19b50110376c6 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -396,6 +396,13 @@ static inline void blk_mq_rq_time_init(struct request *rq, u64 alloc_time_ns) + #endif + } + ++static inline void blk_mq_bio_issue_init(struct bio *bio) ++{ ++#ifdef CONFIG_BLK_CGROUP ++ bio->issue_time_ns = blk_time_get_ns(); ++#endif ++} ++ + static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, + struct blk_mq_tags *tags, unsigned int tag) + { +@@ -3168,6 +3175,7 @@ void blk_mq_submit_bio(struct bio *bio) + if (!bio_integrity_prep(bio)) + goto queue_exit; + ++ blk_mq_bio_issue_init(bio); + if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) + goto queue_exit; + +-- +2.51.0 + diff --git a/queue-6.17/block-skip-unnecessary-checks-for-split-bio.patch b/queue-6.17/block-skip-unnecessary-checks-for-split-bio.patch new file mode 100644 index 0000000000..7772df6316 --- /dev/null +++ b/queue-6.17/block-skip-unnecessary-checks-for-split-bio.patch @@ -0,0 +1,72 @@ +From f0afc7868f942db52eace27e1ea6e74aed1fb760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 14:30:54 +0800 +Subject: block: skip unnecessary checks for split bio + +From: Yu Kuai + +[ Upstream commit 0b64682e78f7a53ea863e368b1aa66f05767858d ] + +Lots of checks are already done while submitting this bio the first +time, and there is no need to check them again when this bio is +resubmitted after split. + +Hence open code should_fail_bio() and blk_throtl_bio() that are still +necessary from submit_bio_split_bioset(). + +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 2 +- + block/blk-merge.c | 6 +++++- + block/blk.h | 1 + + 3 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index e5af6eda5a459..03a5d4c9cbf72 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -539,7 +539,7 @@ static inline void bio_check_ro(struct bio *bio) + } + } + +-static noinline int should_fail_bio(struct bio *bio) ++int should_fail_bio(struct bio *bio) + { + if (should_fail_request(bdev_whole(bio->bi_bdev), bio->bi_iter.bi_size)) + return -EIO; +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 51fe4ed5b7c0b..c411045fcf03a 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -130,7 +130,11 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors, + bio_chain(split, bio); + trace_block_split(split, bio->bi_iter.bi_sector); + WARN_ON_ONCE(bio_zone_write_plugging(bio)); +- submit_bio_noacct(bio); ++ ++ if (should_fail_bio(bio)) ++ bio_io_error(bio); ++ else if (!blk_throtl_bio(bio)) ++ submit_bio_noacct_nocheck(bio); + + return split; + } +diff --git a/block/blk.h b/block/blk.h +index 0268deb222688..18cc3c2afdd4d 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -615,6 +615,7 @@ extern const struct address_space_operations def_blk_aops; + int disk_register_independent_access_ranges(struct gendisk *disk); + void disk_unregister_independent_access_ranges(struct gendisk *disk); + ++int should_fail_bio(struct bio *bio); + #ifdef CONFIG_FAIL_MAKE_REQUEST + bool should_fail_request(struct block_device *part, unsigned int bytes); + #else /* CONFIG_FAIL_MAKE_REQUEST */ +-- +2.51.0 + diff --git a/queue-6.17/block-update-validation-of-atomic-writes-boundary-fo.patch b/queue-6.17/block-update-validation-of-atomic-writes-boundary-fo.patch new file mode 100644 index 0000000000..741825b9e1 --- /dev/null +++ b/queue-6.17/block-update-validation-of-atomic-writes-boundary-fo.patch @@ -0,0 +1,78 @@ +From f6911f1cb732ffc43b29e4ab0489258c21b9adec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 10:34:58 +0000 +Subject: block: update validation of atomic writes boundary for stacked + devices + +From: John Garry + +[ Upstream commit bfd4037296bd7e1f95394a2e3daf8e3c1796c3b3 ] + +In commit 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked +atomic write limits"), it was missed to use a chunk sectors limit check +in blk_stack_atomic_writes_boundary_head(), so update that function to +do the proper check. + +Fixes: 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked atomic write limits") +Signed-off-by: John Garry +Reviewed-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 693bc8d20acf3..6760dbf130b24 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -643,18 +643,24 @@ static bool blk_stack_atomic_writes_tail(struct queue_limits *t, + static bool blk_stack_atomic_writes_boundary_head(struct queue_limits *t, + struct queue_limits *b) + { ++ unsigned int boundary_sectors; ++ ++ if (!b->atomic_write_hw_boundary || !t->chunk_sectors) ++ return true; ++ ++ boundary_sectors = b->atomic_write_hw_boundary >> SECTOR_SHIFT; ++ + /* + * Ensure atomic write boundary is aligned with chunk sectors. Stacked +- * devices store chunk sectors in t->io_min. ++ * devices store any stripe size in t->chunk_sectors. + */ +- if (b->atomic_write_hw_boundary > t->io_min && +- b->atomic_write_hw_boundary % t->io_min) ++ if (boundary_sectors > t->chunk_sectors && ++ boundary_sectors % t->chunk_sectors) + return false; +- if (t->io_min > b->atomic_write_hw_boundary && +- t->io_min % b->atomic_write_hw_boundary) ++ if (t->chunk_sectors > boundary_sectors && ++ t->chunk_sectors % boundary_sectors) + return false; + +- t->atomic_write_hw_boundary = b->atomic_write_hw_boundary; + return true; + } + +@@ -695,13 +701,13 @@ static void blk_stack_atomic_writes_chunk_sectors(struct queue_limits *t) + static bool blk_stack_atomic_writes_head(struct queue_limits *t, + struct queue_limits *b) + { +- if (b->atomic_write_hw_boundary && +- !blk_stack_atomic_writes_boundary_head(t, b)) ++ if (!blk_stack_atomic_writes_boundary_head(t, b)) + return false; + + t->atomic_write_hw_unit_max = b->atomic_write_hw_unit_max; + t->atomic_write_hw_unit_min = b->atomic_write_hw_unit_min; + t->atomic_write_hw_max = b->atomic_write_hw_max; ++ t->atomic_write_hw_boundary = b->atomic_write_hw_boundary; + return true; + } + +-- +2.51.0 + diff --git a/queue-6.17/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.17/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..fe153c56c7 --- /dev/null +++ b/queue-6.17/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From fbc31a615c94f0a00effb0cc05257d4a76a8a658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index d6438e6c276dc..693bc8d20acf3 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -763,7 +763,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t, + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->features |= (b->features & BLK_FEAT_INHERIT_MASK); + +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-btintel_pcie-refactor-device-coredump.patch b/queue-6.17/bluetooth-btintel_pcie-refactor-device-coredump.patch new file mode 100644 index 0000000000..4e4279e373 --- /dev/null +++ b/queue-6.17/bluetooth-btintel_pcie-refactor-device-coredump.patch @@ -0,0 +1,362 @@ +From 8498588fb2bba51d28d1c63efa061f235161cb24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:18:49 +0530 +Subject: Bluetooth: btintel_pcie: Refactor Device Coredump + +From: Kiran K + +[ Upstream commit 58fddb364dd5c4e9bf223a2113a42538d9c040de ] + +As device coredumps are not HCI traces, maintain the device coredump at +the driver level and eliminate the dependency on hdev_devcd*() + +Signed-off-by: Kiran K +Fixes: 07e6bddb54b4 ("Bluetooth: btintel_pcie: Add support for device coredump") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btintel_pcie.c | 220 +++++++++++-------------------- + drivers/bluetooth/btintel_pcie.h | 2 + + 2 files changed, 77 insertions(+), 145 deletions(-) + +diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c +index 6e7bbbd35279f..585de143ab255 100644 +--- a/drivers/bluetooth/btintel_pcie.c ++++ b/drivers/bluetooth/btintel_pcie.c +@@ -15,6 +15,7 @@ + #include + + #include ++#include + + #include + #include +@@ -554,25 +555,6 @@ static void btintel_pcie_mac_init(struct btintel_pcie_data *data) + btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); + } + +-static int btintel_pcie_add_dmp_data(struct hci_dev *hdev, const void *data, int size) +-{ +- struct sk_buff *skb; +- int err; +- +- skb = alloc_skb(size, GFP_ATOMIC); +- if (!skb) +- return -ENOMEM; +- +- skb_put_data(skb, data, size); +- err = hci_devcd_append(hdev, skb); +- if (err) { +- bt_dev_err(hdev, "Failed to append data in the coredump"); +- return err; +- } +- +- return 0; +-} +- + static int btintel_pcie_get_mac_access(struct btintel_pcie_data *data) + { + u32 reg; +@@ -617,30 +599,35 @@ static void btintel_pcie_release_mac_access(struct btintel_pcie_data *data) + btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); + } + +-static void btintel_pcie_copy_tlv(struct sk_buff *skb, enum btintel_pcie_tlv_type type, +- void *data, int size) ++static void *btintel_pcie_copy_tlv(void *dest, enum btintel_pcie_tlv_type type, ++ void *data, size_t size) + { + struct intel_tlv *tlv; + +- tlv = skb_put(skb, sizeof(*tlv) + size); ++ tlv = dest; + tlv->type = type; + tlv->len = size; + memcpy(tlv->val, data, tlv->len); ++ return dest + sizeof(*tlv) + size; + } + + static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data) + { +- u32 offset, prev_size, wr_ptr_status, dump_size, i; ++ u32 offset, prev_size, wr_ptr_status, dump_size, data_len; + struct btintel_pcie_dbgc *dbgc = &data->dbgc; +- u8 buf_idx, dump_time_len, fw_build; + struct hci_dev *hdev = data->hdev; ++ u8 *pdata, *p, buf_idx; + struct intel_tlv *tlv; + struct timespec64 now; +- struct sk_buff *skb; + struct tm tm_now; +- char buf[256]; +- u16 hdr_len; +- int ret; ++ char fw_build[128]; ++ char ts[128]; ++ char vendor[64]; ++ char driver[64]; ++ ++ if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) ++ return -EOPNOTSUPP; ++ + + wr_ptr_status = btintel_pcie_rd_dev_mem(data, BTINTEL_PCIE_DBGC_CUR_DBGBUFF_STATUS); + offset = wr_ptr_status & BTINTEL_PCIE_DBG_OFFSET_BIT_MASK; +@@ -657,88 +644,84 @@ static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data) + else + return -EINVAL; + ++ snprintf(vendor, sizeof(vendor), "Vendor: Intel\n"); ++ snprintf(driver, sizeof(driver), "Driver: %s\n", ++ data->dmp_hdr.driver_name); ++ + ktime_get_real_ts64(&now); + time64_to_tm(now.tv_sec, 0, &tm_now); +- dump_time_len = snprintf(buf, sizeof(buf), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d", ++ snprintf(ts, sizeof(ts), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d", + tm_now.tm_mday, tm_now.tm_mon + 1, tm_now.tm_year + 1900, + tm_now.tm_hour, tm_now.tm_min, tm_now.tm_sec); + +- fw_build = snprintf(buf + dump_time_len, sizeof(buf) - dump_time_len, ++ snprintf(fw_build, sizeof(fw_build), + "Firmware Timestamp: Year %u WW %02u buildtype %u build %u", + 2000 + (data->dmp_hdr.fw_timestamp >> 8), + data->dmp_hdr.fw_timestamp & 0xff, data->dmp_hdr.fw_build_type, + data->dmp_hdr.fw_build_num); + +- hdr_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) + +- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) + +- sizeof(*tlv) + dump_time_len + +- sizeof(*tlv) + fw_build; ++ data_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) + ++ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) + ++ sizeof(*tlv) + strlen(ts) + ++ sizeof(*tlv) + strlen(fw_build) + ++ sizeof(*tlv) + strlen(vendor) + ++ sizeof(*tlv) + strlen(driver); + +- dump_size = hdr_len + sizeof(hdr_len); ++ /* ++ * sizeof(u32) - signature ++ * sizeof(data_len) - to store tlv data size ++ * data_len - TLV data ++ */ ++ dump_size = sizeof(u32) + sizeof(data_len) + data_len; + +- skb = alloc_skb(dump_size, GFP_KERNEL); +- if (!skb) +- return -ENOMEM; + + /* Add debug buffers data length to dump size */ + dump_size += BTINTEL_PCIE_DBGC_BUFFER_SIZE * dbgc->count; + +- ret = hci_devcd_init(hdev, dump_size); +- if (ret) { +- bt_dev_err(hdev, "Failed to init devcoredump, err %d", ret); +- kfree_skb(skb); +- return ret; +- } ++ pdata = vmalloc(dump_size); ++ if (!pdata) ++ return -ENOMEM; ++ p = pdata; ++ ++ *(u32 *)p = BTINTEL_PCIE_MAGIC_NUM; ++ p += sizeof(u32); + +- skb_put_data(skb, &hdr_len, sizeof(hdr_len)); ++ *(u32 *)p = data_len; ++ p += sizeof(u32); + +- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt, +- sizeof(data->dmp_hdr.cnvi_bt)); + +- btintel_pcie_copy_tlv(skb, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr, +- sizeof(data->dmp_hdr.write_ptr)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_VENDOR, vendor, strlen(vendor)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_DRIVER, driver, strlen(driver)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_DUMP_TIME, ts, strlen(ts)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_BUILD, fw_build, ++ strlen(fw_build)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt, ++ sizeof(data->dmp_hdr.cnvi_bt)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr, ++ sizeof(data->dmp_hdr.write_ptr)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr, ++ sizeof(data->dmp_hdr.wrap_ctr)); + + data->dmp_hdr.wrap_ctr = btintel_pcie_rd_dev_mem(data, + BTINTEL_PCIE_DBGC_DBGBUFF_WRAP_ARND); + +- btintel_pcie_copy_tlv(skb, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr, +- sizeof(data->dmp_hdr.wrap_ctr)); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason, +- sizeof(data->dmp_hdr.trigger_reason)); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1, +- sizeof(data->dmp_hdr.fw_git_sha1)); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top, +- sizeof(data->dmp_hdr.cnvr_top)); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top, +- sizeof(data->dmp_hdr.cnvi_top)); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_DUMP_TIME, buf, dump_time_len); +- +- btintel_pcie_copy_tlv(skb, BTINTEL_FW_BUILD, buf + dump_time_len, fw_build); +- +- ret = hci_devcd_append(hdev, skb); +- if (ret) +- goto exit_err; +- +- for (i = 0; i < dbgc->count; i++) { +- ret = btintel_pcie_add_dmp_data(hdev, dbgc->bufs[i].data, +- BTINTEL_PCIE_DBGC_BUFFER_SIZE); +- if (ret) +- break; +- } +- +-exit_err: +- hci_devcd_complete(hdev); +- return ret; ++ p = btintel_pcie_copy_tlv(p, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason, ++ sizeof(data->dmp_hdr.trigger_reason)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1, ++ sizeof(data->dmp_hdr.fw_git_sha1)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top, ++ sizeof(data->dmp_hdr.cnvr_top)); ++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top, ++ sizeof(data->dmp_hdr.cnvi_top)); ++ ++ memcpy(p, dbgc->bufs[0].data, dbgc->count * BTINTEL_PCIE_DBGC_BUFFER_SIZE); ++ dev_coredumpv(&hdev->dev, pdata, dump_size, GFP_KERNEL); ++ return 0; + } + + static void btintel_pcie_dump_traces(struct hci_dev *hdev) +@@ -760,51 +743,6 @@ static void btintel_pcie_dump_traces(struct hci_dev *hdev) + bt_dev_err(hdev, "Failed to dump traces: (%d)", ret); + } + +-static void btintel_pcie_dump_hdr(struct hci_dev *hdev, struct sk_buff *skb) +-{ +- struct btintel_pcie_data *data = hci_get_drvdata(hdev); +- u16 len = skb->len; +- u16 *hdrlen_ptr; +- char buf[80]; +- +- hdrlen_ptr = skb_put_zero(skb, sizeof(len)); +- +- snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", +- INTEL_HW_VARIANT(data->dmp_hdr.cnvi_bt)); +- skb_put_data(skb, buf, strlen(buf)); +- +- snprintf(buf, sizeof(buf), "Firmware Build Number: %u\n", +- data->dmp_hdr.fw_build_num); +- skb_put_data(skb, buf, strlen(buf)); +- +- snprintf(buf, sizeof(buf), "Driver: %s\n", data->dmp_hdr.driver_name); +- skb_put_data(skb, buf, strlen(buf)); +- +- snprintf(buf, sizeof(buf), "Vendor: Intel\n"); +- skb_put_data(skb, buf, strlen(buf)); +- +- *hdrlen_ptr = skb->len - len; +-} +- +-static void btintel_pcie_dump_notify(struct hci_dev *hdev, int state) +-{ +- struct btintel_pcie_data *data = hci_get_drvdata(hdev); +- +- switch (state) { +- case HCI_DEVCOREDUMP_IDLE: +- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE; +- break; +- case HCI_DEVCOREDUMP_ACTIVE: +- data->dmp_hdr.state = HCI_DEVCOREDUMP_ACTIVE; +- break; +- case HCI_DEVCOREDUMP_TIMEOUT: +- case HCI_DEVCOREDUMP_ABORT: +- case HCI_DEVCOREDUMP_DONE: +- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE; +- break; +- } +-} +- + /* This function enables BT function by setting BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT bit in + * BTINTEL_PCIE_CSR_FUNC_CTRL_REG register and wait for MSI-X with + * BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0. +@@ -1378,6 +1316,11 @@ static void btintel_pcie_rx_work(struct work_struct *work) + struct btintel_pcie_data, rx_work); + struct sk_buff *skb; + ++ if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) { ++ btintel_pcie_dump_traces(data->hdev); ++ clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags); ++ } ++ + if (test_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags)) { + /* Unlike usb products, controller will not send hardware + * exception event on exception. Instead controller writes the +@@ -1390,11 +1333,6 @@ static void btintel_pcie_rx_work(struct work_struct *work) + clear_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags); + } + +- if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) { +- btintel_pcie_dump_traces(data->hdev); +- clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags); +- } +- + /* Process the sk_buf in queue and send to the HCI layer */ + while ((skb = skb_dequeue(&data->rx_skb_q))) { + btintel_pcie_recv_frame(data, skb); +@@ -2184,13 +2122,6 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev) + if (ver_tlv.img_type == 0x02 || ver_tlv.img_type == 0x03) + data->dmp_hdr.fw_git_sha1 = ver_tlv.git_sha1; + +- err = hci_devcd_register(hdev, btintel_pcie_dump_traces, btintel_pcie_dump_hdr, +- btintel_pcie_dump_notify); +- if (err) { +- bt_dev_err(hdev, "Failed to register coredump (%d)", err); +- goto exit_error; +- } +- + btintel_print_fseq_info(hdev); + exit_error: + kfree_skb(skb); +@@ -2319,7 +2250,6 @@ static void btintel_pcie_removal_work(struct work_struct *wk) + btintel_pcie_synchronize_irqs(data); + + flush_work(&data->rx_work); +- flush_work(&data->hdev->dump.dump_rx); + + bt_dev_dbg(data->hdev, "Release bluetooth interface"); + btintel_pcie_release_hdev(data); +diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h +index 0fa876c5b954a..04b21f968ad30 100644 +--- a/drivers/bluetooth/btintel_pcie.h ++++ b/drivers/bluetooth/btintel_pcie.h +@@ -132,6 +132,8 @@ enum btintel_pcie_tlv_type { + BTINTEL_CNVI_TOP, + BTINTEL_DUMP_TIME, + BTINTEL_FW_BUILD, ++ BTINTEL_VENDOR, ++ BTINTEL_DRIVER + }; + + /* causes for the MBOX interrupts */ +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.17/bluetooth-hci_sync-fix-using-random-address-for-big-.patch new file mode 100644 index 0000000000..6bb3fd3bd5 --- /dev/null +++ b/queue-6.17/bluetooth-hci_sync-fix-using-random-address-for-big-.patch @@ -0,0 +1,57 @@ +From 404b0b26b9cd58c32d0a20bdd62658c998aa3830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 12:30:05 -0400 +Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA + advertisements + +From: Luiz Augusto von Dentz + +[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ] + +When creating an advertisement for BIG the address shall not be +non-resolvable since in case of acting as BASS/Broadcast Assistant the +address must be the same as the connection in order to use the PAST +method and even when PAST/BASS are not in the picture a Periodic +Advertisement can still be synchronized thus the same argument as to +connectable advertisements still stand. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Luiz Augusto von Dentz +Reviewed-by: Paul Menzel +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 7a7d498908584..eefdb6134ca53 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.17/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch new file mode 100644 index 0000000000..4cf03c5529 --- /dev/null +++ b/queue-6.17/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch @@ -0,0 +1,38 @@ +From 176475e51e4f8d34cb5bdb24a0393985bda4e4af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:22 +0300 +Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX + +From: Pauli Virtanen + +[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ] + +For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the +skb is leaked. + +Free skb after copying its data. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 9170c46eb47c6..88602f19decac 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -2416,7 +2416,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.17/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch new file mode 100644 index 0000000000..ba642efeef --- /dev/null +++ b/queue-6.17/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch @@ -0,0 +1,40 @@ +From 57d37564233799eeff3828169c0095491ab70635 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:27:51 -0400 +Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free + +From: Luiz Augusto von Dentz + +[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] + +This attempt to fix similar issue to sco_conn_free where if the +conn->sk is not set to NULL may lead to UAF on iso_conn_free. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 5ce823ca3aaf4..c047a15e3fa39 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-iso-free-rx_skb-if-not-consumed.patch b/queue-6.17/bluetooth-iso-free-rx_skb-if-not-consumed.patch new file mode 100644 index 0000000000..96380680c6 --- /dev/null +++ b/queue-6.17/bluetooth-iso-free-rx_skb-if-not-consumed.patch @@ -0,0 +1,35 @@ +From af6b752fe5c4b0c8edf85821e1afe861ceec4966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:21 +0300 +Subject: Bluetooth: ISO: free rx_skb if not consumed + +From: Pauli Virtanen + +[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ] + +If iso_conn is freed when RX is incomplete, free any leftover skb piece. + +Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index c047a15e3fa39..9170c46eb47c6 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref) + /* Ensure no more work items will run since hci_conn has been dropped */ + disable_delayed_work_sync(&conn->timeout_work); + ++ kfree_skb(conn->rx_skb); ++ + kfree(conn); + } + +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.17/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..00f2e2f07b --- /dev/null +++ b/queue-6.17/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From 9340e23db147f00439cf32c02504fd05db898fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 225140fcb3d6c..a3d16eece0d23 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +-- +2.51.0 + diff --git a/queue-6.17/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch b/queue-6.17/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch new file mode 100644 index 0000000000..10794f0268 --- /dev/null +++ b/queue-6.17/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch @@ -0,0 +1,95 @@ +From 892a8fdf08c308a2c8d93b29f5a2e8542b3159f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:33:03 +0000 +Subject: bonding: fix xfrm offload feature setup on active-backup mode + +From: Hangbin Liu + +[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ] + +The active-backup bonding mode supports XFRM ESP offload. However, when +a bond is added using command like `ip link add bond0 type bond mode 1 +miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is +disabled. This occurs because, in bond_newlink(), we change bond link +first and register bond device later. So the XFRM feature update in +bond_option_mode_set() is not called as the bond device is not yet +registered, leading to the offload feature not being set successfully. + +To resolve this issue, we can modify the code order in bond_newlink() to +ensure that the bond device is registered first before changing the bond +link parameters. This change will allow the XFRM ESP offload feature to be +correctly enabled. + +Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time") +Signed-off-by: Hangbin Liu +Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + drivers/net/bonding/bond_netlink.c | 16 +++++++++------- + include/net/bonding.h | 1 + + 3 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 57be04f6cb11a..f4f0feddd9fa0 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4411,7 +4411,7 @@ void bond_work_init_all(struct bonding *bond) + INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler); + } + +-static void bond_work_cancel_all(struct bonding *bond) ++void bond_work_cancel_all(struct bonding *bond) + { + cancel_delayed_work_sync(&bond->mii_work); + cancel_delayed_work_sync(&bond->arp_work); +diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c +index 57fff2421f1b5..7a9d73ec8e91c 100644 +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -579,20 +579,22 @@ static int bond_newlink(struct net_device *bond_dev, + struct rtnl_newlink_params *params, + struct netlink_ext_ack *extack) + { ++ struct bonding *bond = netdev_priv(bond_dev); + struct nlattr **data = params->data; + struct nlattr **tb = params->tb; + int err; + +- err = bond_changelink(bond_dev, tb, data, extack); +- if (err < 0) ++ err = register_netdevice(bond_dev); ++ if (err) + return err; + +- err = register_netdevice(bond_dev); +- if (!err) { +- struct bonding *bond = netdev_priv(bond_dev); ++ netif_carrier_off(bond_dev); ++ bond_work_init_all(bond); + +- netif_carrier_off(bond_dev); +- bond_work_init_all(bond); ++ err = bond_changelink(bond_dev, tb, data, extack); ++ if (err) { ++ bond_work_cancel_all(bond); ++ unregister_netdevice(bond_dev); + } + + return err; +diff --git a/include/net/bonding.h b/include/net/bonding.h +index e06f0d63b2c17..bd56ad976cfb0 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -711,6 +711,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev, + int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave); + void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay); + void bond_work_init_all(struct bonding *bond); ++void bond_work_cancel_all(struct bonding *bond); + + #ifdef CONFIG_PROC_FS + void bond_create_proc_entry(struct bonding *bond); +-- +2.51.0 + diff --git a/queue-6.17/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch b/queue-6.17/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch new file mode 100644 index 0000000000..768b886fd8 --- /dev/null +++ b/queue-6.17/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch @@ -0,0 +1,41 @@ +From b4c531d3aa3206702313f308b201af247d3f9930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 23:26:53 +0000 +Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() + +From: Hengqi Chen + +[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ] + +The current implementation seems incorrect and does NOT match the +comment above, use bpf_jit_binary_pack_finalize() instead. + +Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") +Acked-by: Puranjay Mohan +Signed-off-by: Hengqi Chen +Acked-by: Song Liu +Acked-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 52ffe115a8c47..4ef9b7b8fb404 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -3064,8 +3064,7 @@ void bpf_jit_free(struct bpf_prog *prog) + * before freeing it. + */ + if (jit_data) { +- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size, +- sizeof(jit_data->header->size)); ++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kfree(jit_data); + } + prog->bpf_func -= cfi_get_offset(); +-- +2.51.0 + diff --git a/queue-6.17/bpf-dont-report-verifier-bug-for-missing-bpf_scc_vis.patch b/queue-6.17/bpf-dont-report-verifier-bug-for-missing-bpf_scc_vis.patch new file mode 100644 index 0000000000..0ee47a66cb --- /dev/null +++ b/queue-6.17/bpf-dont-report-verifier-bug-for-missing-bpf_scc_vis.patch @@ -0,0 +1,82 @@ +From 3860cd5b1139d2f8ec2f9f5e5f8350753f9453a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:22:50 -0700 +Subject: bpf: dont report verifier bug for missing bpf_scc_visit on + speculative path + +From: Eduard Zingerman + +[ Upstream commit a3c73d629ea1373af3c0c954d41fd1af555492e3 ] + +Syzbot generated a program that triggers a verifier_bug() call in +maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a +state with insn_idx in some SCC, there should be an instance of struct +bpf_scc_visit allocated for that SCC. Turns out the assumption does +not hold for speculative execution paths. See example in the next +patch. + +maybe_scc_exit() is called from update_branch_counts() for states that +reach branch count of zero, meaning that path exploration for a +particular path is finished. Path exploration can finish in one of +three ways: +a. Verification error is found. In this case, update_branch_counts() + is called only for non-speculative paths. +b. Top level BPF_EXIT is reached. Such instructions are never a part of + an SCC, so compute_scc_callchain() in maybe_scc_exit() will return + false, and maybe_scc_exit() will return early. +c. A checkpoint is reached and matched. Checkpoints are created by + is_state_visited(), which calls maybe_enter_scc(), which allocates + bpf_scc_visit instances for checkpoints within SCCs. + +Hence, for non-speculative symbolic execution paths, the assumption +still holds: if maybe_scc_exit() is called for a state within an SCC, +bpf_scc_visit instance must exist. + +This patch removes the verifier_bug() call for speculative paths. + +Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges") +Reported-by: syzbot+3afc814e8df1af64b653@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/ +Signed-off-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20250916212251.3490455-1-eddyz87@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9fb1f957a0937..6ad0dc226183a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1946,9 +1946,24 @@ static int maybe_exit_scc(struct bpf_verifier_env *env, struct bpf_verifier_stat + return 0; + visit = scc_visit_lookup(env, callchain); + if (!visit) { +- verifier_bug(env, "scc exit: no visit info for call chain %s", +- format_callchain(env, callchain)); +- return -EFAULT; ++ /* ++ * If path traversal stops inside an SCC, corresponding bpf_scc_visit ++ * must exist for non-speculative paths. For non-speculative paths ++ * traversal stops when: ++ * a. Verification error is found, maybe_exit_scc() is not called. ++ * b. Top level BPF_EXIT is reached. Top level BPF_EXIT is not a member ++ * of any SCC. ++ * c. A checkpoint is reached and matched. Checkpoints are created by ++ * is_state_visited(), which calls maybe_enter_scc(), which allocates ++ * bpf_scc_visit instances for checkpoints within SCCs. ++ * (c) is the only case that can reach this point. ++ */ ++ if (!st->speculative) { ++ verifier_bug(env, "scc exit: no visit info for call chain %s", ++ format_callchain(env, callchain)); ++ return -EFAULT; ++ } ++ return 0; + } + if (visit->entry_state != st) + return 0; +-- +2.51.0 + diff --git a/queue-6.17/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.17/bpf-enforce-expected_attach_type-for-tailcall-compat.patch new file mode 100644 index 0000000000..d28fdf1e28 --- /dev/null +++ b/queue-6.17/bpf-enforce-expected_attach_type-for-tailcall-compat.patch @@ -0,0 +1,93 @@ +From d637034fbdc8fb0a4e0dc0839f8647eeda193df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 19:12:00 +0200 +Subject: bpf: Enforce expected_attach_type for tailcall compatibility + +From: Daniel Borkmann + +[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ] + +Yinhao et al. recently reported: + + Our fuzzer tool discovered an uninitialized pointer issue in the + bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. + This leads to a NULL pointer dereference when a BPF program attempts to + deference the txq member of struct xdp_buff object. + +The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the +entry point for bpf_prog_test_run_xdp() and its expected_attach_type can +neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot +of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP +to pass xdp_is_valid_access() validation. The program returns struct xdp_md's +egress_ifindex, and the latter is only allowed to be accessed under mentioned +expected_attach_type. progB is then inserted into the tailcall which progA +calls. + +The underlying issue goes beyond XDP though. Another example are programs +of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well +as sock_addr_func_proto() have different logic depending on the programs' +expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME +should not be allowed doing a tailcall into a program which calls bpf_bind() +out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. + +In short, specifying expected_attach_type allows to open up additional +functionality or restrictions beyond what the basic bpf_prog_type enables. +The use of tailcalls must not violate these constraints. Fix it by enforcing +expected_attach_type in __bpf_prog_map_compatible(). + +Note that we only enforce this for tailcall maps, but not for BPF devmaps or +cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and +cpu_map_bpf_prog_run*() which set up a new environment / context and therefore +these situations are not prone to this issue. + +Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") +Reported-by: Yinhao Hu +Reported-by: Kaiyan Mei +Reviewed-by: Dongliang Mu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 + + kernel/bpf/core.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index cc700925b802f..84826dc0a3268 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -285,6 +285,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index e4568d44e8279..f6dd071f5e38c 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2393,6 +2393,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2404,6 +2405,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +-- +2.51.0 + diff --git a/queue-6.17/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.17/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..733ac198c9 --- /dev/null +++ b/queue-6.17/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From ed18936959f8071f504aa3c21d2ea86f52fdaf16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index da391e2b0788d..2d326d35c3871 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9284,13 +9284,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-6.17/bpf-mark-kfuncs-as-__noclone.patch b/queue-6.17/bpf-mark-kfuncs-as-__noclone.patch new file mode 100644 index 0000000000..49c8568bea --- /dev/null +++ b/queue-6.17/bpf-mark-kfuncs-as-__noclone.patch @@ -0,0 +1,56 @@ +From 12873d9458267246162e045999fa695770ed5f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 10:14:26 +0200 +Subject: bpf: Mark kfuncs as __noclone + +From: Andrea Righi + +[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ] + +Some distributions (e.g., CachyOS) support building the kernel with -O3, +but doing so may break kfuncs, resulting in their symbols not being +properly exported. + +In fact, with gcc -O3, some kfuncs may be optimized away despite being +annotated as noinline. This happens because gcc can still clone the +function during IPA optimizations, e.g., by duplicating or inlining it +into callers, and then dropping the standalone symbol. This breaks BTF +ID resolution since resolve_btfids relies on the presence of a global +symbol for each kfunc. + +Currently, this is not an issue for upstream, because we don't allow +building the kernel with -O3, but it may be safer to address it anyway, +to prevent potential issues in the future if compilers become more +aggressive with optimizations. + +Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never +cloned and remain distinct, globally visible symbols, regardless of +the optimization level. + +Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs") +Acked-by: David Vernet +Acked-by: Yonghong Song +Signed-off-by: Andrea Righi +Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/btf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/btf.h b/include/linux/btf.h +index 9eda6b113f9b4..f06976ffb63f9 100644 +--- a/include/linux/btf.h ++++ b/include/linux/btf.h +@@ -86,7 +86,7 @@ + * as to avoid issues such as the compiler inlining or eliding either a static + * kfunc, or a global kfunc in an LTO build. + */ +-#define __bpf_kfunc __used __retain noinline ++#define __bpf_kfunc __used __retain __noclone noinline + + #define __bpf_kfunc_start_defs() \ + __diag_push(); \ +-- +2.51.0 + diff --git a/queue-6.17/bpf-reject-negative-offsets-for-alu-ops.patch b/queue-6.17/bpf-reject-negative-offsets-for-alu-ops.patch new file mode 100644 index 0000000000..9edcde459e --- /dev/null +++ b/queue-6.17/bpf-reject-negative-offsets-for-alu-ops.patch @@ -0,0 +1,61 @@ +From d9fd833798db839be187606e9949021b3ef4f0c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 23:04:33 +0800 +Subject: bpf: Reject negative offsets for ALU ops + +From: Yazhou Tang + +[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] + +When verifying BPF programs, the check_alu_op() function validates +instructions with ALU operations. The 'offset' field in these +instructions is a signed 16-bit integer. + +The existing check 'insn->off > 1' was intended to ensure the offset is +either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is +signed, this check incorrectly accepts all negative values (e.g., -1). + +This commit tightens the validation by changing the condition to +'(insn->off != 0 && insn->off != 1)'. This ensures that any value +other than the explicitly permitted 0 and 1 is rejected, hardening the +verifier against malformed BPF programs. + +Co-developed-by: Shenghao Yuan +Signed-off-by: Shenghao Yuan +Co-developed-by: Tianci Cao +Signed-off-by: Tianci Cao +Signed-off-by: Yazhou Tang +Acked-by: Yonghong Song +Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") +Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 299e43dac873e..ed1457c273409 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15755,7 +15755,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } else { /* all other ALU ops: and, sub, xor, add, ... */ + + if (BPF_SRC(insn->code) == BPF_X) { +- if (insn->imm != 0 || insn->off > 1 || ++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +@@ -15765,7 +15765,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + if (err) + return err; + } else { +- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || ++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.17/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch new file mode 100644 index 0000000000..c239d54d00 --- /dev/null +++ b/queue-6.17/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch @@ -0,0 +1,59 @@ +From 2a8de15a1bf7cb70b796f6c640f1fd63342d3579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:14:29 +0800 +Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run + +From: Tao Chen + +[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ] + +Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run +called all the way from graph tracer, which disables preemption in +function_graph_enter_regs, as Jiri and Yonghong suggested, there is no +need to use migrate_disable. As a result, some overhead may will be reduced. +And add cant_sleep check for __this_cpu_inc_return. + +Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 3ae52978cae61..606007c387c52 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2728,20 +2728,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct pt_regs *regs; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + bpf_prog_inc_misses_counter(link->link.prog); + err = 1; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr()); + old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.51.0 + diff --git a/queue-6.17/bpf-remove-preempt_disable-in-bpf_try_get_buffers.patch b/queue-6.17/bpf-remove-preempt_disable-in-bpf_try_get_buffers.patch new file mode 100644 index 0000000000..f808201ef1 --- /dev/null +++ b/queue-6.17/bpf-remove-preempt_disable-in-bpf_try_get_buffers.patch @@ -0,0 +1,48 @@ +From d36cc320b0322c5623c03777797b2b0a278dec65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 20:56:38 +0800 +Subject: bpf: Remove preempt_disable in bpf_try_get_buffers + +From: Tao Chen + +[ Upstream commit 4223bf833c8495e40ae2886acbc0ecbe88fa6306 ] + +Now BPF program will run with migration disabled, so it is safe +to access this_cpu_inc_return(bpf_bprintf_nest_level). + +Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250819125638.2544715-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 8af62cb243d9e..9c750a6a895bf 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -774,11 +774,9 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs) + { + int nest_level; + +- preempt_disable(); + nest_level = this_cpu_inc_return(bpf_bprintf_nest_level); + if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) { + this_cpu_dec(bpf_bprintf_nest_level); +- preempt_enable(); + return -EBUSY; + } + *bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]); +@@ -791,7 +789,6 @@ void bpf_put_buffers(void) + if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0)) + return; + this_cpu_dec(bpf_bprintf_nest_level); +- preempt_enable(); + } + + void bpf_bprintf_cleanup(struct bpf_bprintf_data *data) +-- +2.51.0 + diff --git a/queue-6.17/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.17/bpf-selftests-fix-test_tcpnotify_user.patch new file mode 100644 index 0000000000..b4a11a723b --- /dev/null +++ b/queue-6.17/bpf-selftests-fix-test_tcpnotify_user.patch @@ -0,0 +1,139 @@ +From 295c137bb9814f2dc178da05e5213b72ed6d03f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:12:14 +0000 +Subject: bpf/selftests: Fix test_tcpnotify_user + +From: Matt Bobrowski + +[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ] + +Based on a bisect, it appears that commit 7ee988770326 ("timers: +Implement the hierarchical pull model") has somehow inadvertently +broken BPF selftest test_tcpnotify_user. The error that is being +generated by this test is as follows: + + FAILED: Wrong stats Expected 10 calls, got 8 + +It looks like the change allows timer functions to be run on CPUs +different from the one they are armed on. The test had pinned itself +to CPU 0, and in the past the retransmit attempts also occurred on CPU +0. The test had set the max_entries attribute for +BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling +bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was +likely to be in range. With the change to allow timers to run on other +CPUs, the current CPU tasked with performing the retransmit might be +bumped and in turn fall out of range, as the event will be filtered +out via __bpf_perf_event_output() using: + + if (unlikely(index >= array->map.max_entries)) + return -E2BIG; + +A possible change would be to explicitly set the max_entries attribute +for perf_event_map in test_tcpnotify_kern.c to a value that's at least +as large as the number of CPUs. As it turns out however, if the field +is left unset, then the libbpf will determine the number of CPUs available +on the underlying system and update the max_entries attribute accordingly +in map_set_def_max_entries(). + +A further problem with the test is that it has a thread that continues +running up until the program exits. The main thread cleans up some +LIBBPF data structures, while the other thread continues to use them, +which inevitably will trigger a SIGSEGV. This can be dealt with by +telling the thread to run for as long as necessary and doing a +pthread_join on it before exiting the program. + +Finally, I don't think binding the process to CPU 0 is meaningful for +this test any more, so get rid of that. + +Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") +Signed-off-by: Matt Bobrowski +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 - + .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++---------- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85..ef00d38b0a8d2 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f..35b4893ccdf8a 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +-- +2.51.0 + diff --git a/queue-6.17/bpf-skip-scalar-adjustment-for-bpf_neg-if-dst-is-a-p.patch b/queue-6.17/bpf-skip-scalar-adjustment-for-bpf_neg-if-dst-is-a-p.patch new file mode 100644 index 0000000000..d61a2590c2 --- /dev/null +++ b/queue-6.17/bpf-skip-scalar-adjustment-for-bpf_neg-if-dst-is-a-p.patch @@ -0,0 +1,48 @@ +From 2f7189adc66936b329ddc22a3f88fbbc550fa759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 00:47:38 +0530 +Subject: bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer + +From: Brahmajit Das + +[ Upstream commit 34904582b502a86fdb4d7984b12cacd2faabbe0d ] + +In check_alu_op(), the verifier currently calls check_reg_arg() and +adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations. +However, if the destination register holds a pointer, these scalar +adjustments are unnecessary and potentially incorrect. + +This patch adds a check to skip the adjustment logic when the destination +register contains a pointer. + +Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58 +Fixes: aced132599b3 ("bpf: Add range tracking for BPF_NEG") +Suggested-by: KaFai Wan +Suggested-by: Eduard Zingerman +Signed-off-by: Brahmajit Das +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20251001191739.2323644-2-listout@listout.xyz +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 6ad0dc226183a..299e43dac873e 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -15592,7 +15592,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } + + /* check dest operand */ +- if (opcode == BPF_NEG) { ++ if (opcode == BPF_NEG && ++ regs[insn->dst_reg].type == SCALAR_VALUE) { + err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK); + err = err ?: adjust_scalar_min_max_vals(env, insn, + ®s[insn->dst_reg], +-- +2.51.0 + diff --git a/queue-6.17/bpf-tidy-verifier-bug-message.patch b/queue-6.17/bpf-tidy-verifier-bug-message.patch new file mode 100644 index 0000000000..11938b295c --- /dev/null +++ b/queue-6.17/bpf-tidy-verifier-bug-message.patch @@ -0,0 +1,60 @@ +From e26e123149656a7bc12d9d66e276db2ebe0ce692 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 20:58:20 +0200 +Subject: bpf: Tidy verifier bug message + +From: Paul Chaignon + +[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ] + +Yonghong noticed that error messages for potential verifier bugs often +have a '(1)' at the end. This is happening because verifier_bug_if(cond, +env, fmt, args...) prints "(" #cond ")\n" as part of the message and +verifier_bug() is defined as: + + #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args) + +Hence, verifier_bug() always ends up displaying '(1)'. This small patch +fixes it by having verifier_bug_if conditionally call verifier_bug +instead of the other way around. + +Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs") +Reported-by: Yonghong Song +Signed-off-by: Paul Chaignon +Signed-off-by: Andrii Nakryiko +Tested-by: Eduard Zingerman +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf_verifier.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index 94defa405c85e..fe9a841fdf0cf 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -875,13 +875,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env, + #define verifier_bug_if(cond, env, fmt, args...) \ + ({ \ + bool __cond = (cond); \ +- if (unlikely(__cond)) { \ +- BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args); \ +- bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args); \ +- } \ ++ if (unlikely(__cond)) \ ++ verifier_bug(env, fmt " (" #cond ")", ##args); \ + (__cond); \ + }) +-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args) ++#define verifier_bug(env, fmt, args...) \ ++ ({ \ ++ BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args); \ ++ bpf_log(&env->log, "verifier bug: " fmt "\n", ##args); \ ++ }) + + static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env) + { +-- +2.51.0 + diff --git a/queue-6.17/btrfs-fix-symbolic-link-reading-when-bs-ps.patch b/queue-6.17/btrfs-fix-symbolic-link-reading-when-bs-ps.patch new file mode 100644 index 0000000000..9e54765adf --- /dev/null +++ b/queue-6.17/btrfs-fix-symbolic-link-reading-when-bs-ps.patch @@ -0,0 +1,109 @@ +From ec1ac8a0879d127fb32708399eaabdee4db87e22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 14:29:42 +0930 +Subject: btrfs: fix symbolic link reading when bs > ps + +From: Qu Wenruo + +[ Upstream commit 67378b754608a3524d125bfa5744508a49fe48be ] + +[BUG DURING BS > PS TEST] +When running the following script on a btrfs whose block size is larger +than page size, e.g. 8K block size and 4K page size, it will trigger a +kernel BUG: + + # mkfs.btrfs -s 8k $dev + # mount $dev $mnt + # mkdir $mnt/dir + # ln -s dir $mnt/link + # ls $mnt/link + +The call trace looks like this: + + BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing + BTRFS info (device dm-2): checking UUID tree + BTRFS info (device dm-2): enabling ssd optimizations + BTRFS info (device dm-2): enabling free space tree + ------------[ cut here ]------------ + kernel BUG at /home/adam/linux/include/linux/highmem.h:275! + Oops: invalid opcode: 0000 [#1] SMP + CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G OE 6.17.0-rc4-custom+ #283 PREEMPT(full) + Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 + RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs] + Call Trace: + + btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] + btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] + btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] + filemap_read_folio+0x37/0xe0 + do_read_cache_folio+0x94/0x3e0 + __page_get_link.isra.0+0x20/0x90 + page_get_link+0x16/0x40 + step_into+0x69b/0x830 + path_lookupat+0xa7/0x170 + filename_lookup+0xf7/0x200 + ? set_ptes.isra.0+0x36/0x70 + vfs_statx+0x7a/0x160 + do_statx+0x63/0xa0 + __x64_sys_statx+0x90/0xe0 + do_syscall_64+0x82/0xae0 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + + +Please note bs > ps support is still under development and the +enablement patch is not even in btrfs development branch. + +[CAUSE] +Btrfs reuses its data folio read path to handle symbolic links, as the +symbolic link target is stored as an inline data extent. + +But for newly created inodes, btrfs only set the minimal order if the +target inode is a regular file. + +Thus for above newly created symbolic link, it doesn't properly respect +the minimal folio order, and triggered the above crash. + +[FIX] +Call btrfs_set_inode_mapping_order() unconditionally inside +btrfs_create_new_inode(). + +For symbolic links this will fix the crash as now the folio will meet +the minimal order. + +For regular files this brings no change. + +For directory/bdev/char and all the other types of inodes, they won't +go through the data read path, thus no effect either. + +Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL") +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 18db1053cdf08..cd8a09e3d1dc0 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -6479,6 +6479,7 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans, + if (!args->subvol) + btrfs_inherit_iflags(BTRFS_I(inode), BTRFS_I(dir)); + ++ btrfs_set_inode_mapping_order(BTRFS_I(inode)); + if (S_ISREG(inode->i_mode)) { + if (btrfs_test_opt(fs_info, NODATASUM)) + BTRFS_I(inode)->flags |= BTRFS_INODE_NODATASUM; +@@ -6486,7 +6487,6 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans, + BTRFS_I(inode)->flags |= BTRFS_INODE_NODATACOW | + BTRFS_INODE_NODATASUM; + btrfs_update_inode_mapping_flags(BTRFS_I(inode)); +- btrfs_set_inode_mapping_order(BTRFS_I(inode)); + } + + ret = btrfs_insert_inode_locked(inode); +-- +2.51.0 + diff --git a/queue-6.17/btrfs-return-any-hit-error-from-extent_writepage_io.patch b/queue-6.17/btrfs-return-any-hit-error-from-extent_writepage_io.patch new file mode 100644 index 0000000000..034b919913 --- /dev/null +++ b/queue-6.17/btrfs-return-any-hit-error-from-extent_writepage_io.patch @@ -0,0 +1,70 @@ +From 8e3e786c9b4029340b8468eecad2318973417284 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 08:40:45 +0930 +Subject: btrfs: return any hit error from extent_writepage_io() + +From: Qu Wenruo + +[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ] + +Since the support of bs < ps support, extent_writepage_io() will submit +multiple blocks inside the folio. + +But if we hit error submitting one sector, but the next sector can still +be submitted successfully, the function extent_writepage_io() will still +return 0. + +This will make btrfs to silently ignore the error without setting error +flag for the filemap. + +Fix it by recording the first error hit, and always return that value. + +Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed") +Reviewed-by: Daniel Vacek +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index b21cb72835ccf..4eafe3817e11c 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1621,7 +1621,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + struct btrfs_fs_info *fs_info = inode->root->fs_info; + unsigned long range_bitmap = 0; + bool submitted_io = false; +- bool error = false; ++ int found_error = 0; + const u64 folio_start = folio_pos(folio); + const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio); + u64 cur; +@@ -1685,7 +1685,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + */ + btrfs_mark_ordered_io_finished(inode, folio, cur, + fs_info->sectorsize, false); +- error = true; ++ if (!found_error) ++ found_error = ret; + continue; + } + submitted_io = true; +@@ -1702,11 +1703,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode, + * If we hit any error, the corresponding sector will have its dirty + * flag cleared and writeback finished, thus no need to handle the error case. + */ +- if (!submitted_io && !error) { ++ if (!submitted_io && !found_error) { + btrfs_folio_set_writeback(fs_info, folio, start, len); + btrfs_folio_clear_writeback(fs_info, folio, start, len); + } +- return ret; ++ return found_error; + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/cdx-don-t-select-config_generic_msi_irq.patch b/queue-6.17/cdx-don-t-select-config_generic_msi_irq.patch new file mode 100644 index 0000000000..d694f37c79 --- /dev/null +++ b/queue-6.17/cdx-don-t-select-config_generic_msi_irq.patch @@ -0,0 +1,103 @@ +From 0ea52100752639b7e1b2abfdf420ecd336e713aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 10:08:51 +0530 +Subject: cdx: don't select CONFIG_GENERIC_MSI_IRQ + +From: Nipun Gupta + +[ Upstream commit ab1d8dda32e9507ca3bfb6b43661aeaa27f7bd82 ] + +x86 does not use CONFIG_GENERIC_MSI_IRQ, and trying to enable it anyway +results in a build failure: + +In file included from include/linux/ssb/ssb.h:10, + from drivers/ssb/pcihost_wrapper.c:18: +include/linux/gpio/driver.h:41:33: error: field 'msiinfo' has incomplete type + 41 | msi_alloc_info_t msiinfo; + | ^~~~~~~ +In file included from include/linux/kvm_host.h:19, + from arch/x86/events/intel/core.c:17: +include/linux/msi.h:528:33: error: field 'alloc_info' has incomplete type + 528 | msi_alloc_info_t alloc_info; + +Change the driver to actually build without this symbol and remove the +incorrect 'select' statements. + +Fixes: e8b18c11731d ("cdx: Fix missing GENERIC_MSI_IRQ on compile test") +Reviewed-by: Robin Murphy +Reviewed-by: Nikhil Agarwal +Signed-off-by: Arnd Bergmann +Signed-off-by: Nipun Gupta +Link: https://lore.kernel.org/r/20250826043852.2206008-1-nipun.gupta@amd.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/cdx/Kconfig | 1 - + drivers/cdx/cdx.c | 4 ++-- + drivers/cdx/controller/Kconfig | 1 - + drivers/cdx/controller/cdx_controller.c | 3 ++- + 4 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/cdx/Kconfig b/drivers/cdx/Kconfig +index 3af41f51cf38b..1f1e360507d7d 100644 +--- a/drivers/cdx/Kconfig ++++ b/drivers/cdx/Kconfig +@@ -8,7 +8,6 @@ + config CDX_BUS + bool "CDX Bus driver" + depends on OF && ARM64 || COMPILE_TEST +- select GENERIC_MSI_IRQ + help + Driver to enable Composable DMA Transfer(CDX) Bus. CDX bus + exposes Fabric devices which uses composable DMA IP to the +diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c +index 092306ca2541c..3d50f8cd9c0bd 100644 +--- a/drivers/cdx/cdx.c ++++ b/drivers/cdx/cdx.c +@@ -310,7 +310,7 @@ static int cdx_probe(struct device *dev) + * Setup MSI device data so that generic MSI alloc/free can + * be used by the device driver. + */ +- if (cdx->msi_domain) { ++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) { + error = msi_setup_device_data(&cdx_dev->dev); + if (error) + return error; +@@ -833,7 +833,7 @@ int cdx_device_add(struct cdx_dev_params *dev_params) + ((cdx->id << CDX_CONTROLLER_ID_SHIFT) | (cdx_dev->bus_num & CDX_BUS_NUM_MASK)), + cdx_dev->dev_num); + +- if (cdx->msi_domain) { ++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) { + cdx_dev->num_msi = dev_params->num_msi; + dev_set_msi_domain(&cdx_dev->dev, cdx->msi_domain); + } +diff --git a/drivers/cdx/controller/Kconfig b/drivers/cdx/controller/Kconfig +index 0641a4c21e660..a480b62cbd1f7 100644 +--- a/drivers/cdx/controller/Kconfig ++++ b/drivers/cdx/controller/Kconfig +@@ -10,7 +10,6 @@ if CDX_BUS + config CDX_CONTROLLER + tristate "CDX bus controller" + depends on HAS_DMA +- select GENERIC_MSI_IRQ + select REMOTEPROC + select RPMSG + help +diff --git a/drivers/cdx/controller/cdx_controller.c b/drivers/cdx/controller/cdx_controller.c +index fca83141e3e66..5e3fd89b6b561 100644 +--- a/drivers/cdx/controller/cdx_controller.c ++++ b/drivers/cdx/controller/cdx_controller.c +@@ -193,7 +193,8 @@ static int xlnx_cdx_probe(struct platform_device *pdev) + cdx->ops = &cdx_ops; + + /* Create MSI domain */ +- cdx->msi_domain = cdx_msi_domain_init(&pdev->dev); ++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ)) ++ cdx->msi_domain = cdx_msi_domain_init(&pdev->dev); + if (!cdx->msi_domain) { + ret = dev_err_probe(&pdev->dev, -ENODEV, "cdx_msi_domain_init() failed"); + goto cdx_msi_fail; +-- +2.51.0 + diff --git a/queue-6.17/clocksource-drivers-tegra186-avoid-64-bit-division.patch b/queue-6.17/clocksource-drivers-tegra186-avoid-64-bit-division.patch new file mode 100644 index 0000000000..dfcbfc1605 --- /dev/null +++ b/queue-6.17/clocksource-drivers-tegra186-avoid-64-bit-division.patch @@ -0,0 +1,47 @@ +From c49513d2d5052b7134ccbb0b8d271c4dff22f6fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jun 2025 13:19:35 +0200 +Subject: clocksource/drivers/tegra186: Avoid 64-bit division + +From: Arnd Bergmann + +[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ] + +The newly added function causes a build failure on 32-bit targets with +older compiler version such as gcc-10: + +arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft': +timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod' + +The calculation can trivially be changed to avoid the division entirely, +as USEC_PER_SEC is a multiple of 5. Change both such calculation for +consistency, even though gcc apparently managed to optimize the other one +properly already. + +[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ] + +Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-tegra186.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c +index 7b506de654386..47bdb1e320af9 100644 +--- a/drivers/clocksource/timer-tegra186.c ++++ b/drivers/clocksource/timer-tegra186.c +@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt) + tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR); + + /* configure timer (system reset happens on the fifth expiration) */ +- value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) | ++ value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) | + TMRCR_PERIODIC | TMRCR_ENABLE; + tmr_writel(wdt->tmr, value, TMRCR); + +-- +2.51.0 + diff --git a/queue-6.17/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch b/queue-6.17/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch new file mode 100644 index 0000000000..c3e276ac51 --- /dev/null +++ b/queue-6.17/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch @@ -0,0 +1,47 @@ +From f4bb3c5a56c9f393391b86328979b39dddfd028b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jun 2025 10:55:55 -0700 +Subject: clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation + +From: Guenter Roeck + +[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ] + +Building the driver on xtensa fails with + +tensa-linux-ld: drivers/clocksource/timer-tegra186.o: + in function `tegra186_timer_remove': +timer-tegra186.c:(.text+0x350): + undefined reference to `__udivdi3' + +Avoid the problem by rearranging the offending code to avoid the 64-bit +divide operation. + +Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") +Signed-off-by: Guenter Roeck +Signed-off-by: Daniel Lezcano +Reviewed-by: Jon Hunter +Cc: Pohsun Su +Cc: Robert Lin +Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-tegra186.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c +index e5394f98a02e6..7b506de654386 100644 +--- a/drivers/clocksource/timer-tegra186.c ++++ b/drivers/clocksource/timer-tegra186.c +@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd) + * counter value to the time of the counter expirations that + * remain. + */ +- timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration); ++ timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration); + + /* + * Convert the current counter value to seconds, +-- +2.51.0 + diff --git a/queue-6.17/coresight-appropriately-disable-programming-clocks.patch b/queue-6.17/coresight-appropriately-disable-programming-clocks.patch new file mode 100644 index 0000000000..cfbe46ca13 --- /dev/null +++ b/queue-6.17/coresight-appropriately-disable-programming-clocks.patch @@ -0,0 +1,363 @@ +From 6a43de5dc8cb428e0af3d37602e60aac018abb2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:40 +0100 +Subject: coresight: Appropriately disable programming clocks + +From: Leo Yan + +[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ] + +Some CoreSight components have programming clocks (pclk) and are enabled +using clk_get() and clk_prepare_enable(). However, in many cases, these +clocks are not disabled when modules exit and only released by clk_put(). + +To fix the issue, this commit refactors programming clock by replacing +clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled() +for enabling APB clock. If the "apb_pclk" clock is not found, a NULL +pointer is returned, and the function proceeds to attempt enabling the +"apb" clock. + +Since ACPI platforms rely on firmware to manage clocks, returning a NULL +pointer in this case leaves clock management to the firmware rather than +the driver. This effectively avoids a clock imbalance issue during +module removal - where the clock could be disabled twice: once during +the ACPI runtime suspend and again during the devm resource release. + +Callers are updated to reuse the returned error value. + +With the change, programming clocks are managed as resources in driver +model layer, allowing clock cleanup to be handled automatically. As a +result, manual cleanup operations are no longer needed and are removed +from the Coresight drivers. + +Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-catu.c | 9 ++------ + .../hwtracing/coresight/coresight-cpu-debug.c | 6 +---- + .../hwtracing/coresight/coresight-ctcu-core.c | 10 ++------- + .../coresight/coresight-etm4x-core.c | 9 ++------ + .../hwtracing/coresight/coresight-funnel.c | 6 +---- + .../coresight/coresight-replicator.c | 6 +---- + drivers/hwtracing/coresight/coresight-stm.c | 4 +--- + .../hwtracing/coresight/coresight-tmc-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-tpiu.c | 4 +--- + include/linux/coresight.h | 22 ++++++++----------- + 10 files changed, 21 insertions(+), 59 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index af2a55f0c907c..4c345ff2cff14 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + pm_runtime_get_noresume(&pdev->dev); + pm_runtime_set_active(&pdev->dev); +@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev) + dev_set_drvdata(&pdev->dev, drvdata); + ret = __catu_probe(&pdev->dev, res); + pm_runtime_put(&pdev->dev); +- if (ret) { ++ if (ret) + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); +- } + + return ret; + } +@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev) + + __catu_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index a871d997330b0..e39dfb886688e 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + dev_set_drvdata(&pdev->dev, drvdata); + pm_runtime_get_noresume(&pdev->dev); +@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev) + if (ret) { + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + return ret; + } +@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev) + + __debug_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c +index c6bafc96db963..de279efe34058 100644 +--- a/drivers/hwtracing/coresight/coresight-ctcu-core.c ++++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c +@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev) + + drvdata->apb_clk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->apb_clk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->apb_clk); + + cfgs = of_device_get_match_data(dev); + if (cfgs) { +@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev) + desc.access = CSDEV_ACCESS_IOMEM(base); + + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- if (!IS_ERR_OR_NULL(drvdata->apb_clk)) +- clk_put(drvdata->apb_clk); +- ++ if (IS_ERR(drvdata->csdev)) + return PTR_ERR(drvdata->csdev); +- } + + return 0; + } +@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev) + + ctcu_remove(pdev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->apb_clk)) +- clk_put(drvdata->apb_clk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 81f20a167e001..4b98a7bf4cb73 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + if (res) { + drvdata->base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(drvdata->base)) { +- clk_put(drvdata->pclk); ++ if (IS_ERR(drvdata->base)) + return PTR_ERR(drvdata->base); +- } + } + + dev_set_drvdata(&pdev->dev, drvdata); +@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev) + if (drvdata) + etm4_remove_dev(drvdata); + pm_runtime_disable(&pdev->dev); +- +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + static const struct amba_id etm4_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index b1922dbe9292b..36fc4e991458c 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + /* + * Map the device base for dynamic-funnel, which has been +@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res) + out_disable_clk: + if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) + clk_disable_unprepare(drvdata->atclk); +- if (ret && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); + return ret; + } + +@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev) + + funnel_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + static const struct of_device_id funnel_match[] = { +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index 06efd2b01a0f7..6dd24eb10a94b 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + /* + * Map the device base for dynamic-replicator, which has been +@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res) + out_disable_clk: + if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) + clk_disable_unprepare(drvdata->atclk); +- if (ret && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); + return ret; + } + +@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev) + + replicator_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index e45c6c7204b44..88ee453b28154 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + dev_set_drvdata(dev, drvdata); + + base = devm_ioremap_resource(dev, res); +@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev) + + __stm_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 0b5e7635a084d..e867198b03e82 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev) + + drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + + dev_set_drvdata(&pdev->dev, drvdata); + pm_runtime_get_noresume(&pdev->dev); +@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev) + + __tmc_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 3e01592884280..b2559c6fac6d2 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res) + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +- return -ENODEV; ++ return PTR_ERR(drvdata->pclk); + dev_set_drvdata(dev, drvdata); + + /* Validity for the resource is already checked by the AMBA core */ +@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev) + + __tpiu_remove(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- if (!IS_ERR_OR_NULL(drvdata->pclk)) +- clk_put(drvdata->pclk); + } + + #ifdef CONFIG_ACPI +diff --git a/include/linux/coresight.h b/include/linux/coresight.h +index 4ac65c68bbf44..1e652e1578419 100644 +--- a/include/linux/coresight.h ++++ b/include/linux/coresight.h +@@ -6,6 +6,7 @@ + #ifndef _LINUX_CORESIGHT_H + #define _LINUX_CORESIGHT_H + ++#include + #include + #include + #include +@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base) + * Returns: + * + * clk - Clock is found and enabled +- * NULL - clock is not found ++ * NULL - Clock is controlled by firmware (ACPI device only) + * ERROR - Clock is found but failed to enable + */ + static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev) + { + struct clk *pclk; +- int ret; + +- pclk = clk_get(dev, "apb_pclk"); +- if (IS_ERR(pclk)) { +- pclk = clk_get(dev, "apb"); +- if (IS_ERR(pclk)) +- return NULL; +- } ++ /* Firmware controls clocks for an ACPI device. */ ++ if (has_acpi_companion(dev)) ++ return NULL; ++ ++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); ++ if (!pclk) ++ pclk = devm_clk_get_optional_enabled(dev, "apb"); + +- ret = clk_prepare_enable(pclk); +- if (ret) { +- clk_put(pclk); +- return ERR_PTR(ret); +- } + return pclk; + } + +-- +2.51.0 + diff --git a/queue-6.17/coresight-appropriately-disable-trace-bus-clocks.patch b/queue-6.17/coresight-appropriately-disable-trace-bus-clocks.patch new file mode 100644 index 0000000000..002b3f2faa --- /dev/null +++ b/queue-6.17/coresight-appropriately-disable-trace-bus-clocks.patch @@ -0,0 +1,281 @@ +From c70457cdd3e349c0a79b493da4a2ea1799217923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:41 +0100 +Subject: coresight: Appropriately disable trace bus clocks + +From: Leo Yan + +[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ] + +Some CoreSight components have trace bus clocks 'atclk' and are enabled +using clk_prepare_enable(). These clocks are not disabled when modules +exit. + +As atclk is optional, use devm_clk_get_optional_enabled() to manage it. +The benefit is the driver model layer can automatically disable and +release clocks. + +Check the returned value with IS_ERR() to detect errors but leave the +NULL pointer case if the clock is not found. And remove the error +handling codes which are no longer needed. + +Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etb10.c | 10 +++--- + .../coresight/coresight-etm3x-core.c | 9 ++--- + .../hwtracing/coresight/coresight-funnel.c | 36 ++++++------------- + .../coresight/coresight-replicator.c | 34 ++++++------------ + drivers/hwtracing/coresight/coresight-stm.c | 9 ++--- + drivers/hwtracing/coresight/coresight-tpiu.c | 10 ++---- + 6 files changed, 34 insertions(+), 74 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c +index d5efb085b30d3..8e81b41eb2226 100644 +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + dev_set_drvdata(dev, drvdata); + + /* validity for the resource is already checked by the AMBA core */ +diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c +index 1c6204e144221..baba2245b1dfb 100644 +--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c +@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id) + + spin_lock_init(&drvdata->spinlock); + +- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->cpu = coresight_get_cpu(dev); + if (drvdata->cpu < 0) +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index 36fc4e991458c..b044a4125310b 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel); + + static int funnel_probe(struct device *dev, struct resource *res) + { +- int ret; + void __iomem *base; + struct coresight_platform_data *pdata = NULL; + struct funnel_drvdata *drvdata; +@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res) + */ + if (res) { + base = devm_ioremap_resource(dev, res); +- if (IS_ERR(base)) { +- ret = PTR_ERR(base); +- goto out_disable_clk; +- } ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + drvdata->base = base; + desc.groups = coresight_funnel_groups; + desc.access = CSDEV_ACCESS_IOMEM(base); +@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res) + dev_set_drvdata(dev, drvdata); + + pdata = coresight_get_platform_data(dev); +- if (IS_ERR(pdata)) { +- ret = PTR_ERR(pdata); +- goto out_disable_clk; +- } ++ if (IS_ERR(pdata)) ++ return PTR_ERR(pdata); ++ + dev->platform_data = pdata; + + raw_spin_lock_init(&drvdata->spinlock); +@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res) + desc.pdata = pdata; + desc.dev = dev; + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- ret = PTR_ERR(drvdata->csdev); +- goto out_disable_clk; +- } ++ if (IS_ERR(drvdata->csdev)) ++ return PTR_ERR(drvdata->csdev); + +- ret = 0; +- +-out_disable_clk: +- if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) +- clk_disable_unprepare(drvdata->atclk); +- return ret; ++ return 0; + } + + static int funnel_remove(struct device *dev) +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index 6dd24eb10a94b..9e8bd36e7a9a2 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = { + + static int replicator_probe(struct device *dev, struct resource *res) + { +- int ret = 0; + struct coresight_platform_data *pdata = NULL; + struct replicator_drvdata *drvdata; + struct coresight_desc desc = { 0 }; +@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res) + */ + if (res) { + base = devm_ioremap_resource(dev, res); +- if (IS_ERR(base)) { +- ret = PTR_ERR(base); +- goto out_disable_clk; +- } ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + drvdata->base = base; + desc.groups = replicator_groups; + desc.access = CSDEV_ACCESS_IOMEM(base); +@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res) + dev_set_drvdata(dev, drvdata); + + pdata = coresight_get_platform_data(dev); +- if (IS_ERR(pdata)) { +- ret = PTR_ERR(pdata); +- goto out_disable_clk; +- } ++ if (IS_ERR(pdata)) ++ return PTR_ERR(pdata); + dev->platform_data = pdata; + + raw_spin_lock_init(&drvdata->spinlock); +@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res) + desc.dev = dev; + + drvdata->csdev = coresight_register(&desc); +- if (IS_ERR(drvdata->csdev)) { +- ret = PTR_ERR(drvdata->csdev); +- goto out_disable_clk; +- } ++ if (IS_ERR(drvdata->csdev)) ++ return PTR_ERR(drvdata->csdev); + + replicator_reset(drvdata); +- +-out_disable_clk: +- if (ret && !IS_ERR_OR_NULL(drvdata->atclk)) +- clk_disable_unprepare(drvdata->atclk); +- return ret; ++ return 0; + } + + static int replicator_remove(struct device *dev) +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index 88ee453b28154..57fbe3ad0fb20 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res) + if (!drvdata) + return -ENOMEM; + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index b2559c6fac6d2..8d6179c83e5d3 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = { + + static int __tpiu_probe(struct device *dev, struct resource *res) + { +- int ret; + void __iomem *base; + struct coresight_platform_data *pdata = NULL; + struct tpiu_drvdata *drvdata; +@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res) + + spin_lock_init(&drvdata->spinlock); + +- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */ +- if (!IS_ERR(drvdata->atclk)) { +- ret = clk_prepare_enable(drvdata->atclk); +- if (ret) +- return ret; +- } ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); + + drvdata->pclk = coresight_get_enable_apb_pclk(dev); + if (IS_ERR(drvdata->pclk)) +-- +2.51.0 + diff --git a/queue-6.17/coresight-avoid-enable-programming-clock-duplicately.patch b/queue-6.17/coresight-avoid-enable-programming-clock-duplicately.patch new file mode 100644 index 0000000000..f248798d3b --- /dev/null +++ b/queue-6.17/coresight-avoid-enable-programming-clock-duplicately.patch @@ -0,0 +1,65 @@ +From 202e88efc89003b6de420157e123266ae7464c00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:42 +0100 +Subject: coresight: Avoid enable programming clock duplicately + +From: Leo Yan + +[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ] + +The programming clock is enabled by AMBA bus driver before a dynamic +probe. As a result, a CoreSight driver may redundantly enable the same +clock. + +To avoid this, add a check for device type and skip enabling the +programming clock for AMBA devices. The returned NULL pointer will be +tolerated by the drivers. + +Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + include/linux/coresight.h | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/include/linux/coresight.h b/include/linux/coresight.h +index 1e652e1578419..bb49080ec8f96 100644 +--- a/include/linux/coresight.h ++++ b/include/linux/coresight.h +@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base) + * Returns: + * + * clk - Clock is found and enabled +- * NULL - Clock is controlled by firmware (ACPI device only) ++ * NULL - Clock is controlled by firmware (ACPI device only) or when managed ++ * by the AMBA bus driver instead + * ERROR - Clock is found but failed to enable + */ + static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev) + { +- struct clk *pclk; ++ struct clk *pclk = NULL; + + /* Firmware controls clocks for an ACPI device. */ + if (has_acpi_companion(dev)) + return NULL; + +- pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); +- if (!pclk) +- pclk = devm_clk_get_optional_enabled(dev, "apb"); ++ if (!dev_is_amba(dev)) { ++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk"); ++ if (!pclk) ++ pclk = devm_clk_get_optional_enabled(dev, "apb"); ++ } + + return pclk; + } +-- +2.51.0 + diff --git a/queue-6.17/coresight-catu-support-atclk.patch b/queue-6.17/coresight-catu-support-atclk.patch new file mode 100644 index 0000000000..6add4d77bb --- /dev/null +++ b/queue-6.17/coresight-catu-support-atclk.patch @@ -0,0 +1,93 @@ +From 60ce713d9eb425d58cdd7fbaf088988259f30c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:38 +0100 +Subject: coresight: catu: Support atclk + +From: Leo Yan + +[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ] + +The atclk is an optional clock for the CoreSight CATU, but the driver +misses to initialize it. + +This change enables atclk in probe of the CATU driver, and dynamically +control the clock during suspend and resume. + +The checks for driver data and clocks in suspend and resume are not +needed, remove them. Add error handling in the resume function. + +Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++----- + drivers/hwtracing/coresight/coresight-catu.h | 1 + + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index 5058432233da1..af2a55f0c907c 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res) + struct coresight_platform_data *pdata = NULL; + void __iomem *base; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + catu_desc.name = coresight_alloc_device_name(&catu_devs, dev); + if (!catu_desc.name) + return -ENOMEM; +@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int catu_runtime_resume(struct device *dev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h +index 755776cd19c5b..6e6b7aac206dc 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.h ++++ b/drivers/hwtracing/coresight/coresight-catu.h +@@ -62,6 +62,7 @@ + + struct catu_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + int irq; +-- +2.51.0 + diff --git a/queue-6.17/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.17/coresight-etm4x-conditionally-access-register-trcext.patch new file mode 100644 index 0000000000..d5e8359041 --- /dev/null +++ b/queue-6.17/coresight-etm4x-conditionally-access-register-trcext.patch @@ -0,0 +1,91 @@ +From 857ea1992c12decf0535c5e28848e392818ecf51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 01:24:45 -0700 +Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR + +From: Yuanfang Zhang + +[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ] + +The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. +To avoid invalid accesses, introduce a check on numextinsel +(derived from TRCIDR5[11:9]) before reading or writing to this register. + +Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") +Signed-off-by: Yuanfang Zhang +Reviewed-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++ + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index cbea200489c8f..b4f1834a1af1e 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index ac649515054d9..823914fefa90a 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -999,6 +1000,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +-- +2.51.0 + diff --git a/queue-6.17/coresight-etm4x-support-atclk.patch b/queue-6.17/coresight-etm4x-support-atclk.patch new file mode 100644 index 0000000000..816eae49d5 --- /dev/null +++ b/queue-6.17/coresight-etm4x-support-atclk.patch @@ -0,0 +1,106 @@ +From 80781dfb954dd66f795ee3fa1cc5b1a73f540c6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:39 +0100 +Subject: coresight: etm4x: Support atclk + +From: Leo Yan + +[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ] + +The atclk is an optional clock for the CoreSight ETMv4, but the driver +misses to initialize it. + +This change enables atclk in probe of the ETMv4 driver, and dynamically +control the clock during suspend and resume. + +No need to check the driver data and clock pointer in the runtime +suspend and resume, so remove checks. And add error handling in the +resume function. + +Add a minor fix to the comment format when adding the atclk field. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++- + 2 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index b4f1834a1af1e..81f20a167e001 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev) + if (WARN_ON(!drvdata)) + return -ENOMEM; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) + pm_save_enable = coresight_loses_context_with_cpu(dev) ? + PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; +@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); + + return 0; + } +@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev) + static int etm4_runtime_resume(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); + +- return 0; ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 823914fefa90a..13ec9ecef46f5 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -920,7 +920,8 @@ struct etmv4_save_state { + + /** + * struct etm4_drvdata - specifics associated to an ETM component +- * @pclk APB clock if present, otherwise NULL ++ * @pclk: APB clock if present, otherwise NULL ++ * @atclk: Optional clock for the core parts of the ETMv4. + * @base: Memory mapped base address for this component. + * @csdev: Component vitals needed by the framework. + * @spinlock: Only one at a time pls. +@@ -989,6 +990,7 @@ struct etmv4_save_state { + */ + struct etmv4_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + raw_spinlock_t spinlock; +-- +2.51.0 + diff --git a/queue-6.17/coresight-fix-incorrect-handling-for-return-value-of.patch b/queue-6.17/coresight-fix-incorrect-handling-for-return-value-of.patch new file mode 100644 index 0000000000..1a0c421cd7 --- /dev/null +++ b/queue-6.17/coresight-fix-incorrect-handling-for-return-value-of.patch @@ -0,0 +1,39 @@ +From 73a93141d52ed468c3725e680976d3708a311652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 20:20:22 +0800 +Subject: coresight: Fix incorrect handling for return value of devm_kzalloc + +From: Lin Yujun + +[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ] + +The return value of devm_kzalloc could be an null pointer, +use "!desc.pdata" to fix incorrect handling return value +of devm_kzalloc. + +Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE") +Signed-off-by: Lin Yujun +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 3dd2e1b4809dc..43643d2c5bdd0 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp + * into the device for that purpose. + */ + desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL); +- if (IS_ERR(desc.pdata)) ++ if (!desc.pdata) + goto cpu_clear; + + desc.type = CORESIGHT_DEV_TYPE_SINK; +-- +2.51.0 + diff --git a/queue-6.17/coresight-fix-indentation-error-in-cscfg_remove_owne.patch b/queue-6.17/coresight-fix-indentation-error-in-cscfg_remove_owne.patch new file mode 100644 index 0000000000..b1ba7cb2da --- /dev/null +++ b/queue-6.17/coresight-fix-indentation-error-in-cscfg_remove_owne.patch @@ -0,0 +1,40 @@ +From 4484a46df828dac073ad8f3acdd796a4c1fd7c38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 11:30:25 +0100 +Subject: coresight: fix indentation error in + cscfg_remove_owned_csdev_configs() + +From: Yeoreum Yun + +[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ] + +Fix wrong indentation in cscfg_remove_owned_csdev_configs() + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/ +Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev") +Signed-off-by: Yeoreum Yun +Reviewed-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-syscfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c +index 83dad24e0116d..6836b05986e80 100644 +--- a/drivers/hwtracing/coresight/coresight-syscfg.c ++++ b/drivers/hwtracing/coresight/coresight-syscfg.c +@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi + if (list_empty(&csdev->config_csdev_list)) + return; + +- guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock); ++ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock); + + list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) { + if (config_csdev->config_desc->load_owner == load_owner) +-- +2.51.0 + diff --git a/queue-6.17/coresight-fix-missing-include-for-field_get.patch b/queue-6.17/coresight-fix-missing-include-for-field_get.patch new file mode 100644 index 0000000000..f3ffe62e70 --- /dev/null +++ b/queue-6.17/coresight-fix-missing-include-for-field_get.patch @@ -0,0 +1,77 @@ +From c2743fd98325f76a70f6ed0b28f5410057b6a281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jul 2025 10:55:27 +0100 +Subject: coresight: Fix missing include for FIELD_GET + +From: James Clark + +[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ] + +Include the header for FIELD_GET which is only sometimes transitively +included on some configs and kernel releases. + +Reported-by: Linux Kernel Functional Testing +Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/ +Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits") +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 1 + + drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 + + drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 + + drivers/hwtracing/coresight/ultrasoc-smb.h | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index fa758cc218275..c2db94f2ab237 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -3,6 +3,7 @@ + * Copyright (c) 2012, The Linux Foundation. All rights reserved. + */ + ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 42e5d37403add..cbea200489c8f 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index ab251865b893d..e9eeea6240d55 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -4,6 +4,7 @@ + * Author: Mathieu Poirier + */ + ++#include + #include + #include + #include +diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h +index c4c111275627b..323f0ccb6878c 100644 +--- a/drivers/hwtracing/coresight/ultrasoc-smb.h ++++ b/drivers/hwtracing/coresight/ultrasoc-smb.h +@@ -7,6 +7,7 @@ + #ifndef _ULTRASOC_SMB_H + #define _ULTRASOC_SMB_H + ++#include + #include + #include + +-- +2.51.0 + diff --git a/queue-6.17/coresight-only-register-perf-symlink-for-sinks-with-.patch b/queue-6.17/coresight-only-register-perf-symlink-for-sinks-with-.patch new file mode 100644 index 0000000000..54a55eb22b --- /dev/null +++ b/queue-6.17/coresight-only-register-perf-symlink-for-sinks-with-.patch @@ -0,0 +1,45 @@ +From 7a7292c9f442efec87b6a21c98511a174251ed17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jun 2025 18:26:19 +0800 +Subject: coresight: Only register perf symlink for sinks with alloc_buffer + +From: Yuanfang Zhang + +[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ] + +Ensure that etm_perf_add_symlink_sink() is only called for devices +that implement the alloc_buffer operation. This prevents invalid +symlink creation for dummy sinks that do not implement alloc_buffer. + +Without this check, perf may attempt to use a dummy sink that lacks +alloc_buffer operationsu to initialise perf's ring buffer, leading +to runtime failures. + +Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver") +Signed-off-by: Yuanfang Zhang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index c2db94f2ab237..1accd7cbd54bf 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) + goto out_unlock; + } + +- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { ++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || ++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && ++ sink_ops(csdev)->alloc_buffer) { + ret = etm_perf_add_symlink_sink(csdev); + + if (ret) { +-- +2.51.0 + diff --git a/queue-6.17/coresight-tmc-support-atclk.patch b/queue-6.17/coresight-tmc-support-atclk.patch new file mode 100644 index 0000000000..9f0e0b2ecd --- /dev/null +++ b/queue-6.17/coresight-tmc-support-atclk.patch @@ -0,0 +1,111 @@ +From eb5d366cb7266b5050ce0a7a5168ed38827c02b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:37 +0100 +Subject: coresight: tmc: Support atclk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leo Yan + +[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ] + +The atclk is an optional clock for the CoreSight TMC, but the driver +misses to initialize it. In most cases, TMC shares the atclk clock with +other CoreSight components. Since these components enable the clock +before the TMC device is initialized, the TMC continues properly, +which is why we don’t observe any lockup issues. + +This change enables atclk in probe of the TMC driver. Given the clock +is optional, it is possible to return NULL if the clock does not exist. +IS_ERR() is tolerant for this case. + +Dynamically disable and enable atclk during suspend and resume. The +clock pointers will never be error values if the driver has successfully +probed, and the case of a NULL pointer case will be handled by the clock +core layer. The driver data is always valid after probe. Therefore, +remove the related checks. Also in the resume flow adds error handling. + +Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-tmc.h | 2 ++ + 2 files changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 88afb16bb6bec..0b5e7635a084d 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res) + struct coresight_desc desc = { 0 }; + struct coresight_dev_list *dev_list = NULL; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + ret = -ENOMEM; + + /* Validity for the resource is already checked by the AMBA core */ +@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); ++ + return 0; + } + + static int tmc_runtime_resume(struct device *dev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); +- return 0; ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 6541a27a018e6..cbb4ba4391585 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -210,6 +210,7 @@ struct tmc_resrv_buf { + + /** + * struct tmc_drvdata - specifics associated to an TMC component ++ * @atclk: optional clock for the core parts of the TMC. + * @pclk: APB clock if present, otherwise NULL + * @base: memory mapped base address for this component. + * @csdev: component vitals needed by the framework. +@@ -244,6 +245,7 @@ struct tmc_resrv_buf { + * Used by ETR/ETF. + */ + struct tmc_drvdata { ++ struct clk *atclk; + struct clk *pclk; + void __iomem *base; + struct coresight_device *csdev; +-- +2.51.0 + diff --git a/queue-6.17/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch b/queue-6.17/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch new file mode 100644 index 0000000000..9324ae2fba --- /dev/null +++ b/queue-6.17/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch @@ -0,0 +1,54 @@ +From 27dc0497a63e0c26d23e08159627ad8f7a3ac3a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 07:53:04 +0800 +Subject: coresight: tpda: fix the logic to setup the element size + +From: Jie Gan + +[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ] + +Some TPDM devices support both CMB and DSB datasets, requiring +the system to enable the port with both corresponding element sizes. + +Currently, the logic treats tpdm_read_element_size as successful if +the CMB element size is retrieved correctly, regardless of whether +the DSB element size is obtained. This behavior causes issues +when parsing data from TPDM devices that depend on both element sizes. + +To address this, the function should explicitly fail if the DSB +element size cannot be read correctly. + +Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element") +Reviewed-by: James Clark +Signed-off-by: Jie Gan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tpda.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c +index 0633f04beb240..333b3cb236859 100644 +--- a/drivers/hwtracing/coresight/coresight-tpda.c ++++ b/drivers/hwtracing/coresight/coresight-tpda.c +@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata, + if (tpdm_data->dsb) { + rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent), + "qcom,dsb-element-bits", &drvdata->dsb_esize); ++ if (rc) ++ goto out; + } + + if (tpdm_data->cmb) { +@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata, + "qcom,cmb-element-bits", &drvdata->cmb_esize); + } + ++out: + if (rc) + dev_warn_once(&csdev->dev, + "Failed to read TPDM Element size: %d\n", rc); +-- +2.51.0 + diff --git a/queue-6.17/coresight-trbe-add-isb-after-trblimitr-write.patch b/queue-6.17/coresight-trbe-add-isb-after-trblimitr-write.patch new file mode 100644 index 0000000000..359f4703bc --- /dev/null +++ b/queue-6.17/coresight-trbe-add-isb-after-trblimitr-write.patch @@ -0,0 +1,41 @@ +From ccccaefe39037b38532a5ab481663de77b6931f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 11:19:05 +0100 +Subject: coresight: trbe: Add ISB after TRBLIMITR write + +From: James Clark + +[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ] + +DEN0154 states that hardware will be allowed to ignore writes to TRB* +registers while the trace buffer is enabled. Add an ISB to ensure that +it's disabled before clearing the other registers. + +This is purely defensive because it's expected that arm_trbe_disable() +would be called before teardown which has the required ISB. + +Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call") +Signed-off-by: James Clark +Reviewed-by: Yeoreum Yun +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 8f426f94e32a1..f78c9b9dc0087 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata) + static void trbe_reset_local(struct trbe_cpudata *cpudata) + { + write_sysreg_s(0, SYS_TRBLIMITR_EL1); ++ isb(); + trbe_drain_buffer(); + write_sysreg_s(0, SYS_TRBPTR_EL1); + write_sysreg_s(0, SYS_TRBBASER_EL1); +-- +2.51.0 + diff --git a/queue-6.17/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.17/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..2e8815fcf9 --- /dev/null +++ b/queue-6.17/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From ecec4b6f19589e48bf1c4cbdca40a211fa756332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 8267dd1a2130d..8f426f94e32a1 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -23,7 +23,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-6.17/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.17/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..5fa86ff769 --- /dev/null +++ b/queue-6.17/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From c6985e88e964b76efaf225eebaee4652084ff150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index f78c9b9dc0087..3dd2e1b4809dc 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-6.17/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.17/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..bd85058c54 --- /dev/null +++ b/queue-6.17/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From 45088de5363a00a6270c0292f5d40b5c26653da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index ef078426bfd51..38c165d526d14 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-6.17/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.17/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch new file mode 100644 index 0000000000..e33e7d7a62 --- /dev/null +++ b/queue-6.17/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch @@ -0,0 +1,58 @@ +From 3c9e2ac7861ce020d75a2bd9f1e54ee8c6b6d7e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 17:22:12 +0200 +Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe + +From: Johan Hovold + +[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ] + +Make sure to drop the reference to the saw device taken by +of_find_device_by_node() after retrieving its driver data during +probe(). + +Also drop the reference to the CPU node sooner to avoid leaking it in +case there is no saw node or device. + +Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index 5f386761b1562..f60a4cf536423 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.17/cpuset-fix-failure-to-enable-isolated-partition-when.patch b/queue-6.17/cpuset-fix-failure-to-enable-isolated-partition-when.patch new file mode 100644 index 0000000000..1a2f6346c1 --- /dev/null +++ b/queue-6.17/cpuset-fix-failure-to-enable-isolated-partition-when.patch @@ -0,0 +1,77 @@ +From eb4adbbf6ac3a7d1259dd62947ca7c4469d725f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:12:26 +0000 +Subject: cpuset: fix failure to enable isolated partition when containing + isolcpus + +From: Chen Ridong + +[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ] + +The 'isolcpus' parameter specified at boot time can be assigned to an +isolated partition. While it is valid put the 'isolcpus' in an isolated +partition, attempting to change a member cpuset to an isolated partition +will fail if the cpuset contains any 'isolcpus'. + +For example, the system boots with 'isolcpus=9', and the following +configuration works correctly: + + # cd /sys/fs/cgroup/ + # mkdir test + # echo 1 > test/cpuset.cpus + # echo isolated > test/cpuset.cpus.partition + # cat test/cpuset.cpus.partition + isolated + # echo 9 > test/cpuset.cpus + # cat test/cpuset.cpus.partition + isolated + # cat test/cpuset.cpus + 9 + +However, the following steps to convert a member cpuset to an isolated +partition will fail: + + # cd /sys/fs/cgroup/ + # mkdir test + # echo 9 > test/cpuset.cpus + # echo isolated > test/cpuset.cpus.partition + # cat test/cpuset.cpus.partition + isolated invalid (partition config conflicts with housekeeping setup) + +The issue occurs because the new partition state (new_prs) is used for +validation against housekeeping constraints before it has been properly +updated. To resolve this, move the assignment of new_prs before the +housekeeping validation check when enabling a root partition. + +Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup") +Signed-off-by: Chen Ridong +Reviewed-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 27adb04df675d..fef93032fe7e4 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd, + xcpus = tmp->delmask; + if (compute_effective_exclusive_cpumask(cs, xcpus, NULL)) + WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus)); ++ new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED; + + /* + * Enabling partition root is not allowed if its +@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd, + + deleting = true; + subparts_delta++; +- new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED; + } else if (cmd == partcmd_disable) { + /* + * May need to add cpus back to parent's effective_cpus +-- +2.51.0 + diff --git a/queue-6.17/cramfs-fix-incorrect-physical-page-address-calculati.patch b/queue-6.17/cramfs-fix-incorrect-physical-page-address-calculati.patch new file mode 100644 index 0000000000..d6efd7713c --- /dev/null +++ b/queue-6.17/cramfs-fix-incorrect-physical-page-address-calculati.patch @@ -0,0 +1,45 @@ +From 2d088a49206a38857f390268ad1aa81830c82280 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 10:53:33 +1000 +Subject: cramfs: fix incorrect physical page address calculation + +From: Alistair Popple + +[ Upstream commit 20a8e0454d833d80d0c0cae304841a50a2a126bd ] + +Commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") +incorrectly replaced the pfn with the physical address when calling +vmf_insert_mixed(). Instead the phys_to_pfn_t() call should have been +replaced with PHYS_PFN(). + +Found by inspection after a similar issue was noted in fuse virtio_fs. + +Link: https://lkml.kernel.org/r/20250923005333.3165032-1-apopple@nvidia.com +Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") +Signed-off-by: Alistair Popple +Reviewed-by: Dev Jain +Reviewed-by: David Hildenbrand +Cc: Haiyue Wang +Cc: Nicolas Pitre +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/cramfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c +index b002e9b734f99..56c8005b24a34 100644 +--- a/fs/cramfs/inode.c ++++ b/fs/cramfs/inode.c +@@ -412,7 +412,7 @@ static int cramfs_physmem_mmap(struct file *file, struct vm_area_struct *vma) + vm_fault_t vmf; + unsigned long off = i * PAGE_SIZE; + vmf = vmf_insert_mixed(vma, vma->vm_start + off, +- address + off); ++ PHYS_PFN(address + off)); + if (vmf & VM_FAULT_ERROR) + ret = vm_fault_to_errno(vmf, 0); + } +-- +2.51.0 + diff --git a/queue-6.17/crypto-comp-use-same-definition-of-context-alloc-and.patch b/queue-6.17/crypto-comp-use-same-definition-of-context-alloc-and.patch new file mode 100644 index 0000000000..2d10d0e072 --- /dev/null +++ b/queue-6.17/crypto-comp-use-same-definition-of-context-alloc-and.patch @@ -0,0 +1,191 @@ +From c3ba96a697e5ff3cd4bf98c04190f6ce4e59c1f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 10:12:43 -0600 +Subject: crypto: comp - Use same definition of context alloc and free ops + +From: Dan Moulding + +[ Upstream commit f75f66683ded09f7135aef2e763c245a07c8271a ] + +In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation +code into acomp"), the crypto_acomp_streams struct was made to rely on +having the alloc_ctx and free_ctx operations defined in the same order +as the scomp_alg struct. But in that same commit, the alloc_ctx and +free_ctx members of scomp_alg may be randomized by structure layout +randomization, since they are contained in a pure ops structure +(containing only function pointers). If the pointers within scomp_alg +are randomized, but those in crypto_acomp_streams are not, then +the order may no longer match. This fixes the problem by removing the +union from scomp_alg so that both crypto_acomp_streams and scomp_alg +will share the same definition of alloc_ctx and free_ctx, ensuring +they will always have the same layout. + +Signed-off-by: Dan Moulding +Suggested-by: Herbert Xu +Fixes: 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/842.c | 6 ++++-- + crypto/lz4.c | 6 ++++-- + crypto/lz4hc.c | 6 ++++-- + crypto/lzo-rle.c | 6 ++++-- + crypto/lzo.c | 6 ++++-- + drivers/crypto/nx/nx-common-powernv.c | 6 ++++-- + drivers/crypto/nx/nx-common-pseries.c | 6 ++++-- + include/crypto/internal/scompress.h | 11 +---------- + 8 files changed, 29 insertions(+), 24 deletions(-) + +diff --git a/crypto/842.c b/crypto/842.c +index 8c257c40e2b90..4007e87bed806 100644 +--- a/crypto/842.c ++++ b/crypto/842.c +@@ -54,8 +54,10 @@ static int crypto842_sdecompress(struct crypto_scomp *tfm, + } + + static struct scomp_alg scomp = { +- .alloc_ctx = crypto842_alloc_ctx, +- .free_ctx = crypto842_free_ctx, ++ .streams = { ++ .alloc_ctx = crypto842_alloc_ctx, ++ .free_ctx = crypto842_free_ctx, ++ }, + .compress = crypto842_scompress, + .decompress = crypto842_sdecompress, + .base = { +diff --git a/crypto/lz4.c b/crypto/lz4.c +index 7a984ae5ae52e..57b713516aefa 100644 +--- a/crypto/lz4.c ++++ b/crypto/lz4.c +@@ -68,8 +68,10 @@ static int lz4_sdecompress(struct crypto_scomp *tfm, const u8 *src, + } + + static struct scomp_alg scomp = { +- .alloc_ctx = lz4_alloc_ctx, +- .free_ctx = lz4_free_ctx, ++ .streams = { ++ .alloc_ctx = lz4_alloc_ctx, ++ .free_ctx = lz4_free_ctx, ++ }, + .compress = lz4_scompress, + .decompress = lz4_sdecompress, + .base = { +diff --git a/crypto/lz4hc.c b/crypto/lz4hc.c +index 9c61d05b62142..bb84f8a68cb58 100644 +--- a/crypto/lz4hc.c ++++ b/crypto/lz4hc.c +@@ -66,8 +66,10 @@ static int lz4hc_sdecompress(struct crypto_scomp *tfm, const u8 *src, + } + + static struct scomp_alg scomp = { +- .alloc_ctx = lz4hc_alloc_ctx, +- .free_ctx = lz4hc_free_ctx, ++ .streams = { ++ .alloc_ctx = lz4hc_alloc_ctx, ++ .free_ctx = lz4hc_free_ctx, ++ }, + .compress = lz4hc_scompress, + .decompress = lz4hc_sdecompress, + .base = { +diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c +index ba013f2d5090d..794e7ec49536b 100644 +--- a/crypto/lzo-rle.c ++++ b/crypto/lzo-rle.c +@@ -70,8 +70,10 @@ static int lzorle_sdecompress(struct crypto_scomp *tfm, const u8 *src, + } + + static struct scomp_alg scomp = { +- .alloc_ctx = lzorle_alloc_ctx, +- .free_ctx = lzorle_free_ctx, ++ .streams = { ++ .alloc_ctx = lzorle_alloc_ctx, ++ .free_ctx = lzorle_free_ctx, ++ }, + .compress = lzorle_scompress, + .decompress = lzorle_sdecompress, + .base = { +diff --git a/crypto/lzo.c b/crypto/lzo.c +index 7867e2c67c4ed..d43242b24b4e8 100644 +--- a/crypto/lzo.c ++++ b/crypto/lzo.c +@@ -70,8 +70,10 @@ static int lzo_sdecompress(struct crypto_scomp *tfm, const u8 *src, + } + + static struct scomp_alg scomp = { +- .alloc_ctx = lzo_alloc_ctx, +- .free_ctx = lzo_free_ctx, ++ .streams = { ++ .alloc_ctx = lzo_alloc_ctx, ++ .free_ctx = lzo_free_ctx, ++ }, + .compress = lzo_scompress, + .decompress = lzo_sdecompress, + .base = { +diff --git a/drivers/crypto/nx/nx-common-powernv.c b/drivers/crypto/nx/nx-common-powernv.c +index fd0a98b2fb1b2..0493041ea0885 100644 +--- a/drivers/crypto/nx/nx-common-powernv.c ++++ b/drivers/crypto/nx/nx-common-powernv.c +@@ -1043,8 +1043,10 @@ static struct scomp_alg nx842_powernv_alg = { + .base.cra_priority = 300, + .base.cra_module = THIS_MODULE, + +- .alloc_ctx = nx842_powernv_crypto_alloc_ctx, +- .free_ctx = nx842_crypto_free_ctx, ++ .streams = { ++ .alloc_ctx = nx842_powernv_crypto_alloc_ctx, ++ .free_ctx = nx842_crypto_free_ctx, ++ }, + .compress = nx842_crypto_compress, + .decompress = nx842_crypto_decompress, + }; +diff --git a/drivers/crypto/nx/nx-common-pseries.c b/drivers/crypto/nx/nx-common-pseries.c +index f528e072494a2..fc0222ebe8072 100644 +--- a/drivers/crypto/nx/nx-common-pseries.c ++++ b/drivers/crypto/nx/nx-common-pseries.c +@@ -1020,8 +1020,10 @@ static struct scomp_alg nx842_pseries_alg = { + .base.cra_priority = 300, + .base.cra_module = THIS_MODULE, + +- .alloc_ctx = nx842_pseries_crypto_alloc_ctx, +- .free_ctx = nx842_crypto_free_ctx, ++ .streams = { ++ .alloc_ctx = nx842_pseries_crypto_alloc_ctx, ++ .free_ctx = nx842_crypto_free_ctx, ++ }, + .compress = nx842_crypto_compress, + .decompress = nx842_crypto_decompress, + }; +diff --git a/include/crypto/internal/scompress.h b/include/crypto/internal/scompress.h +index 533d6c16a4914..6a2c5f2e90f95 100644 +--- a/include/crypto/internal/scompress.h ++++ b/include/crypto/internal/scompress.h +@@ -18,11 +18,8 @@ struct crypto_scomp { + /** + * struct scomp_alg - synchronous compression algorithm + * +- * @alloc_ctx: Function allocates algorithm specific context +- * @free_ctx: Function frees context allocated with alloc_ctx + * @compress: Function performs a compress operation + * @decompress: Function performs a de-compress operation +- * @base: Common crypto API algorithm data structure + * @streams: Per-cpu memory for algorithm + * @calg: Cmonn algorithm data structure shared with acomp + */ +@@ -34,13 +31,7 @@ struct scomp_alg { + unsigned int slen, u8 *dst, unsigned int *dlen, + void *ctx); + +- union { +- struct { +- void *(*alloc_ctx)(void); +- void (*free_ctx)(void *ctx); +- }; +- struct crypto_acomp_streams streams; +- }; ++ struct crypto_acomp_streams streams; + + union { + struct COMP_ALG_COMMON; +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-check-the-sva-module-status-while-e.patch b/queue-6.17/crypto-hisilicon-check-the-sva-module-status-while-e.patch new file mode 100644 index 0000000000..870a410814 --- /dev/null +++ b/queue-6.17/crypto-hisilicon-check-the-sva-module-status-while-e.patch @@ -0,0 +1,366 @@ +From 7b0f8828fc251dba636017c5e97594ed224b7fbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:06 +0800 +Subject: crypto: hisilicon - check the sva module status while enabling or + disabling address prefetch + +From: Weili Qian + +[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ] + +After enabling address prefetch, check the sva module status. If all +previous prefetch requests from the sva module are not completed, then +disable the address prefetch to ensure normal execution of new task +operations. After disabling address prefetch, check if all requests +from the sva module have been completed. + +Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching") +Signed-off-by: Weili Qian +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++---- + drivers/crypto/hisilicon/sec2/sec_main.c | 48 +++++++++++++- + drivers/crypto/hisilicon/zip/zip_main.c | 79 +++++++++++++++++++---- + 3 files changed, 164 insertions(+), 26 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index 34f84978180f0..7b60e89015bdf 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -78,6 +78,11 @@ + #define HPRE_PREFETCH_ENABLE (~(BIT(0) | BIT(30))) + #define HPRE_PREFETCH_DISABLE BIT(30) + #define HPRE_SVA_DISABLE_READY (BIT(4) | BIT(8)) ++#define HPRE_SVA_PREFTCH_DFX4 0x301144 ++#define HPRE_WAIT_SVA_READY 500000 ++#define HPRE_READ_SVA_STATUS_TIMES 3 ++#define HPRE_WAIT_US_MIN 10 ++#define HPRE_WAIT_US_MAX 20 + + /* clock gate */ + #define HPRE_CLKGATE_CTL 0x301a10 +@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type) + return NULL; + } + ++static int hpre_wait_sva_ready(struct hisi_qm *qm) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4); ++ if (val) ++ count = 0; ++ else if (++count == HPRE_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX); ++ } while (++try_times < HPRE_WAIT_SVA_READY); ++ ++ if (try_times == HPRE_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static void hpre_config_pasid(struct hisi_qm *qm) + { + u32 val1, val2; +@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm) + writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE); + } + +-static void hpre_open_sva_prefetch(struct hisi_qm *qm) ++static void hpre_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + +- /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG); +- val &= HPRE_PREFETCH_ENABLE; ++ val |= HPRE_PREFETCH_DISABLE; + writel(val, qm->io_base + HPRE_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG, +- val, !(val & HPRE_PREFETCH_DISABLE), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX, ++ val, !(val & HPRE_SVA_DISABLE_READY), + HPRE_REG_RD_INTVRL_US, + HPRE_REG_RD_TMOUT_US); + if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)hpre_wait_sva_ready(qm); + } + +-static void hpre_close_sva_prefetch(struct hisi_qm *qm) ++static void hpre_open_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + ++ /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG); +- val |= HPRE_PREFETCH_DISABLE; ++ val &= HPRE_PREFETCH_ENABLE; + writel(val, qm->io_base + HPRE_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX, +- val, !(val & HPRE_SVA_DISABLE_READY), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG, ++ val, !(val & HPRE_PREFETCH_DISABLE), + HPRE_REG_RD_INTVRL_US, + HPRE_REG_RD_TMOUT_US); ++ if (ret) { ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ hpre_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = hpre_wait_sva_ready(qm); + if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ hpre_close_sva_prefetch(qm); + } + + static void hpre_enable_clock_gate(struct hisi_qm *qm) +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index ddb20f380b546..348f1f52956dc 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -93,6 +93,16 @@ + #define SEC_PREFETCH_ENABLE (~(BIT(0) | BIT(1) | BIT(11))) + #define SEC_PREFETCH_DISABLE BIT(1) + #define SEC_SVA_DISABLE_READY (BIT(7) | BIT(11)) ++#define SEC_SVA_PREFETCH_INFO 0x301ED4 ++#define SEC_SVA_STALL_NUM GENMASK(23, 8) ++#define SEC_SVA_PREFETCH_NUM GENMASK(2, 0) ++#define SEC_WAIT_SVA_READY 500000 ++#define SEC_READ_SVA_STATUS_TIMES 3 ++#define SEC_WAIT_US_MIN 10 ++#define SEC_WAIT_US_MAX 20 ++#define SEC_WAIT_QP_US_MIN 1000 ++#define SEC_WAIT_QP_US_MAX 2000 ++#define SEC_MAX_WAIT_TIMES 2000 + + #define SEC_DELAY_10_US 10 + #define SEC_POLL_TIMEOUT_US 1000 +@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + offset); ++ if (val & mask) ++ count = 0; ++ else if (++count == SEC_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX); ++ } while (++try_times < SEC_WAIT_SVA_READY); ++ ++ if (try_times == SEC_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static void sec_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; +@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm) + SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); + if (ret) + pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM); + } + + static void sec_open_sva_prefetch(struct hisi_qm *qm) +@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm) + ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, + val, !(val & SEC_PREFETCH_DISABLE), + SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) ++ if (ret) { + pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ sec_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM); ++ if (ret) ++ sec_close_sva_prefetch(qm); + } + + static void sec_engine_sva_config(struct hisi_qm *qm) +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 480fa590664a8..341c4564e21aa 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -95,10 +95,16 @@ + #define HZIP_PREFETCH_ENABLE (~(BIT(26) | BIT(17) | BIT(0))) + #define HZIP_SVA_PREFETCH_DISABLE BIT(26) + #define HZIP_SVA_DISABLE_READY (BIT(26) | BIT(30)) ++#define HZIP_SVA_PREFETCH_NUM GENMASK(18, 16) ++#define HZIP_SVA_STALL_NUM GENMASK(15, 0) + #define HZIP_SHAPER_RATE_COMPRESS 750 + #define HZIP_SHAPER_RATE_DECOMPRESS 140 +-#define HZIP_DELAY_1_US 1 +-#define HZIP_POLL_TIMEOUT_US 1000 ++#define HZIP_DELAY_1_US 1 ++#define HZIP_POLL_TIMEOUT_US 1000 ++#define HZIP_WAIT_SVA_READY 500000 ++#define HZIP_READ_SVA_STATUS_TIMES 3 ++#define HZIP_WAIT_US_MIN 10 ++#define HZIP_WAIT_US_MAX 20 + + /* clock gating */ + #define HZIP_PEH_CFG_AUTO_GATE 0x3011A8 +@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm) + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); + } + +-static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) ++static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask) ++{ ++ u32 val, try_times = 0; ++ u8 count = 0; ++ ++ /* ++ * Read the register value every 10-20us. If the value is 0 for three ++ * consecutive times, the SVA module is ready. ++ */ ++ do { ++ val = readl(qm->io_base + offset); ++ if (val & mask) ++ count = 0; ++ else if (++count == HZIP_READ_SVA_STATUS_TIMES) ++ break; ++ ++ usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX); ++ } while (++try_times < HZIP_WAIT_SVA_READY); ++ ++ if (try_times == HZIP_WAIT_SVA_READY) { ++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ ++static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + +- /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG); +- val &= HZIP_PREFETCH_ENABLE; ++ val |= HZIP_SVA_PREFETCH_DISABLE; + writel(val, qm->io_base + HZIP_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG, +- val, !(val & HZIP_SVA_PREFETCH_DISABLE), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS, ++ val, !(val & HZIP_SVA_DISABLE_READY), + HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US); + if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ ++ (void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM); + } + +-static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) ++static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) + { + u32 val; + int ret; +@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm) + if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) + return; + ++ /* Enable prefetch */ + val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG); +- val |= HZIP_SVA_PREFETCH_DISABLE; ++ val &= HZIP_PREFETCH_ENABLE; + writel(val, qm->io_base + HZIP_PREFETCH_CFG); + +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS, +- val, !(val & HZIP_SVA_DISABLE_READY), ++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG, ++ val, !(val & HZIP_SVA_PREFETCH_DISABLE), + HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US); ++ if (ret) { ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++ hisi_zip_close_sva_prefetch(qm); ++ return; ++ } ++ ++ ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM); + if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ hisi_zip_close_sva_prefetch(qm); + } + + static void hisi_zip_enable_clock_gate(struct hisi_qm *qm) +@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + void __iomem *base = qm->io_base; + u32 dcomp_bm, comp_bm; + u32 zip_core_en; ++ int ret; + + /* qm user domain */ + writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1); +@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + +- return hisi_dae_set_user_domain(qm); ++ ret = hisi_dae_set_user_domain(qm); ++ if (ret) ++ goto close_sva_prefetch; ++ ++ return 0; ++ ++close_sva_prefetch: ++ hisi_zip_close_sva_prefetch(qm); ++ return ret; + } + + static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable) +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-qm-check-whether-the-input-function.patch b/queue-6.17/crypto-hisilicon-qm-check-whether-the-input-function.patch new file mode 100644 index 0000000000..99c67acf0b --- /dev/null +++ b/queue-6.17/crypto-hisilicon-qm-check-whether-the-input-function.patch @@ -0,0 +1,42 @@ +From 07ac31c2cfece203d76ab0f7d7d1cc154b6f61c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:07 +0800 +Subject: crypto: hisilicon/qm - check whether the input function and PF are on + the same device + +From: Zhushuai Yin + +[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ] + +Function rate limiting is set through physical function driver. +Users configure by providing function information and rate limit values. +Before configuration, it is necessary to check whether the +provided function and PF belong to the same device. + +Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") +Signed-off-by: Zhushuai Yin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index a5cc0ccd94f1f..2f96c673b60a5 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -3826,6 +3826,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, + } + + pdev = container_of(dev, struct pci_dev, dev); ++ if (pci_physfn(pdev) != qm->pdev) { ++ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); ++ return -EINVAL; ++ } + + *fun_index = pdev->devfn; + +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch b/queue-6.17/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch new file mode 100644 index 0000000000..958356800c --- /dev/null +++ b/queue-6.17/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch @@ -0,0 +1,113 @@ +From 5a83a18e6426f291e20096bb1d7a929300c82cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:08 +0800 +Subject: crypto: hisilicon/qm - request reserved interrupt for virtual + function + +From: Weili Qian + +[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ] + +The device interrupt vector 3 is an error interrupt for +physical function and a reserved interrupt for virtual function. +However, the driver has not registered the reserved interrupt for +virtual function. When allocating interrupts, the number of interrupts +is allocated based on powers of two, which includes this interrupt. +When the system enables GICv4 and the virtual function passthrough +to the virtual machine, releasing the interrupt in the driver +triggers a warning. + +The WARNING report is: +WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 + +Therefore, register a reserved interrupt for VF and set the +IRQF_NO_AUTOEN flag to avoid that warning. + +Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers") +Signed-off-by: Weili Qian +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------ + 1 file changed, 32 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 2f96c673b60a5..102aff9ea19a0 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4732,6 +4732,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev) + } + EXPORT_SYMBOL_GPL(hisi_qm_reset_done); + ++static irqreturn_t qm_rsvd_irq(int irq, void *data) ++{ ++ struct hisi_qm *qm = data; ++ ++ dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n"); ++ ++ return IRQ_HANDLED; ++} ++ + static irqreturn_t qm_abnormal_irq(int irq, void *data) + { + struct hisi_qm *qm = data; +@@ -5015,7 +5024,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm) + struct pci_dev *pdev = qm->pdev; + u32 irq_vector, val; + +- if (qm->fun_type == QM_HW_VF) ++ if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3) + return; + + val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val; +@@ -5032,17 +5041,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm) + u32 irq_vector, val; + int ret; + +- if (qm->fun_type == QM_HW_VF) +- return 0; +- + val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val; + if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) + return 0; +- + irq_vector = val & QM_IRQ_VECTOR_MASK; ++ ++ /* For VF, this is a reserved interrupt in V3 version. */ ++ if (qm->fun_type == QM_HW_VF) { ++ if (qm->ver < QM_HW_V3) ++ return 0; ++ ++ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq, ++ IRQF_NO_AUTOEN, qm->dev_name, qm); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret); ++ return ret; ++ } ++ return 0; ++ } ++ + ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm); + if (ret) +- dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret); ++ dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret); + + return ret; + } +@@ -5408,6 +5428,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm) + pci_set_master(pdev); + + num_vec = qm_get_irq_num(qm); ++ if (!num_vec) { ++ dev_err(dev, "Device irq num is zero!\n"); ++ ret = -EINVAL; ++ goto err_get_pci_res; ++ } ++ num_vec = roundup_pow_of_two(num_vec); + ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI); + if (ret < 0) { + dev_err(dev, "Failed to enable MSI vectors!\n"); +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.17/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch new file mode 100644 index 0000000000..3c67daacea --- /dev/null +++ b/queue-6.17/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch @@ -0,0 +1,38 @@ +From d1db9e9b19916c13a3075e15eec94dd3d4cace58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:57:54 +0800 +Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs + +From: Chenghai Huang + +[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ] + +When the initialization of qm->debug.acc_diff_reg fails, +the probe process does not exit. However, after qm->debug.qm_diff_regs is +freed, it is not set to NULL. This can lead to a double free when the +remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs +should be set to NULL after it is freed. + +Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index 45e130b901eb5..17eb236e9ee4d 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.17/crypto-hisilicon-re-enable-address-prefetch-after-de.patch new file mode 100644 index 0000000000..cd523fa55d --- /dev/null +++ b/queue-6.17/crypto-hisilicon-re-enable-address-prefetch-after-de.patch @@ -0,0 +1,200 @@ +From e33392536f0008c2e25e1697add3eece592137c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:05 +0800 +Subject: crypto: hisilicon - re-enable address prefetch after device resuming + +From: Chenghai Huang + +[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ] + +When the device resumes from a suspended state, it will revert to its +initial state and requires re-enabling. Currently, the address prefetch +function is not re-enabled after device resuming. Move the address prefetch +enable to the initialization process. In this way, the address prefetch +can be enabled when the device resumes by calling the initialization +process. + +Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +- + drivers/crypto/hisilicon/qm.c | 3 - + drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------ + drivers/crypto/hisilicon/zip/zip_main.c | 5 +- + 4 files changed, 43 insertions(+), 48 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index f5b47e5ff48a4..34f84978180f0 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 2e4ee7ecfdfbb..a5cc0ccd94f1f 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4447,9 +4447,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 72cf48d1f3ab8..ddb20f380b546 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index fb7b19927dd32..480fa590664a8 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + +@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return hisi_dae_set_user_domain(qm); +@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- hisi_zip_set_high_perf(qm); +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +-- +2.51.0 + diff --git a/queue-6.17/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.17/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch new file mode 100644 index 0000000000..f25c217ba7 --- /dev/null +++ b/queue-6.17/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch @@ -0,0 +1,67 @@ +From f365f5fa510f2be67aff9dc638efe480d06feb5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:04 +0800 +Subject: crypto: hisilicon/zip - remove unnecessary validation for + high-performance mode configurations + +From: Chenghai Huang + +[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ] + +When configuring the high-performance mode register, there is no +need to verify whether the register has been successfully +enabled, as there is no possibility of a write failure for this +register. + +Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index d8ba23b7cc7dd..fb7b19927dd32 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; ++ hisi_zip_set_high_perf(qm); + + hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); +-- +2.51.0 + diff --git a/queue-6.17/crypto-keembay-add-missing-check-after-sg_nents_for_.patch b/queue-6.17/crypto-keembay-add-missing-check-after-sg_nents_for_.patch new file mode 100644 index 0000000000..6378b9198c --- /dev/null +++ b/queue-6.17/crypto-keembay-add-missing-check-after-sg_nents_for_.patch @@ -0,0 +1,45 @@ +From f565753abaaf812c98f16182238cd280585ddf85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 14:03:30 +0200 +Subject: crypto: keembay - Add missing check after sg_nents_for_len() + +From: Thomas Fourier + +[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ] + +sg_nents_for_len() returns an int which is negative in case of error. + +Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +index 8f9e21ced0fe1..48281d8822603 100644 +--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c ++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + struct device *dev = rctx->hcu_dev->dev; + unsigned int remainder = 0; + unsigned int total; +- size_t nents; ++ int nents; + size_t count; + int rc; + int i; +@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + /* Determine the number of scatter gather list entries to process. */ + nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); + ++ if (nents < 0) ++ return nents; ++ + /* If there are entries to process, map them. */ + if (nents) { + rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, +-- +2.51.0 + diff --git a/queue-6.17/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch b/queue-6.17/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch new file mode 100644 index 0000000000..98b512770a --- /dev/null +++ b/queue-6.17/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch @@ -0,0 +1,42 @@ +From c6ddade15ea2f53e6a10117f668085f7fe7a9069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 11:24:57 +0200 +Subject: crypto: octeontx2 - Call strscpy() with correct size argument + +From: Thorsten Blum + +[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ] + +In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length +of the source string rather than the size of the destination buffer. + +This is fine as long as the destination buffer is larger than the source +string, but we should still use the destination buffer size instead to +call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer, +we can safely omit the size argument and let strscpy() infer it using +sizeof(). + +Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups") +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +index cc47e361089a0..ebdf4efa09d4d 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf, + return -EINVAL; + } + err_msg = "Invalid engine group format"; +- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1); ++ strscpy(tmp_buf, ctx->val.vstr); + start = tmp_buf; + + has_se = has_ie = has_ae = false; +-- +2.51.0 + diff --git a/queue-6.17/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch b/queue-6.17/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch new file mode 100644 index 0000000000..2397a8b30e --- /dev/null +++ b/queue-6.17/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch @@ -0,0 +1,51 @@ +From e97124c6abeffc1caeb0d2be67548eead4be5f3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 23:22:38 +0300 +Subject: dm vdo: return error on corrupted metadata in start_restoring_volume + functions + +From: Ivan Abramov + +[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ] + +The return values of VDO_ASSERT calls that validate metadata are not acted +upon. + +Return UDS_CORRUPT_DATA in case of an error. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a4eb7e255517 ("dm vdo: implement the volume index") +Signed-off-by: Ivan Abramov +Reviewed-by: Matthew Sakai +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-vdo/indexer/volume-index.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c +index 12f954a0c5325..afb062e1f1fb4 100644 +--- a/drivers/md/dm-vdo/indexer/volume-index.c ++++ b/drivers/md/dm-vdo/indexer/volume-index.c +@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) { + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index, + "%zu bytes decoded of %zu expected", offset, + sizeof(buffer)); + if (result != VDO_SUCCESS) +- result = UDS_CORRUPT_DATA; ++ return UDS_CORRUPT_DATA; + + if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0) + return vdo_log_warning_strerror(UDS_CORRUPT_DATA, +-- +2.51.0 + diff --git a/queue-6.17/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch b/queue-6.17/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch new file mode 100644 index 0000000000..daf21a28b9 --- /dev/null +++ b/queue-6.17/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch @@ -0,0 +1,44 @@ +From b63231b105d7b9525185872193ba61da60ce8a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 11:07:38 -0500 +Subject: dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation + +From: Nathan Lynch + +[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ] + +Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc +warnings") inserted new documentation for @desc_free in the middle of +@tx_submit's description. + +Put @tx_submit's description back together, matching the indentation +style of the rest of the documentation for dma_async_tx_descriptor. + +Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings") +Reviewed-by: Dave Jiang +Signed-off-by: Nathan Lynch +Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 6de7c05d6bd8c..99efe2b9b4ea9 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops { + * @phys: physical address of the descriptor + * @chan: target channel for this operation + * @tx_submit: accept the descriptor, assign ordered cookie and mark the ++ * descriptor pending. To be pushed on .issue_pending() call + * @desc_free: driver's callback function to free a resusable descriptor + * after completion +- * descriptor pending. To be pushed on .issue_pending() call + * @callback: routine to call after this operation is complete + * @callback_result: error result from a DMA transaction + * @callback_param: general parameter to pass to the callback routine +-- +2.51.0 + diff --git a/queue-6.17/docs-iio-ad3552r-fix-malformed-code-block-directive.patch b/queue-6.17/docs-iio-ad3552r-fix-malformed-code-block-directive.patch new file mode 100644 index 0000000000..c65fed435b --- /dev/null +++ b/queue-6.17/docs-iio-ad3552r-fix-malformed-code-block-directive.patch @@ -0,0 +1,38 @@ +From 351f3eae38b3d32e41c625470d9ab5ba890293fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 16:44:23 +0200 +Subject: docs: iio: ad3552r: Fix malformed code-block directive + +From: Jorge Marques + +[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ] + +Missing required double dot and line break. + +Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver") +Signed-off-by: Jorge Marques +Reviewed-by: David Lechner +Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + Documentation/iio/ad3552r.rst | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst +index f5d59e4e86c7e..4274e35f503d9 100644 +--- a/Documentation/iio/ad3552r.rst ++++ b/Documentation/iio/ad3552r.rst +@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``. + Usage examples + -------------- + +-. code-block:: bash ++.. code-block:: bash ++ + root:/sys/bus/iio/devices/iio:device0# cat data_source + normal + root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source +-- +2.51.0 + diff --git a/queue-6.17/documentation-trace-historgram-design-separate-sched.patch b/queue-6.17/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..e050286669 --- /dev/null +++ b/queue-6.17/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 9db7b7d75d505e69bd6d0732f9201b5a3d439460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 5765eb3e9efa7..a30f4bed11b4e 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-6.17/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.17/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..5c69114d5e --- /dev/null +++ b/queue-6.17/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From f89d73219b082877b7f125af9b3cef02597ade11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 45d512939c408..67b01d5797377 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -887,7 +887,6 @@ int register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-6.17/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.17/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..4645f6f7b3 --- /dev/null +++ b/queue-6.17/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 8c9e57e7a409013be623e6b9760fba2fa101ff0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 3399594136b2a..45d512939c408 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -885,6 +885,11 @@ int register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch b/queue-6.17/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch new file mode 100644 index 0000000000..3dcab1f025 --- /dev/null +++ b/queue-6.17/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch @@ -0,0 +1,103 @@ +From 9def92f835da7c8cfea68ce4c4d7fb2d19218ad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 12:14:01 +0530 +Subject: drm/amd/display: Add NULL pointer checks in dc_stream cursor + attribute functions + +From: Srinivasan Shanmugam + +[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ] + +The function dc_stream_set_cursor_attributes() currently dereferences +the `stream` pointer and nested members `stream->ctx->dc->current_state` +without checking for NULL. + +All callers of these functions, such as in +`dcn30_apply_idle_power_optimizations()` and +`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks +before calling these functions. + +Fixes below: +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() +error: we previously assumed 'stream' could be null (see line 334) + +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c + 327 bool dc_stream_program_cursor_attributes( + 328 struct dc_stream_state *stream, + 329 const struct dc_cursor_attributes *attributes) + 330 { + 331 struct dc *dc; + 332 bool reset_idle_optimizations = false; + 333 + 334 dc = stream ? stream->ctx->dc : NULL; + ^^^^^^ +The old code assumed stream could be NULL. + + 335 +--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) { + ^^^^^^ +The refactor added an unchecked dereference. + +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c + 313 bool dc_stream_set_cursor_attributes( + 314 struct dc_stream_state *stream, + 315 const struct dc_cursor_attributes *attributes) + 316 { + 317 bool result = false; + 318 + 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. +This function used to check for if stream as NULL and return false at +the start. Probably we should add that back. + +Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic") +Reported-by: Dan Carpenter +Cc: Alex Hung +Cc: Alvin Lee +Cc: Ray Wu +Cc: Dillon Varone +Cc: Aurabindo Pillai +Cc: Roman Li +Cc: ChiaHsuan Chung +Cc: Harry Wentland +Cc: Daniel Wheeler +Cc: Tom Chung +Cc: Wenjing Liu +Cc: Jun Lei +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Dillon Varone +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +index 4d6bc9fd4faa8..9ac2d41f8fcae 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes( + { + bool result = false; + ++ if (!stream) ++ return false; ++ + if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { + stream->cursor_attributes = *attributes; + result = true; +@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes( + struct dc *dc; + bool reset_idle_optimizations = false; + +- dc = stream ? stream->ctx->dc : NULL; ++ if (!stream) ++ return false; ++ ++ dc = stream->ctx->dc; + + if (dc_stream_set_cursor_attributes(stream, attributes)) { + dc_z10_restore(dc); +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-reduce-stack-usage-by-moving-audio_o.patch b/queue-6.17/drm-amd-display-reduce-stack-usage-by-moving-audio_o.patch new file mode 100644 index 0000000000..add5643091 --- /dev/null +++ b/queue-6.17/drm-amd-display-reduce-stack-usage-by-moving-audio_o.patch @@ -0,0 +1,240 @@ +From 0c8246cdbe65a281290556f047e4ee5304e16a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:02:18 +0530 +Subject: drm/amd/display: Reduce Stack Usage by moving 'audio_output' into + 'stream_res' v4 + +From: Srinivasan Shanmugam + +[ Upstream commit 1cf1205ef2685cf43db3785706b017d1e54e0bec ] + +The function `dp_retrain_link_dp_test` currently allocates a large +audio_output array on the stack, causing the stack frame size to exceed +the compiler limit (1080 bytes > 1024 bytes). + +This change prevents stack overflow issues: +amdgpu/../display/dc/link/accessories/link_dp_cts.c:65:13: warning: stack frame size (1080) exceeds limit (1024) in 'dp_retrain_link_dp_test' [-Wframe-larger-than] +static void dp_retrain_link_dp_test(struct dc_link *link, + +v2: Move audio-related data like `audio_output` is kept "per pipe" to + manage the audio for that specific display pipeline/display output path + (stream). (Wenjing) + +v3: Update in all the places where `build_audio_output` is currently + called with a separate audio_output variable on the stack & wherever + `audio_output` is passed to other functions + `dce110_apply_single_controller_ctx_to_hw()` & + `dce110_setup_audio_dto()` (like `az_configure`, `wall_dto_setup`) + replace with usage of `pipe_ctx->stream_res.audio_output` + to centralize audio data per pipe. + +v4: Remove empty lines before `build_audio_output`. (Alex) + +Fixes: 9c6669c2e21a ("drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO") +Cc: Wayne Lin +Cc: George Shen +Cc: Michael Strauss +Cc: Alvin Lee +Cc: Ray Wu +Cc: Wenjing Liu +Cc: Harry Wentland +Cc: Tom Chung +Cc: Roman Li +Cc: Alex Hung +Cc: Aurabindo Pillai +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Wenjing Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 32 ++++++++----------- + .../gpu/drm/amd/display/dc/inc/core_types.h | 5 +-- + .../display/dc/link/accessories/link_dp_cts.c | 12 +++---- + .../dc/resource/dcn31/dcn31_resource.c | 5 ++- + .../dc/resource/dcn31/dcn31_resource.h | 3 +- + 5 files changed, 26 insertions(+), 31 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 4ea13d0bf815e..c69194e04ff93 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1600,19 +1600,17 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw( + } + + if (pipe_ctx->stream_res.audio != NULL) { +- struct audio_output audio_output = {0}; ++ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output); + +- build_audio_output(context, pipe_ctx, &audio_output); +- +- link_hwss->setup_audio_output(pipe_ctx, &audio_output, ++ link_hwss->setup_audio_output(pipe_ctx, &pipe_ctx->stream_res.audio_output, + pipe_ctx->stream_res.audio->inst); + + pipe_ctx->stream_res.audio->funcs->az_configure( + pipe_ctx->stream_res.audio, + pipe_ctx->stream->signal, +- &audio_output.crtc_info, ++ &pipe_ctx->stream_res.audio_output.crtc_info, + &pipe_ctx->stream->audio_info, +- &audio_output.dp_link_info); ++ &pipe_ctx->stream_res.audio_output.dp_link_info); + + if (dc->config.disable_hbr_audio_dp2) + if (pipe_ctx->stream_res.audio->funcs->az_disable_hbr_audio && +@@ -2386,9 +2384,7 @@ static void dce110_setup_audio_dto( + if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A) + continue; + if (pipe_ctx->stream_res.audio != NULL) { +- struct audio_output audio_output; +- +- build_audio_output(context, pipe_ctx, &audio_output); ++ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output); + + if (dc->res_pool->dccg && dc->res_pool->dccg->funcs->set_audio_dtbclk_dto) { + struct dtbclk_dto_params dto_params = {0}; +@@ -2399,14 +2395,14 @@ static void dce110_setup_audio_dto( + pipe_ctx->stream_res.audio->funcs->wall_dto_setup( + pipe_ctx->stream_res.audio, + pipe_ctx->stream->signal, +- &audio_output.crtc_info, +- &audio_output.pll_info); ++ &pipe_ctx->stream_res.audio_output.crtc_info, ++ &pipe_ctx->stream_res.audio_output.pll_info); + } else + pipe_ctx->stream_res.audio->funcs->wall_dto_setup( + pipe_ctx->stream_res.audio, + pipe_ctx->stream->signal, +- &audio_output.crtc_info, +- &audio_output.pll_info); ++ &pipe_ctx->stream_res.audio_output.crtc_info, ++ &pipe_ctx->stream_res.audio_output.pll_info); + break; + } + } +@@ -2426,15 +2422,15 @@ static void dce110_setup_audio_dto( + continue; + + if (pipe_ctx->stream_res.audio != NULL) { +- struct audio_output audio_output = {0}; +- +- build_audio_output(context, pipe_ctx, &audio_output); ++ build_audio_output(context, ++ pipe_ctx, ++ &pipe_ctx->stream_res.audio_output); + + pipe_ctx->stream_res.audio->funcs->wall_dto_setup( + pipe_ctx->stream_res.audio, + pipe_ctx->stream->signal, +- &audio_output.crtc_info, +- &audio_output.pll_info); ++ &pipe_ctx->stream_res.audio_output.crtc_info, ++ &pipe_ctx->stream_res.audio_output.pll_info); + break; + } + } +diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h +index f0d7185153b2a..f896cce87b8d4 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h +@@ -228,8 +228,7 @@ struct resource_funcs { + enum dc_status (*update_dc_state_for_encoder_switch)(struct dc_link *link, + struct dc_link_settings *link_setting, + uint8_t pipe_count, +- struct pipe_ctx *pipes, +- struct audio_output *audio_output); ++ struct pipe_ctx *pipes); + }; + + struct audio_support{ +@@ -361,6 +360,8 @@ struct stream_resource { + uint8_t gsl_group; + + struct test_pattern_params test_pattern_params; ++ ++ struct audio_output audio_output; + }; + + struct plane_resource { +diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +index 2956c2b3ad1aa..b12d61701d4d9 100644 +--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c ++++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +@@ -75,7 +75,6 @@ static void dp_retrain_link_dp_test(struct dc_link *link, + bool is_hpo_acquired; + uint8_t count; + int i; +- struct audio_output audio_output[MAX_PIPES]; + + needs_divider_update = (link->dc->link_srv->dp_get_encoding_format(link_setting) != + link->dc->link_srv->dp_get_encoding_format((const struct dc_link_settings *) &link->cur_link_settings)); +@@ -99,7 +98,7 @@ static void dp_retrain_link_dp_test(struct dc_link *link, + if (needs_divider_update && link->dc->res_pool->funcs->update_dc_state_for_encoder_switch) { + link->dc->res_pool->funcs->update_dc_state_for_encoder_switch(link, + link_setting, count, +- *pipes, &audio_output[0]); ++ *pipes); + for (i = 0; i < count; i++) { + pipes[i]->clock_source->funcs->program_pix_clk( + pipes[i]->clock_source, +@@ -111,15 +110,16 @@ static void dp_retrain_link_dp_test(struct dc_link *link, + const struct link_hwss *link_hwss = get_link_hwss( + link, &pipes[i]->link_res); + +- link_hwss->setup_audio_output(pipes[i], &audio_output[i], +- pipes[i]->stream_res.audio->inst); ++ link_hwss->setup_audio_output(pipes[i], ++ &pipes[i]->stream_res.audio_output, ++ pipes[i]->stream_res.audio->inst); + + pipes[i]->stream_res.audio->funcs->az_configure( + pipes[i]->stream_res.audio, + pipes[i]->stream->signal, +- &audio_output[i].crtc_info, ++ &pipes[i]->stream_res.audio_output.crtc_info, + &pipes[i]->stream->audio_info, +- &audio_output[i].dp_link_info); ++ &pipes[i]->stream_res.audio_output.dp_link_info); + + if (link->dc->config.disable_hbr_audio_dp2 && + pipes[i]->stream_res.audio->funcs->az_disable_hbr_audio && +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +index 3ed7f50554e21..ca17e5d8fdc2a 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +@@ -2239,8 +2239,7 @@ struct resource_pool *dcn31_create_resource_pool( + enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link, + struct dc_link_settings *link_setting, + uint8_t pipe_count, +- struct pipe_ctx *pipes, +- struct audio_output *audio_output) ++ struct pipe_ctx *pipes) + { + struct dc_state *state = link->dc->current_state; + int i; +@@ -2255,7 +2254,7 @@ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link, + + // Setup audio + if (pipes[i].stream_res.audio != NULL) +- build_audio_output(state, &pipes[i], &audio_output[i]); ++ build_audio_output(state, &pipes[i], &pipes[i].stream_res.audio_output); + } + #else + /* This DCN requires rate divider updates and audio reprogramming to allow DP1<-->DP2 link rate switching, +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h +index c32c85ef0ba47..7e8fde65528f1 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h +@@ -69,8 +69,7 @@ unsigned int dcn31_get_det_buffer_size( + enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link, + struct dc_link_settings *link_setting, + uint8_t pipe_count, +- struct pipe_ctx *pipes, +- struct audio_output *audio_output); ++ struct pipe_ctx *pipes); + + /*temp: B0 specific before switch to dcn313 headers*/ + #ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.17/drm-amd-display-remove-redundant-semicolons.patch new file mode 100644 index 0000000000..f5adf9a766 --- /dev/null +++ b/queue-6.17/drm-amd-display-remove-redundant-semicolons.patch @@ -0,0 +1,34 @@ +From e7c1176ea3a7cabcc9f1cd9b7407f85491caf171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:50:14 +0800 +Subject: drm/amd/display: Remove redundant semicolons + +From: Liao Yuanhong + +[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ] + +Remove unnecessary semicolons. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Liao Yuanhong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4..6c75aa82327ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.17/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch new file mode 100644 index 0000000000..c09a17bec8 --- /dev/null +++ b/queue-6.17/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch @@ -0,0 +1,57 @@ +From 8311ae80cd5ea70aa337a148ee59038a0d38fa76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:07 +0200 +Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ] + +Based on some comments in dm_pp_display_configuration +above the crtc_index and line_time fields, these values +are programmed to the SMC to work around an SMC hang +when it switches MCLK. + +According to Alex, the Windows driver programs them to: +mclk_change_block_cp_min = 200 / line_time +mclk_change_block_cp_max = 100 / line_time +Let's use the same for the sake of consistency. + +Previously we used the watermark values, but it seemed buggy +as the code was mixing up low/high and A/B watermarks, and +was not saving a low watermark value on DCE 6, so +mclk_change_block_cp_max would be always zero previously. + +Split this change off from the previous si_upload_smc_data +to make it easier to bisect, in case it causes any issues. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 6736c592dfdc6..fb008c5980d67 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + crtc_index = amdgpu_crtc->crtc_id; + + if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; + } + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.17/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch new file mode 100644 index 0000000000..6b54bd0dd9 --- /dev/null +++ b/queue-6.17/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch @@ -0,0 +1,48 @@ +From 6fe3b62b4130ee8bd556df7e0bfbfbbd95ef9c79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:09 +0200 +Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ] + +According to pp_pm_compute_clocks the non-DC display code +has "issues with mclk switching with refresh rates over 120 hz". +The workaround is to disable MCLK switching in this case. + +Do the same for legacy DPM. + +Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c..2d2d2d5e67634 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.17/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch new file mode 100644 index 0000000000..95977cb792 --- /dev/null +++ b/queue-6.17/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch @@ -0,0 +1,99 @@ +From 27c780ca8b8a4aea58860c954c8c3fbc6babe822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:10 +0200 +Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks + (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ] + +Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk +switching on Oland when two 4K 60Hz monitors are connected") + +This is an ad-hoc DPM fix, necessary because we don't have +proper bandwidth calculation for DCE 6. + +We define "high pixelclock" for SI as higher than necessary +for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into +this category. + +When two high pixel clock displays are connected to Oland, +additionally disable shader clock switching, which results in +a higher voltage, thereby addressing some visible flickering. + +v2: +Add more comments. +v3: +Split into two commits for easier review. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index c11c4cc111df5..4236700fc1ad1 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.17/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch new file mode 100644 index 0000000000..0ad4f0ab82 --- /dev/null +++ b/queue-6.17/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch @@ -0,0 +1,53 @@ +From 93c5e796d35c532ed159cba3e8773b09a48b5bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:04 +0200 +Subject: drm/amd/pm: Disable ULV even if unsupported (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ] + +Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode +is unsupported, to make sure it is properly turned off. + +v3: +Simplify si_disable_ulv further. +Always check the return value of amdgpu_si_send_msg_to_smc. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 52e732be59e36..e71070a23b915 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; ++ PPSMC_Result r; + +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; +- +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.17/drm-amd-pm-fix-si_upload_smc_data-v3.patch new file mode 100644 index 0000000000..1dd2dae5d7 --- /dev/null +++ b/queue-6.17/drm-amd-pm-fix-si_upload_smc_data-v3.patch @@ -0,0 +1,106 @@ +From f1c71135d38990efecc3e5a9b29c05c7ebe0783a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:06 +0200 +Subject: drm/amd/pm: Fix si_upload_smc_data (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ] + +The si_upload_smc_data function uses si_write_smc_soft_register +to set some register values in the SMC, and expects the result +to be PPSMC_Result_OK which is 1. + +The PPSMC_Result_OK / PPSMC_Result_Failed values are used for +checking the result of a command sent to the SMC. +However, the si_write_smc_soft_register actually doesn't send +any commands to the SMC and returns zero on success, +so this check was incorrect. + +Fix that by not checking the return value, just like other +calls to si_write_smc_soft_register. + +v3: +Additionally, when no display is plugged in, there is no need +to restrict MCLK switching, so program the registers to zero. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++---------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index e71070a23b915..6736c592dfdc6 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.17/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch new file mode 100644 index 0000000000..17ff643690 --- /dev/null +++ b/queue-6.17/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch @@ -0,0 +1,53 @@ +From b6afb4db4582d325de784bb1b4a47c3da680ca4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:08 +0200 +Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ] + +Some parts of the code base expect that MCLK switching is turned +off when the vblank time is set to zero. + +According to pp_pm_compute_clocks the non-DC code has issues +with MCLK switching with refresh rates over 120 Hz. + +v3: +Add code comment to explain this better. +Add an if statement instead of changing the switch_limit. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index fb008c5980d67..c11c4cc111df5 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-check-vcn-state-before-profile-switch.patch b/queue-6.17/drm-amdgpu-check-vcn-state-before-profile-switch.patch new file mode 100644 index 0000000000..c54fb130c0 --- /dev/null +++ b/queue-6.17/drm-amdgpu-check-vcn-state-before-profile-switch.patch @@ -0,0 +1,238 @@ +From bbd90d289cc3b4b8e3c0bfe4f19fa3278b4fbd67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 13:52:50 +0530 +Subject: drm/amdgpu: Check vcn state before profile switch + +From: Lijo Lazar + +[ Upstream commit 9c0442286f84a5036958b3d8eb00bf0bb070dbd1 ] + +The patch uses power state of VCN instances for requesting video +profile. + +In idle worker of a vcn instance, when there is no outstanding +submisssion or fence, the instance is put to power gated state. When +all instances are powered off that means video profile is no longer +required. A request is made to turn off video profile. + +A job submission starts with begin_use of ring, and at that time +vcn instance state is changed to power on. Subsequently a check is +made for active video profile, and if not active, a request is made. + +Fixes: 3b669df92c85 ("drm/amdgpu/vcn: adjust workload profile handling") +Signed-off-by: Lijo Lazar +Reviewed-by: Sathishkumar S +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 80 ++++++++++++++++--------- + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 3 + + drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 27 +-------- + 3 files changed, 56 insertions(+), 54 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +index e965b624efdb1..e5e40d10bb14b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +@@ -410,6 +410,54 @@ int amdgpu_vcn_resume(struct amdgpu_device *adev, int i) + return 0; + } + ++void amdgpu_vcn_get_profile(struct amdgpu_device *adev) ++{ ++ int r; ++ ++ mutex_lock(&adev->vcn.workload_profile_mutex); ++ ++ if (adev->vcn.workload_profile_active) { ++ mutex_unlock(&adev->vcn.workload_profile_mutex); ++ return; ++ } ++ r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, ++ true); ++ if (r) ++ dev_warn(adev->dev, ++ "(%d) failed to enable video power profile mode\n", r); ++ else ++ adev->vcn.workload_profile_active = true; ++ mutex_unlock(&adev->vcn.workload_profile_mutex); ++} ++ ++void amdgpu_vcn_put_profile(struct amdgpu_device *adev) ++{ ++ bool pg = true; ++ int r, i; ++ ++ mutex_lock(&adev->vcn.workload_profile_mutex); ++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) { ++ if (adev->vcn.inst[i].cur_state != AMD_PG_STATE_GATE) { ++ pg = false; ++ break; ++ } ++ } ++ ++ if (pg) { ++ r = amdgpu_dpm_switch_power_profile( ++ adev, PP_SMC_POWER_PROFILE_VIDEO, false); ++ if (r) ++ dev_warn( ++ adev->dev, ++ "(%d) failed to disable video power profile mode\n", ++ r); ++ else ++ adev->vcn.workload_profile_active = false; ++ } ++ ++ mutex_unlock(&adev->vcn.workload_profile_mutex); ++} ++ + static void amdgpu_vcn_idle_work_handler(struct work_struct *work) + { + struct amdgpu_vcn_inst *vcn_inst = +@@ -417,7 +465,6 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work) + struct amdgpu_device *adev = vcn_inst->adev; + unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0}; + unsigned int i = vcn_inst->inst, j; +- int r = 0; + + if (adev->vcn.harvest_config & (1 << i)) + return; +@@ -446,15 +493,8 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work) + mutex_lock(&vcn_inst->vcn_pg_lock); + vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE); + mutex_unlock(&vcn_inst->vcn_pg_lock); +- mutex_lock(&adev->vcn.workload_profile_mutex); +- if (adev->vcn.workload_profile_active) { +- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, +- false); +- if (r) +- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r); +- adev->vcn.workload_profile_active = false; +- } +- mutex_unlock(&adev->vcn.workload_profile_mutex); ++ amdgpu_vcn_put_profile(adev); ++ + } else { + schedule_delayed_work(&vcn_inst->idle_work, VCN_IDLE_TIMEOUT); + } +@@ -464,30 +504,11 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring) + { + struct amdgpu_device *adev = ring->adev; + struct amdgpu_vcn_inst *vcn_inst = &adev->vcn.inst[ring->me]; +- int r = 0; + + atomic_inc(&vcn_inst->total_submission_cnt); + + cancel_delayed_work_sync(&vcn_inst->idle_work); + +- /* We can safely return early here because we've cancelled the +- * the delayed work so there is no one else to set it to false +- * and we don't care if someone else sets it to true. +- */ +- if (adev->vcn.workload_profile_active) +- goto pg_lock; +- +- mutex_lock(&adev->vcn.workload_profile_mutex); +- if (!adev->vcn.workload_profile_active) { +- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, +- true); +- if (r) +- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r); +- adev->vcn.workload_profile_active = true; +- } +- mutex_unlock(&adev->vcn.workload_profile_mutex); +- +-pg_lock: + mutex_lock(&vcn_inst->vcn_pg_lock); + vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_UNGATE); + +@@ -515,6 +536,7 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring) + vcn_inst->pause_dpg_mode(vcn_inst, &new_state); + } + mutex_unlock(&vcn_inst->vcn_pg_lock); ++ amdgpu_vcn_get_profile(adev); + } + + void amdgpu_vcn_ring_end_use(struct amdgpu_ring *ring) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +index b3fb1d0e43fc9..6d9acd36041d0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +@@ -565,4 +565,7 @@ int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev, + const struct amdgpu_hwip_reg_entry *reg, u32 count); + void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block); + void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p); ++void amdgpu_vcn_get_profile(struct amdgpu_device *adev); ++void amdgpu_vcn_put_profile(struct amdgpu_device *adev); ++ + #endif +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +index bc30a5326866c..f13ed3c1e29c2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +@@ -116,7 +116,6 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work) + struct amdgpu_device *adev = vcn_inst->adev; + unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0}; + unsigned int i, j; +- int r = 0; + + for (i = 0; i < adev->vcn.num_vcn_inst; ++i) { + struct amdgpu_vcn_inst *v = &adev->vcn.inst[i]; +@@ -149,15 +148,7 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work) + if (!fences && !atomic_read(&adev->vcn.inst[0].total_submission_cnt)) { + amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN, + AMD_PG_STATE_GATE); +- mutex_lock(&adev->vcn.workload_profile_mutex); +- if (adev->vcn.workload_profile_active) { +- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, +- false); +- if (r) +- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r); +- adev->vcn.workload_profile_active = false; +- } +- mutex_unlock(&adev->vcn.workload_profile_mutex); ++ amdgpu_vcn_put_profile(adev); + } else { + schedule_delayed_work(&adev->vcn.inst[0].idle_work, VCN_IDLE_TIMEOUT); + } +@@ -167,7 +158,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring) + { + struct amdgpu_device *adev = ring->adev; + struct amdgpu_vcn_inst *v = &adev->vcn.inst[ring->me]; +- int r = 0; + + atomic_inc(&adev->vcn.inst[0].total_submission_cnt); + +@@ -177,20 +167,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring) + * the delayed work so there is no one else to set it to false + * and we don't care if someone else sets it to true. + */ +- if (adev->vcn.workload_profile_active) +- goto pg_lock; +- +- mutex_lock(&adev->vcn.workload_profile_mutex); +- if (!adev->vcn.workload_profile_active) { +- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, +- true); +- if (r) +- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r); +- adev->vcn.workload_profile_active = true; +- } +- mutex_unlock(&adev->vcn.workload_profile_mutex); +- +-pg_lock: + mutex_lock(&adev->vcn.inst[0].vcn_pg_lock); + amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN, + AMD_PG_STATE_UNGATE); +@@ -218,6 +194,7 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring) + v->pause_dpg_mode(v, &new_state); + } + mutex_unlock(&adev->vcn.inst[0].vcn_pg_lock); ++ amdgpu_vcn_get_profile(adev); + } + + static void vcn_v2_5_ring_end_use(struct amdgpu_ring *ring) +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch b/queue-6.17/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch new file mode 100644 index 0000000000..ed33ec1659 --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch @@ -0,0 +1,100 @@ +From 2dfdb47c318e966248d2c16e009a38da2563da6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:49:35 +0200 +Subject: drm/amdgpu: Fix allocating extra dwords for rings (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ] + +Rename extra_dw to extra_bytes and document what it's for. + +The value is already used as if it were bytes in vcn_v4_0.c +and in amdgpu_ring_init. Just adjust the dword count in +jpeg_v1_0.c so that it becomes a byte count. + +v2: +Rename extra_dw to extra_bytes as discussed during review. + +Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring") +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++- + drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c | 2 +- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 2 +- + 4 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index 486c3646710cc..8f6ce948c6841 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -364,7 +364,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring, + + /* Allocate ring buffer */ + if (ring->ring_obj == NULL) { +- r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE, ++ r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes, ++ PAGE_SIZE, + AMDGPU_GEM_DOMAIN_GTT, + &ring->ring_obj, + &ring->gpu_addr, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +index 7670f5d82b9e4..12783ea3ba0f1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +@@ -211,7 +211,18 @@ struct amdgpu_ring_funcs { + bool support_64bit_ptrs; + bool no_user_fence; + bool secure_submission_supported; +- unsigned extra_dw; ++ ++ /** ++ * @extra_bytes: ++ * ++ * Optional extra space in bytes that is added to the ring size ++ * when allocating the BO that holds the contents of the ring. ++ * This space isn't used for command submission to the ring, ++ * but is just there to satisfy some hardware requirements or ++ * implement workarounds. It's up to the implementation of each ++ * specific ring to initialize this space. ++ */ ++ unsigned extra_bytes; + + /* ring read/write ptr handling */ + u64 (*get_rptr)(struct amdgpu_ring *ring); +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c +index 9e428e669ada6..b5bb7f4d607c1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c +@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = { + .nop = PACKET0(0x81ff, 0), + .support_64bit_ptrs = false, + .no_user_fence = true, +- .extra_dw = 64, ++ .extra_bytes = 256, + .get_rptr = jpeg_v1_0_decode_ring_get_rptr, + .get_wptr = jpeg_v1_0_decode_ring_get_wptr, + .set_wptr = jpeg_v1_0_decode_ring_set_wptr, +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +index 706f3b2f484f7..ac55549e20be6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = { + .type = AMDGPU_RING_TYPE_VCN_ENC, + .align_mask = 0x3f, + .nop = VCN_ENC_CMD_NO_OP, +- .extra_dw = sizeof(struct amdgpu_vcn_rb_metadata), ++ .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata), + .get_rptr = vcn_v4_0_unified_ring_get_rptr, + .get_wptr = vcn_v4_0_unified_ring_get_wptr, + .set_wptr = vcn_v4_0_unified_ring_set_wptr, +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch b/queue-6.17/drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch new file mode 100644 index 0000000000..ee7a482b70 --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch @@ -0,0 +1,39 @@ +From ffb35d618348b4d11ff5919c8982217e136a825d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 15:20:55 +0800 +Subject: drm/amdgpu: fix incorrect vm flags to map bo + +From: Jack Xiao + +[ Upstream commit b08425fa77ad2f305fe57a33dceb456be03b653f ] + +It should use vm flags instead of pte flags +to specify bo vm attributes. + +Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file") +Signed-off-by: Jack Xiao +Reviewed-by: Likun Gao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +index 02138aa557935..dfb6cfd837606 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, + } + + r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size, +- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE | +- AMDGPU_PTE_EXECUTABLE); ++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE | ++ AMDGPU_VM_PAGE_EXECUTABLE); + + if (r) { + DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r); +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch b/queue-6.17/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch new file mode 100644 index 0000000000..0ca9484723 --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch @@ -0,0 +1,58 @@ +From 9f3d2ef17612d723f5ca1e37838920419fb1d554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:28:26 +0800 +Subject: drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest + +From: Xiang Liu + +[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ] + +Sriov guest side doesn't init ras feature hence the poison irq shouldn't +be put during hw fini. + +[25209.467154] Call Trace: +[25209.467156] +[25209.467158] ? srso_alias_return_thunk+0x5/0x7f +[25209.467162] ? show_trace_log_lvl+0x28e/0x2ea +[25209.467166] ? show_trace_log_lvl+0x28e/0x2ea +[25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] +[25209.467300] ? show_regs.part.0+0x23/0x29 +[25209.467303] ? show_regs.cold+0x8/0xd +[25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467403] ? __warn+0x8c/0x100 +[25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467503] ? report_bug+0xa4/0xd0 +[25209.467508] ? handle_bug+0x39/0x90 +[25209.467511] ? exc_invalid_op+0x19/0x70 +[25209.467513] ? asm_exc_invalid_op+0x1b/0x20 +[25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu] +[25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu] +[25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] +[25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] + +Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq") +Signed-off-by: Xiang Liu +Reviewed-by: Stanley.Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +index b86288a69e7b7..a78144773fabb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +@@ -444,7 +444,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block) + ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE); + } + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG)) ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev)) + amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0); + + return ret; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-link-error-for-pm_sleep.patch b/queue-6.17/drm-amdgpu-fix-link-error-for-pm_sleep.patch new file mode 100644 index 0000000000..205d7fce8f --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-link-error-for-pm_sleep.patch @@ -0,0 +1,70 @@ +From 40c28076ab47b5cec131dbd90ebbdedd4a1dee3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jul 2025 10:16:25 +0200 +Subject: drm/amdgpu: fix link error for !PM_SLEEP + +From: Arnd Bergmann + +[ Upstream commit 4d22db6d070ed3934f02ed15391283f6feb258ad ] + +When power management is not enabled in the kernel build, the newly +added hibernation changes cause a link failure: + +arm-linux-gnueabi-ld: drivers/gpu/drm/amd/amdgpu/amdgpu_drv.o: in function `amdgpu_pmops_thaw': +amdgpu_drv.c:(.text+0x1514): undefined reference to `pm_hibernate_is_recovering' + +Make the power management code in this driver conditional on +CONFIG_PM and CONFIG_PM_SLEEP + +Fixes: 530694f54dd5 ("drm/amdgpu: do not resume device in thaw for normal hibernation") +Signed-off-by: Arnd Bergmann +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250714081635.4071570-1-arnd@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 395c6be901ce7..dbbb3407fa13b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2964,15 +2964,15 @@ long amdgpu_drm_ioctl(struct file *filp, + } + + static const struct dev_pm_ops amdgpu_pm_ops = { +- .prepare = amdgpu_pmops_prepare, +- .complete = amdgpu_pmops_complete, +- .suspend = amdgpu_pmops_suspend, +- .suspend_noirq = amdgpu_pmops_suspend_noirq, +- .resume = amdgpu_pmops_resume, +- .freeze = amdgpu_pmops_freeze, +- .thaw = amdgpu_pmops_thaw, +- .poweroff = amdgpu_pmops_poweroff, +- .restore = amdgpu_pmops_restore, ++ .prepare = pm_sleep_ptr(amdgpu_pmops_prepare), ++ .complete = pm_sleep_ptr(amdgpu_pmops_complete), ++ .suspend = pm_sleep_ptr(amdgpu_pmops_suspend), ++ .suspend_noirq = pm_sleep_ptr(amdgpu_pmops_suspend_noirq), ++ .resume = pm_sleep_ptr(amdgpu_pmops_resume), ++ .freeze = pm_sleep_ptr(amdgpu_pmops_freeze), ++ .thaw = pm_sleep_ptr(amdgpu_pmops_thaw), ++ .poweroff = pm_sleep_ptr(amdgpu_pmops_poweroff), ++ .restore = pm_sleep_ptr(amdgpu_pmops_restore), + .runtime_suspend = amdgpu_pmops_runtime_suspend, + .runtime_resume = amdgpu_pmops_runtime_resume, + .runtime_idle = amdgpu_pmops_runtime_idle, +@@ -3117,7 +3117,7 @@ static struct pci_driver amdgpu_kms_pci_driver = { + .probe = amdgpu_pci_probe, + .remove = amdgpu_pci_remove, + .shutdown = amdgpu_pci_shutdown, +- .driver.pm = &amdgpu_pm_ops, ++ .driver.pm = pm_ptr(&amdgpu_pm_ops), + .err_handler = &amdgpu_pci_err_handler, + .dev_groups = amdgpu_sysfs_groups, + }; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch b/queue-6.17/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch new file mode 100644 index 0000000000..71733d6028 --- /dev/null +++ b/queue-6.17/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch @@ -0,0 +1,57 @@ +From ed1dfcc06276f5e859c2d91bf3f52e32faa86001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:54:50 +0800 +Subject: drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest + +From: Xiang Liu + +[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ] + +Sriov guest side doesn't init ras feature hence the poison irq shouldn't +be put during hw fini. + +[25209.468816] Call Trace: +[25209.468817] +[25209.468818] ? srso_alias_return_thunk+0x5/0x7f +[25209.468820] ? show_trace_log_lvl+0x28e/0x2ea +[25209.468822] ? show_trace_log_lvl+0x28e/0x2ea +[25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] +[25209.468936] ? show_regs.part.0+0x23/0x29 +[25209.468939] ? show_regs.cold+0x8/0xd +[25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469038] ? __warn+0x8c/0x100 +[25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469135] ? report_bug+0xa4/0xd0 +[25209.469138] ? handle_bug+0x39/0x90 +[25209.469140] ? exc_invalid_op+0x19/0x70 +[25209.469142] ? asm_exc_invalid_op+0x1b/0x20 +[25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu] +[25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu] +[25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu] +[25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu] + +Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq") +Signed-off-by: Xiang Liu +Reviewed-by: Stanley.Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +index 2a3663b551af9..52613205669e1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block) + vinst->set_pg_state(vinst, AMD_PG_STATE_GATE); + } + +- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN)) ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev)) + amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0); + + return 0; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.17/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..3a5201fdc2 --- /dev/null +++ b/queue-6.17/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From 88dbca0bc9ee7e76d26d8e34b36a4e26abc0f913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 5dbaebb592b30..2e79a3afc7748 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @ip_block: Pointer to the amdgpu_ip_block for this hw instance. + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + { +@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-vcn-add-regdump-helper-functions.patch b/queue-6.17/drm-amdgpu-vcn-add-regdump-helper-functions.patch new file mode 100644 index 0000000000..7247121f86 --- /dev/null +++ b/queue-6.17/drm-amdgpu-vcn-add-regdump-helper-functions.patch @@ -0,0 +1,165 @@ +From fbd1324830ace453a6115f2dd0eb606dad75d332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 11:30:52 +0530 +Subject: drm/amdgpu/vcn: Add regdump helper functions + +From: Sathishkumar S + +[ Upstream commit de55cbff5ce93c316b0113535752e43079761f2c ] + +Add generic helper functions for vcn devcoredump support +which can be re-used for all vcn versions. + +Signed-off-by: Sathishkumar S +Acked-by: Leo Liu +Signed-off-by: Alex Deucher +Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 87 +++++++++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 8 +++ + 2 files changed, 95 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +index f1f67521c29ca..b497a67141384 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +@@ -92,6 +92,7 @@ MODULE_FIRMWARE(FIRMWARE_VCN5_0_0); + MODULE_FIRMWARE(FIRMWARE_VCN5_0_1); + + static void amdgpu_vcn_idle_work_handler(struct work_struct *work); ++static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev); + + int amdgpu_vcn_early_init(struct amdgpu_device *adev, int i) + { +@@ -285,6 +286,10 @@ int amdgpu_vcn_sw_fini(struct amdgpu_device *adev, int i) + amdgpu_ucode_release(&adev->vcn.inst[0].fw); + adev->vcn.inst[i].fw = NULL; + } ++ ++ if (adev->vcn.reg_list) ++ amdgpu_vcn_reg_dump_fini(adev); ++ + mutex_destroy(&adev->vcn.inst[i].vcn_pg_lock); + mutex_destroy(&adev->vcn.inst[i].vcn1_jpeg1_workaround); + +@@ -1527,3 +1532,85 @@ int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring, + + return amdgpu_vcn_reset_engine(adev, ring->me); + } ++ ++int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev, ++ const struct amdgpu_hwip_reg_entry *reg, u32 count) ++{ ++ adev->vcn.ip_dump = kcalloc(adev->vcn.num_vcn_inst * count, ++ sizeof(uint32_t), GFP_KERNEL); ++ if (!adev->vcn.ip_dump) ++ return -ENOMEM; ++ adev->vcn.reg_list = reg; ++ adev->vcn.reg_count = count; ++ ++ return 0; ++} ++ ++static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev) ++{ ++ kfree(adev->vcn.ip_dump); ++ adev->vcn.reg_list = NULL; ++ adev->vcn.reg_count = 0; ++} ++ ++void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block) ++{ ++ struct amdgpu_device *adev = ip_block->adev; ++ int i, j; ++ bool is_powered; ++ u32 inst_off; ++ ++ if (!adev->vcn.ip_dump) ++ return; ++ ++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) { ++ if (adev->vcn.harvest_config & (1 << i)) ++ continue; ++ ++ inst_off = i * adev->vcn.reg_count; ++ /* mmUVD_POWER_STATUS is always readable and is the first in reg_list */ ++ adev->vcn.ip_dump[inst_off] = ++ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[0], i)); ++ is_powered = (adev->vcn.ip_dump[inst_off] & ++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) != ++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF; ++ ++ if (is_powered) ++ for (j = 1; j < adev->vcn.reg_count; j++) ++ adev->vcn.ip_dump[inst_off + j] = ++ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[j], i)); ++ } ++} ++ ++void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p) ++{ ++ struct amdgpu_device *adev = ip_block->adev; ++ int i, j; ++ bool is_powered; ++ u32 inst_off; ++ ++ if (!adev->vcn.ip_dump) ++ return; ++ ++ drm_printf(p, "num_instances:%d\n", adev->vcn.num_vcn_inst); ++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) { ++ if (adev->vcn.harvest_config & (1 << i)) { ++ drm_printf(p, "\nHarvested Instance:VCN%d Skipping dump\n", i); ++ continue; ++ } ++ ++ inst_off = i * adev->vcn.reg_count; ++ is_powered = (adev->vcn.ip_dump[inst_off] & ++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) != ++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF; ++ ++ if (is_powered) { ++ drm_printf(p, "\nActive Instance:VCN%d\n", i); ++ for (j = 0; j < adev->vcn.reg_count; j++) ++ drm_printf(p, "%-50s \t 0x%08x\n", adev->vcn.reg_list[j].reg_name, ++ adev->vcn.ip_dump[inst_off + j]); ++ } else { ++ drm_printf(p, "\nInactive Instance:VCN%d\n", i); ++ } ++ } ++} +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +index 0bc0a94d7cf0f..b3fb1d0e43fc9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +@@ -237,6 +237,8 @@ + + #define AMDGPU_DRM_KEY_INJECT_WORKAROUND_VCNFW_ASD_HANDSHAKING 2 + ++struct amdgpu_hwip_reg_entry; ++ + enum amdgpu_vcn_caps { + AMDGPU_VCN_RRMT_ENABLED, + }; +@@ -362,6 +364,8 @@ struct amdgpu_vcn { + + bool workload_profile_active; + struct mutex workload_profile_mutex; ++ u32 reg_count; ++ const struct amdgpu_hwip_reg_entry *reg_list; + }; + + struct amdgpu_fw_shared_rb_ptrs_struct { +@@ -557,4 +561,8 @@ int vcn_set_powergating_state(struct amdgpu_ip_block *ip_block, + int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring, + unsigned int vmid, + struct amdgpu_fence *guilty_fence); ++int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev, ++ const struct amdgpu_hwip_reg_entry *reg, u32 count); ++void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block); ++void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p); + #endif +-- +2.51.0 + diff --git a/queue-6.17/drm-amdgpu-vcn-hold-pg_lock-before-vcn-power-off.patch b/queue-6.17/drm-amdgpu-vcn-hold-pg_lock-before-vcn-power-off.patch new file mode 100644 index 0000000000..8ae1cec96c --- /dev/null +++ b/queue-6.17/drm-amdgpu-vcn-hold-pg_lock-before-vcn-power-off.patch @@ -0,0 +1,38 @@ +From 624cc130002a879fb5d022ac877a871fe886660d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 21:35:10 +0530 +Subject: drm/amdgpu/vcn: Hold pg_lock before vcn power off + +From: Sathishkumar S + +[ Upstream commit 111821e4b5a3105c42c7c99f4abd4d8af9f64248 ] + +Acquire vcn_pg_lock before changes to vcn power state +and release it after power off in idle work handler. + +Signed-off-by: Sathishkumar S +Reviewed-by: Leo Liu +Signed-off-by: Alex Deucher +Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +index b497a67141384..e965b624efdb1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +@@ -443,7 +443,9 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work) + fences += fence[i]; + + if (!fences && !atomic_read(&vcn_inst->total_submission_cnt)) { ++ mutex_lock(&vcn_inst->vcn_pg_lock); + vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE); ++ mutex_unlock(&vcn_inst->vcn_pg_lock); + mutex_lock(&adev->vcn.workload_profile_mutex); + if (adev->vcn.workload_profile_active) { + r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO, +-- +2.51.0 + diff --git a/queue-6.17/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.17/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..7528c79633 --- /dev/null +++ b/queue-6.17/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From b2228170c9d3d8ba1ef2e65c87b6767ffb50c698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index a0f22ea6d15af..3d8b20828c068 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.17/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch b/queue-6.17/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch new file mode 100644 index 0000000000..758c05aa54 --- /dev/null +++ b/queue-6.17/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch @@ -0,0 +1,48 @@ +From 25eedef35ea593a899bb1a152adc203374875fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 13:05:07 +0300 +Subject: drm/bridge: cdns-dsi: Fix the _atomic_check() + +From: Aradhya Bhatia + +[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ] + +Use the "adjusted_mode" for the dsi configuration check, as that is the +more appropriate display_mode for validation, and later bridge enable. + +Also, fix the mode_valid_check parameter from false to true, as the dsi +configuration check is taking place during the check-phase, and the +crtc_* mode values are not expected to be populated yet. + +Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()") +Signed-off-by: Aradhya Bhatia +Reviewed-by: Tomi Valkeinen +Tested-by: Jayesh Choudhary +Reviewed-by: Devarsh Thakkar +Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +index a57ca8c3bdaea..695b6246b280f 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +@@ -997,10 +997,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge, + struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge); + struct cdns_dsi *dsi = input_to_dsi(input); + struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state); +- const struct drm_display_mode *mode = &crtc_state->mode; ++ const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode; + struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg; + +- return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false); ++ return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true); + } + + static struct drm_bridge_state * +-- +2.51.0 + diff --git a/queue-6.17/drm-bridge-it6505-select-regmap_i2c.patch b/queue-6.17/drm-bridge-it6505-select-regmap_i2c.patch new file mode 100644 index 0000000000..1b8de1e166 --- /dev/null +++ b/queue-6.17/drm-bridge-it6505-select-regmap_i2c.patch @@ -0,0 +1,39 @@ +From b452591ec6e4b8f271b3ce233eeced241c058c79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 16:58:25 -0700 +Subject: drm/bridge: it6505: select REGMAP_I2C + +From: Chia-I Wu + +[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ] + +Fix + + aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe': + ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c' + +Signed-off-by: Chia-I Wu +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reviewed-by: Chen-Yu Tsai +Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index b9e0ca85226a6..a6d6e62071a0e 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -122,6 +122,7 @@ config DRM_ITE_IT6505 + select EXTCON + select CRYPTO + select CRYPTO_HASH ++ select REGMAP_I2C + help + ITE IT6505 DisplayPort bridge chip driver. + +-- +2.51.0 + diff --git a/queue-6.17/drm-display-bridge-connector-correct-cec-bridge-poin.patch b/queue-6.17/drm-display-bridge-connector-correct-cec-bridge-poin.patch new file mode 100644 index 0000000000..2b8440ac09 --- /dev/null +++ b/queue-6.17/drm-display-bridge-connector-correct-cec-bridge-poin.patch @@ -0,0 +1,51 @@ +From 4ae8d6d905932e574e8026750ad17715f0e43ec7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jul 2025 13:58:13 +0300 +Subject: drm/display: bridge-connector: correct CEC bridge pointers in + drm_bridge_connector_init + +From: Dmitry Baryshkov + +[ Upstream commit 92e34a5241ddf4b084df20e6953275d16f156aa8 ] + +The bridge used in drm_bridge_connector_init() for CEC init does not +correctly point to the required HDMI CEC bridge, which can lead to +errors during CEC initialization. + +Fixes: 65a2575a68e4 ("drm/display: bridge-connector: hook in CEC notifier support") +Fixes: a74288c8ded7 ("drm/display: bridge-connector: handle CEC adapters") +Reported-by: Luca Ceresoli +Closes: http://lore.kernel.org/r/20250718164156.194702d9@booty/ +Reviewed-by: Luca Ceresoli +Link: https://lore.kernel.org/r/20250719-fix-cec-bridges-v1-1-a60b1333c87d@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_bridge_connector.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/display/drm_bridge_connector.c b/drivers/gpu/drm/display/drm_bridge_connector.c +index 5eb7e9bfe3611..8c915427d0538 100644 +--- a/drivers/gpu/drm/display/drm_bridge_connector.c ++++ b/drivers/gpu/drm/display/drm_bridge_connector.c +@@ -816,6 +816,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm, + + if (bridge_connector->bridge_hdmi_cec && + bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER) { ++ bridge = bridge_connector->bridge_hdmi_cec; ++ + ret = drmm_connector_hdmi_cec_notifier_register(connector, + NULL, + bridge->hdmi_cec_dev); +@@ -825,6 +827,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm, + + if (bridge_connector->bridge_hdmi_cec && + bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_ADAPTER) { ++ bridge = bridge_connector->bridge_hdmi_cec; ++ + ret = drmm_connector_hdmi_cec_register(connector, + &drm_bridge_connector_hdmi_cec_funcs, + bridge->hdmi_cec_adapter_name, +-- +2.51.0 + diff --git a/queue-6.17/drm-dp-drm_edp_backlight_set_level-do-not-always-sen.patch b/queue-6.17/drm-dp-drm_edp_backlight_set_level-do-not-always-sen.patch new file mode 100644 index 0000000000..c3ab02d65f --- /dev/null +++ b/queue-6.17/drm-dp-drm_edp_backlight_set_level-do-not-always-sen.patch @@ -0,0 +1,65 @@ +From 57f53906aa1c7ee002c171a2395ae45912128260 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 17:42:24 -0300 +Subject: drm/dp: drm_edp_backlight_set_level: do not always send 3-byte + commands + +From: Val Packett + +[ Upstream commit 4aa8961b1b9c7498550b41168a91cf1558133dd3 ] + +At least some panels using the LSB register are not happy with the +unconditional increase of the command buffer to 3 bytes. + +With the BOE NE14QDM in my Dell Latitude 7455, the recent patches for +luminance based brightness have introduced a regression: the brightness +range stopped being contiguous and became nonsensical (it probably was +interpreting the last 2 bytes of the buffer and not the first 2). + +Change from using a fixed sizeof() to a length variable that's only +set to 3 when luminance is used. Let's leave the default as 2 even for +the single-byte version, since that's how it worked before. + +Fixes: f2db78e37fe7 ("drm/dp: Modify drm_edp_backlight_set_level") +Signed-off-by: Val Packett +Tested-by: Abel Vesa +Reviewed-by: Suraj Kandpal +Link: https://lore.kernel.org/r/20250706204446.8918-1-val@packett.cool +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_helper.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c +index 1ecc3df7e3167..4aaeae4fa03c3 100644 +--- a/drivers/gpu/drm/display/drm_dp_helper.c ++++ b/drivers/gpu/drm/display/drm_dp_helper.c +@@ -3962,6 +3962,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac + int ret; + unsigned int offset = DP_EDP_BACKLIGHT_BRIGHTNESS_MSB; + u8 buf[3] = { 0 }; ++ size_t len = 2; + + /* The panel uses the PWM for controlling brightness levels */ + if (!(bl->aux_set || bl->luminance_set)) +@@ -3974,6 +3975,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac + buf[1] = (level & 0x00ff00) >> 8; + buf[2] = (level & 0xff0000) >> 16; + offset = DP_EDP_PANEL_TARGET_LUMINANCE_VALUE; ++ len = 3; + } else if (bl->lsb_reg_used) { + buf[0] = (level & 0xff00) >> 8; + buf[1] = (level & 0x00ff); +@@ -3981,7 +3983,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac + buf[0] = level; + } + +- ret = drm_dp_dpcd_write_data(aux, offset, buf, sizeof(buf)); ++ ret = drm_dp_dpcd_write_data(aux, offset, buf, len); + if (ret < 0) { + drm_err(aux->drm_dev, + "%s: Failed to write aux backlight level: %d\n", +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch b/queue-6.17/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch new file mode 100644 index 0000000000..7ce9a1c058 --- /dev/null +++ b/queue-6.17/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch @@ -0,0 +1,106 @@ +From 22f5e165fa6a30bd6895852531e10af058ea5abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 09:30:55 +0800 +Subject: drm/msm: Do not validate SSPP when it is not ready + +From: Jun Nie + +[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ] + +Current code will validate current plane and previous plane to +confirm they can share a SSPP with multi-rect mode. The SSPP +is already allocated for previous plane, while current plane +is not associated with any SSPP yet. Null pointer is referenced +when validating the SSPP of current plane. Skip SSPP validation +for current plane. + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +Mem abort info: + ESR = 0x0000000096000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault +Data abort info: + ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 +[0000000000000020] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +Modules linked in: +CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT +Tainted: [S]=CPU_OUT_OF_SPEC +Hardware name: SM8650 EV1 rev1 4slam 2et (DT) +pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) +pc : dpu_plane_is_multirect_capable+0x68/0x90 +lr : dpu_assign_plane_resources+0x288/0x410 +sp : ffff800093dcb770 +x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 +x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 +x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080 +x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff +x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200 +x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000 +x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950 +x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438 +x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000 +Call trace: + dpu_plane_is_multirect_capable+0x68/0x90 (P) + dpu_crtc_atomic_check+0x5bc/0x650 + drm_atomic_helper_check_planes+0x13c/0x220 + drm_atomic_helper_check+0x58/0xb8 + msm_atomic_check+0xd8/0xf0 + drm_atomic_check_only+0x4a8/0x968 + drm_atomic_commit+0x50/0xd8 + drm_atomic_helper_update_plane+0x140/0x188 + __setplane_atomic+0xfc/0x148 + drm_mode_setplane+0x164/0x378 + drm_ioctl_kernel+0xc0/0x140 + drm_ioctl+0x20c/0x500 + __arm64_sys_ioctl+0xbc/0xf8 + invoke_syscall+0x50/0x120 + el0_svc_common.constprop.0+0x48/0xf8 + do_el0_svc+0x28/0x40 + el0_svc+0x30/0xd0 + el0t_64_sync_handler+0x144/0x168 + el0t_64_sync+0x198/0x1a0 +Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1) +---[ end trace 0000000000000000 ]--- + +Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes") +Signed-off-by: Jun Nie +Patchwork: https://patchwork.freedesktop.org/patch/669224/ +Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index 6859e8ef6b055..f54cf0faa1c7c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -922,6 +922,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp, + if (MSM_FORMAT_IS_YUV(fmt)) + return false; + ++ if (!sspp) ++ return true; ++ + if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) && + !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features)) + return false; +@@ -1028,6 +1031,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate, + prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE) + return false; + ++ /* Do not validate SSPP of current plane when it is not ready */ + if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) || + !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt)) + return false; +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.17/drm-msm-dpu-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..bc33f308f4 --- /dev/null +++ b/queue-6.17/drm-msm-dpu-fix-incorrect-type-for-ret.patch @@ -0,0 +1,40 @@ +From 8ad9bef77a490b6a32f7c92132b3709601652df9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:20:45 +0800 +Subject: drm/msm/dpu: fix incorrect type for ret + +From: Qianfeng Rong + +[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ] + +Change 'ret' from unsigned long to int, as storing negative error codes +in an unsigned long makes it never equal to -ETIMEDOUT, causing logical +errors. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Qianfeng Rong +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/671100/ +Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 56a5b596554db..46f348972a975 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -446,7 +446,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-fix-bootup-splat-with-separate_gpu_drm-modpa.patch b/queue-6.17/drm-msm-fix-bootup-splat-with-separate_gpu_drm-modpa.patch new file mode 100644 index 0000000000..75705c28cb --- /dev/null +++ b/queue-6.17/drm-msm-fix-bootup-splat-with-separate_gpu_drm-modpa.patch @@ -0,0 +1,106 @@ +From 235b7a7cf13b463afbb39572c08c85bdfa4856e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 17:20:00 +0530 +Subject: drm/msm: Fix bootup splat with separate_gpu_drm modparam + +From: Akhil P Oommen + +[ Upstream commit f028bcafb6dfb4c2bb656cbff9e6a66222d3d3d7 ] + +The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses +drm_gem_obj.gpuva.list, which is not initialized when the drm driver +does not support DRIVER_GEM_GPUVA feature. Enable it for msm_kms +drm driver to fix the splat seen when msm.separate_gpu_drm=1 modparam +is set: + +[ 9.506020] Unable to handle kernel paging request at virtual address fffffffffffffff0 +[ 9.523160] Mem abort info: +[ 9.523161] ESR = 0x0000000096000006 +[ 9.523163] EC = 0x25: DABT (current EL), IL = 32 bits +[ 9.523165] SET = 0, FnV = 0 +[ 9.523166] EA = 0, S1PTW = 0 +[ 9.523167] FSC = 0x06: level 2 translation fault +[ 9.523169] Data abort info: +[ 9.523170] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 +[ 9.523171] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 9.523172] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 9.523174] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000ad370f000 +[ 9.523176] [fffffffffffffff0] pgd=0000000000000000, p4d=0000000ad4787403, pud=0000000ad4788403, pmd=0000000000000000 +[ 9.523184] Internal error: Oops: 0000000096000006 [#1] SMP +[ 9.592968] CPU: 9 UID: 0 PID: 448 Comm: (udev-worker) Not tainted 6.17.0-rc4-assorted-fix-00005-g0e9bb53a2282-dirty #3 PREEMPT +[ 9.592970] Hardware name: Qualcomm CRD, BIOS 6.0.240718.BOOT.MXF.2.4-00515-HAMOA-1 07/18/2024 +[ 9.592971] pstate: a1400005 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 9.592973] pc : lookup_vma+0x28/0xe0 [msm] +[ 9.592996] lr : get_vma_locked+0x2c/0x128 [msm] +[ 9.763632] sp : ffff800082dab460 +[ 9.763666] Call trace: +[ 9.763668] lookup_vma+0x28/0xe0 [msm] (P) +[ 9.763688] get_vma_locked+0x2c/0x128 [msm] +[ 9.763706] msm_gem_get_and_pin_iova_range+0x68/0x11c [msm] +[ 9.763723] msm_gem_get_and_pin_iova+0x18/0x24 [msm] +[ 9.763740] msm_fbdev_driver_fbdev_probe+0xd0/0x258 [msm] +[ 9.763760] __drm_fb_helper_initial_config_and_unlock+0x288/0x528 [drm_kms_helper] +[ 9.763771] drm_fb_helper_initial_config+0x44/0x54 [drm_kms_helper] +[ 9.763779] drm_fbdev_client_hotplug+0x84/0xd4 [drm_client_lib] +[ 9.763782] drm_client_register+0x58/0x9c [drm] +[ 9.763806] drm_fbdev_client_setup+0xe8/0xcf0 [drm_client_lib] +[ 9.763809] drm_client_setup+0xb4/0xd8 [drm_client_lib] +[ 9.763811] msm_drm_kms_post_init+0x2c/0x3c [msm] +[ 9.763830] msm_drm_init+0x1a8/0x22c [msm] +[ 9.763848] msm_drm_bind+0x30/0x3c [msm] +[ 9.919273] try_to_bring_up_aggregate_device+0x168/0x1d4 +[ 9.919283] __component_add+0xa4/0x170 +[ 9.919286] component_add+0x14/0x20 +[ 9.919288] msm_dp_display_probe_tail+0x4c/0xac [msm] +[ 9.919315] msm_dp_auxbus_done_probe+0x14/0x20 [msm] +[ 9.919335] dp_aux_ep_probe+0x4c/0xf0 [drm_dp_aux_bus] +[ 9.919341] really_probe+0xbc/0x298 +[ 9.919345] __driver_probe_device+0x78/0x12c +[ 9.919348] driver_probe_device+0x40/0x160 +[ 9.919350] __driver_attach+0x94/0x19c +[ 9.919353] bus_for_each_dev+0x74/0xd4 +[ 9.919355] driver_attach+0x24/0x30 +[ 9.919358] bus_add_driver+0xe4/0x208 +[ 9.919360] driver_register+0x60/0x128 +[ 9.919363] __dp_aux_dp_driver_register+0x24/0x30 [drm_dp_aux_bus] +[ 9.919365] atana33xc20_init+0x20/0x1000 [panel_samsung_atna33xc20] +[ 9.919370] do_one_initcall+0x6c/0x1b0 +[ 9.919374] do_init_module+0x58/0x234 +[ 9.919377] load_module+0x19cc/0x1bd4 +[ 9.919380] init_module_from_file+0x84/0xc4 +[ 9.919382] __arm64_sys_finit_module+0x1b8/0x2cc +[ 9.919384] invoke_syscall+0x48/0x110 +[ 9.919389] el0_svc_common.constprop.0+0xc8/0xe8 +[ 9.919393] do_el0_svc+0x20/0x2c +[ 9.919396] el0_svc+0x34/0xf0 +[ 9.919401] el0t_64_sync_handler+0xa0/0xe4 +[ 9.919403] el0t_64_sync+0x198/0x19c +[ 9.919407] Code: eb0000bf 54000480 d100a003 aa0303e2 (f8418c44) +[ 9.919410] ---[ end trace 0000000000000000 ]--- + +Fixes: 217ed15bd399 ("drm/msm: enable separate binding of GPU and display devices") +Signed-off-by: Akhil P Oommen +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/672257/ +Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-1-f3ec9baed513@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 9dcc7a596a11d..7e977fec41007 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -826,6 +826,7 @@ static const struct file_operations fops = { + + #define DRIVER_FEATURES_KMS ( \ + DRIVER_GEM | \ ++ DRIVER_GEM_GPUVA | \ + DRIVER_ATOMIC | \ + DRIVER_MODESET | \ + 0 ) +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-fix-missing-vm_bind-offset-range-validation.patch b/queue-6.17/drm-msm-fix-missing-vm_bind-offset-range-validation.patch new file mode 100644 index 0000000000..3083dd22da --- /dev/null +++ b/queue-6.17/drm-msm-fix-missing-vm_bind-offset-range-validation.patch @@ -0,0 +1,41 @@ +From 5c6a0a9acb8dfbabc0a6a2bf36cb5b242949ebd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 17:04:26 -0700 +Subject: drm/msm: Fix missing VM_BIND offset/range validation + +From: Rob Clark + +[ Upstream commit 3a3bef68a6c15d079646a964ebc4dc8bb0aedb06 ] + +We need to reject the MAP op if offset+range is larger than the BO size. + +Reported-by: Connor Abbott +Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") +Signed-off-by: Rob Clark +Tested-by: Connor Abbott +Patchwork: https://patchwork.freedesktop.org/patch/669781/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_gem_vma.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c +index 209154be5efcc..381a0853c05ba 100644 +--- a/drivers/gpu/drm/msm/msm_gem_vma.c ++++ b/drivers/gpu/drm/msm/msm_gem_vma.c +@@ -1080,6 +1080,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args + + op->obj = obj; + cnt++; ++ ++ if ((op->range + op->obj_offset) > obj->size) { ++ ret = UERR(EINVAL, dev, "invalid range: %016llx + %016llx > %016zx\n", ++ op->range, op->obj_offset, obj->size); ++ goto out_unlock; ++ } + } + + *nr_bos = cnt; +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-fix-obj-leak-in-vm_bind-error-path.patch b/queue-6.17/drm-msm-fix-obj-leak-in-vm_bind-error-path.patch new file mode 100644 index 0000000000..409c47e2bc --- /dev/null +++ b/queue-6.17/drm-msm-fix-obj-leak-in-vm_bind-error-path.patch @@ -0,0 +1,89 @@ +From 79076b360c8ecc96ff831f027a1d10f5865e9c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 17:04:25 -0700 +Subject: drm/msm: Fix obj leak in VM_BIND error path + +From: Rob Clark + +[ Upstream commit 278f8904434aa96055e793936b5977c010549e28 ] + +If we fail a handle-lookup part way thru, we need to drop the already +obtained obj references. + +Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") +Signed-off-by: Rob Clark +Tested-by: Connor Abbott +Patchwork: https://patchwork.freedesktop.org/patch/669784/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_gem_vma.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c +index 00d0f3b7ba327..209154be5efcc 100644 +--- a/drivers/gpu/drm/msm/msm_gem_vma.c ++++ b/drivers/gpu/drm/msm/msm_gem_vma.c +@@ -1023,6 +1023,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args + struct drm_device *dev = job->vm->drm; + int ret = 0; + int cnt = 0; ++ int i = -1; + + if (args->nr_ops == 1) { + /* Single op case, the op is inlined: */ +@@ -1056,11 +1057,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args + + spin_lock(&file->table_lock); + +- for (unsigned i = 0; i < args->nr_ops; i++) { ++ for (i = 0; i < args->nr_ops; i++) { ++ struct msm_vm_bind_op *op = &job->ops[i]; + struct drm_gem_object *obj; + +- if (!job->ops[i].handle) { +- job->ops[i].obj = NULL; ++ if (!op->handle) { ++ op->obj = NULL; + continue; + } + +@@ -1068,15 +1070,15 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args + * normally use drm_gem_object_lookup(), but for bulk lookup + * all under single table_lock just hit object_idr directly: + */ +- obj = idr_find(&file->object_idr, job->ops[i].handle); ++ obj = idr_find(&file->object_idr, op->handle); + if (!obj) { +- ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", job->ops[i].handle, i); ++ ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", op->handle, i); + goto out_unlock; + } + + drm_gem_object_get(obj); + +- job->ops[i].obj = obj; ++ op->obj = obj; + cnt++; + } + +@@ -1085,6 +1087,17 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args + out_unlock: + spin_unlock(&file->table_lock); + ++ if (ret) { ++ for (; i >= 0; i--) { ++ struct msm_vm_bind_op *op = &job->ops[i]; ++ ++ if (!op->obj) ++ continue; ++ ++ drm_gem_object_put(op->obj); ++ op->obj = NULL; ++ } ++ } + out: + return ret; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-mdp4-stop-supporting-no-iommu-configuration.patch b/queue-6.17/drm-msm-mdp4-stop-supporting-no-iommu-configuration.patch new file mode 100644 index 0000000000..7a6aa37b4b --- /dev/null +++ b/queue-6.17/drm-msm-mdp4-stop-supporting-no-iommu-configuration.patch @@ -0,0 +1,42 @@ +From c50400585a540f05c17e4396f46658d0ad1ac0fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 13:51:49 +0300 +Subject: drm/msm/mdp4: stop supporting no-IOMMU configuration + +From: Dmitry Baryshkov + +[ Upstream commit cc64568b522b64fb8f8c607da9eb4e2d9f72d0cf ] + +With the switch to GPUVM the msm driver no longer supports the no-IOMMU +configurations (even without the actual GPU). Return an error in case we +face the lack of the IOMMU for an MDP4 device. + +Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/672557/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +index 0952c7f18abdc..4d1ea9b261917 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +@@ -463,9 +463,9 @@ static int mdp4_kms_init(struct drm_device *dev) + ret = PTR_ERR(mmu); + goto fail; + } else if (!mmu) { +- DRM_DEV_INFO(dev->dev, "no iommu, fallback to phys " +- "contig buffers for scanout\n"); +- vm = NULL; ++ DRM_DEV_INFO(dev->dev, "no IOMMU, bailing out\n"); ++ ret = -ENODEV; ++ goto fail; + } else { + vm = msm_gem_vm_create(dev, mmu, "mdp4", + 0x1000, 0x100000000 - 0x1000, +-- +2.51.0 + diff --git a/queue-6.17/drm-msm-stop-supporting-no-iommu-configuration.patch b/queue-6.17/drm-msm-stop-supporting-no-iommu-configuration.patch new file mode 100644 index 0000000000..deb06d4fa7 --- /dev/null +++ b/queue-6.17/drm-msm-stop-supporting-no-iommu-configuration.patch @@ -0,0 +1,46 @@ +From 8294ef7856fd675e4b974f9539f8b06a4804d57b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 13:51:50 +0300 +Subject: drm/msm: stop supporting no-IOMMU configuration + +From: Dmitry Baryshkov + +[ Upstream commit c94fc6d35685587aa0cb9a8d7d7062c73ab04d89 ] + +With the switch to GPUVM the msm driver no longer supports the no-IOMMU +configurations (even without the actual GPU). Return an error in case we +face the lack of the IOMMU. + +Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/672559/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_kms.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c +index 56828d218e88a..4c4dcb095c4df 100644 +--- a/drivers/gpu/drm/msm/msm_kms.c ++++ b/drivers/gpu/drm/msm/msm_kms.c +@@ -195,14 +195,13 @@ struct drm_gpuvm *msm_kms_init_vm(struct drm_device *dev) + iommu_dev = mdp_dev; + else + iommu_dev = mdss_dev; +- + mmu = msm_iommu_disp_new(iommu_dev, 0); + if (IS_ERR(mmu)) + return ERR_CAST(mmu); + + if (!mmu) { +- drm_info(dev, "no IOMMU, fallback to phys contig buffers for scanout\n"); +- return NULL; ++ drm_info(dev, "no IOMMU, bailing out\n"); ++ return ERR_PTR(-ENODEV); + } + + vm = msm_gem_vm_create(dev, mmu, "mdp_kms", +-- +2.51.0 + diff --git a/queue-6.17/drm-panel-allow-powering-on-panel-follower-after-pan.patch b/queue-6.17/drm-panel-allow-powering-on-panel-follower-after-pan.patch new file mode 100644 index 0000000000..b3d1ebbbac --- /dev/null +++ b/queue-6.17/drm-panel-allow-powering-on-panel-follower-after-pan.patch @@ -0,0 +1,225 @@ +From e08bbe29315047a60e6fd1a72516a38019b90214 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 19:49:33 +0800 +Subject: drm/panel: Allow powering on panel follower after panel is enabled + +From: Pin-yen Lin + +[ Upstream commit 2eb22214c132374e11e681c44d7879c91f67f614 ] + +Some touch controllers have to be powered on after the panel's backlight +is enabled. To support these controllers, introduce .panel_enabled() and +.panel_disabling() to panel_follower_funcs and use them to power on the +device after the panel and its backlight are enabled. + +Signed-off-by: Pin-yen Lin +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250818115015.2909525-1-treapking@chromium.org +Stable-dep-of: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel.c | 73 +++++++++++++++++++++++++++++++------ + include/drm/drm_panel.h | 14 +++++++ + 2 files changed, 76 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c +index c8bb28dccdc1b..d1e6598ea3bc0 100644 +--- a/drivers/gpu/drm/drm_panel.c ++++ b/drivers/gpu/drm/drm_panel.c +@@ -134,6 +134,9 @@ void drm_panel_prepare(struct drm_panel *panel) + panel->prepared = true; + + list_for_each_entry(follower, &panel->followers, list) { ++ if (!follower->funcs->panel_prepared) ++ continue; ++ + ret = follower->funcs->panel_prepared(follower); + if (ret < 0) + dev_info(panel->dev, "%ps failed: %d\n", +@@ -179,6 +182,9 @@ void drm_panel_unprepare(struct drm_panel *panel) + mutex_lock(&panel->follower_lock); + + list_for_each_entry(follower, &panel->followers, list) { ++ if (!follower->funcs->panel_unpreparing) ++ continue; ++ + ret = follower->funcs->panel_unpreparing(follower); + if (ret < 0) + dev_info(panel->dev, "%ps failed: %d\n", +@@ -209,6 +215,7 @@ EXPORT_SYMBOL(drm_panel_unprepare); + */ + void drm_panel_enable(struct drm_panel *panel) + { ++ struct drm_panel_follower *follower; + int ret; + + if (!panel) +@@ -219,10 +226,12 @@ void drm_panel_enable(struct drm_panel *panel) + return; + } + ++ mutex_lock(&panel->follower_lock); ++ + if (panel->funcs && panel->funcs->enable) { + ret = panel->funcs->enable(panel); + if (ret < 0) +- return; ++ goto exit; + } + panel->enabled = true; + +@@ -230,6 +239,19 @@ void drm_panel_enable(struct drm_panel *panel) + if (ret < 0) + DRM_DEV_INFO(panel->dev, "failed to enable backlight: %d\n", + ret); ++ ++ list_for_each_entry(follower, &panel->followers, list) { ++ if (!follower->funcs->panel_enabled) ++ continue; ++ ++ ret = follower->funcs->panel_enabled(follower); ++ if (ret < 0) ++ dev_info(panel->dev, "%ps failed: %d\n", ++ follower->funcs->panel_enabled, ret); ++ } ++ ++exit: ++ mutex_unlock(&panel->follower_lock); + } + EXPORT_SYMBOL(drm_panel_enable); + +@@ -243,6 +265,7 @@ EXPORT_SYMBOL(drm_panel_enable); + */ + void drm_panel_disable(struct drm_panel *panel) + { ++ struct drm_panel_follower *follower; + int ret; + + if (!panel) +@@ -262,6 +285,18 @@ void drm_panel_disable(struct drm_panel *panel) + return; + } + ++ mutex_lock(&panel->follower_lock); ++ ++ list_for_each_entry(follower, &panel->followers, list) { ++ if (!follower->funcs->panel_disabling) ++ continue; ++ ++ ret = follower->funcs->panel_disabling(follower); ++ if (ret < 0) ++ dev_info(panel->dev, "%ps failed: %d\n", ++ follower->funcs->panel_disabling, ret); ++ } ++ + ret = backlight_disable(panel->backlight); + if (ret < 0) + DRM_DEV_INFO(panel->dev, "failed to disable backlight: %d\n", +@@ -270,9 +305,12 @@ void drm_panel_disable(struct drm_panel *panel) + if (panel->funcs && panel->funcs->disable) { + ret = panel->funcs->disable(panel); + if (ret < 0) +- return; ++ goto exit; + } + panel->enabled = false; ++ ++exit: ++ mutex_unlock(&panel->follower_lock); + } + EXPORT_SYMBOL(drm_panel_disable); + +@@ -539,13 +577,13 @@ EXPORT_SYMBOL(drm_is_panel_follower); + * @follower_dev: The 'struct device' for the follower. + * @follower: The panel follower descriptor for the follower. + * +- * A panel follower is called right after preparing the panel and right before +- * unpreparing the panel. It's primary intention is to power on an associated +- * touchscreen, though it could be used for any similar devices. Multiple +- * devices are allowed the follow the same panel. ++ * A panel follower is called right after preparing/enabling the panel and right ++ * before unpreparing/disabling the panel. It's primary intention is to power on ++ * an associated touchscreen, though it could be used for any similar devices. ++ * Multiple devices are allowed the follow the same panel. + * +- * If a follower is added to a panel that's already been turned on, the +- * follower's prepare callback is called right away. ++ * If a follower is added to a panel that's already been prepared/enabled, the ++ * follower's prepared/enabled callback is called right away. + * + * The "panel" property of the follower points to the panel to be followed. + * +@@ -569,12 +607,18 @@ int drm_panel_add_follower(struct device *follower_dev, + mutex_lock(&panel->follower_lock); + + list_add_tail(&follower->list, &panel->followers); +- if (panel->prepared) { ++ if (panel->prepared && follower->funcs->panel_prepared) { + ret = follower->funcs->panel_prepared(follower); + if (ret < 0) + dev_info(panel->dev, "%ps failed: %d\n", + follower->funcs->panel_prepared, ret); + } ++ if (panel->enabled && follower->funcs->panel_enabled) { ++ ret = follower->funcs->panel_enabled(follower); ++ if (ret < 0) ++ dev_info(panel->dev, "%ps failed: %d\n", ++ follower->funcs->panel_enabled, ret); ++ } + + mutex_unlock(&panel->follower_lock); + +@@ -587,7 +631,8 @@ EXPORT_SYMBOL(drm_panel_add_follower); + * @follower: The panel follower descriptor for the follower. + * + * Undo drm_panel_add_follower(). This includes calling the follower's +- * unprepare function if we're removed from a panel that's currently prepared. ++ * unpreparing/disabling function if we're removed from a panel that's currently ++ * prepared/enabled. + * + * Return: 0 or an error code. + */ +@@ -598,7 +643,13 @@ void drm_panel_remove_follower(struct drm_panel_follower *follower) + + mutex_lock(&panel->follower_lock); + +- if (panel->prepared) { ++ if (panel->enabled && follower->funcs->panel_disabling) { ++ ret = follower->funcs->panel_disabling(follower); ++ if (ret < 0) ++ dev_info(panel->dev, "%ps failed: %d\n", ++ follower->funcs->panel_disabling, ret); ++ } ++ if (panel->prepared && follower->funcs->panel_unpreparing) { + ret = follower->funcs->panel_unpreparing(follower); + if (ret < 0) + dev_info(panel->dev, "%ps failed: %d\n", +diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h +index 843fb756a2950..2407bfa60236f 100644 +--- a/include/drm/drm_panel.h ++++ b/include/drm/drm_panel.h +@@ -160,6 +160,20 @@ struct drm_panel_follower_funcs { + * Called before the panel is powered off. + */ + int (*panel_unpreparing)(struct drm_panel_follower *follower); ++ ++ /** ++ * @panel_enabled: ++ * ++ * Called after the panel and the backlight have been enabled. ++ */ ++ int (*panel_enabled)(struct drm_panel_follower *follower); ++ ++ /** ++ * @panel_disabling: ++ * ++ * Called before the panel and the backlight are disabled. ++ */ ++ int (*panel_disabling)(struct drm_panel_follower *follower); + }; + + struct drm_panel_follower { +-- +2.51.0 + diff --git a/queue-6.17/drm-panel-edp-add-50ms-disable-delay-for-four-panels.patch b/queue-6.17/drm-panel-edp-add-50ms-disable-delay-for-four-panels.patch new file mode 100644 index 0000000000..eb2d29c176 --- /dev/null +++ b/queue-6.17/drm-panel-edp-add-50ms-disable-delay-for-four-panels.patch @@ -0,0 +1,76 @@ +From b3fdce942e683917bb0c1730b15f2ca8fc9db76e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 15:25:13 +0800 +Subject: drm/panel-edp: Add 50ms disable delay for four panels + +From: Langyan Ye + +[ Upstream commit 1511d3c4d2bb30f784924a877f3cef518bb73077 ] + +Add 50ms disable delay for NV116WHM-N49, NV122WUM-N41, and MNC207QS1-1 +to satisfy T9+T10 timing. Add 50ms disable delay for MNE007JA1-2 +as well, since MNE007JA1-2 copies the timing of MNC207QS1-1. + +Specifically, it should be noted that the MNE007JA1-2 panel was added +by someone who did not have the panel documentation, so they simply +copied the timing from the MNC207QS1-1 panel. Adding an extra 50 ms +of delay should be safe. + +Fixes: 0547692ac146 ("drm/panel-edp: Add several generic edp panels") +Fixes: 50625eab3972 ("drm/edp-panel: Add panel used by T14s Gen6 Snapdragon") +Signed-off-by: Langyan Ye +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250723072513.2880369-1-yelangyan@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 09170470b3ef1..d0aa602ecc9de 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1736,10 +1736,11 @@ static const struct panel_delay delay_200_500_e50 = { + .enable = 50, + }; + +-static const struct panel_delay delay_200_500_e50_p2e200 = { ++static const struct panel_delay delay_200_500_e50_d50_p2e200 = { + .hpd_absent = 200, + .unprepare = 500, + .enable = 50, ++ .disable = 50, + .prepare_to_enable = 200, + }; + +@@ -1941,13 +1942,13 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('B', 'O', 'E', 0x09dd, &delay_200_500_e50, "NT116WHM-N21"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a1b, &delay_200_500_e50, "NV133WUM-N63"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a36, &delay_200_500_e200, "Unknown"), +- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80, "NV116WHM-N49"), ++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80_d50, "NV116WHM-N49"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a5d, &delay_200_500_e50, "NV116WHM-N45"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ac5, &delay_200_500_e50, "NV116WHM-N4C"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ae8, &delay_200_500_e50_p2e80, "NV140WUM-N41"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b09, &delay_200_500_e50_po2e200, "NV140FHM-NZ"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b1e, &delay_200_500_e80, "NE140QDM-N6A"), +- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80, "NV122WUM-N41"), ++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80_d50, "NV122WUM-N41"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b43, &delay_200_500_e200, "NV140FHM-T09"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"), + EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"), +@@ -1986,8 +1987,8 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('C', 'M', 'N', 0x14e5, &delay_200_500_e80_d50, "N140HGA-EA1"), + EDP_PANEL_ENTRY('C', 'M', 'N', 0x162b, &delay_200_500_e80_d50, "N160JCE-ELL"), + +- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_p2e200, "MNC207QS1-1"), +- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_p2e200, "MNE007JA1-2"), ++ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_d50_p2e200, "MNC207QS1-1"), ++ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_d50_p2e200, "MNE007JA1-2"), + + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"), +-- +2.51.0 + diff --git a/queue-6.17/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch b/queue-6.17/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch new file mode 100644 index 0000000000..6cabce751c --- /dev/null +++ b/queue-6.17/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch @@ -0,0 +1,52 @@ +From df7f5ef70ba3c4377975f063b94f2b8cd9b76a37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 14:16:27 +0800 +Subject: drm/panel-edp: Add disable to 100ms for MNB601LS1-4 + +From: Langyan Ye + +[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ] + +For the MNB601LS1-4 panel, the T9+T10 timing does not meet the +requirements of the specification, so disable is set to 100ms. + +Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4") +Signed-off-by: Langyan Ye +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 9a56e208cbddb..09170470b3ef1 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = { + .powered_on_to_enable = 335, + }; + ++static const struct panel_delay delay_200_500_e50_d100 = { ++ .hpd_absent = 200, ++ .unprepare = 500, ++ .enable = 50, ++ .disable = 100, ++}; ++ + #define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \ + { \ + .ident = { \ +@@ -1984,7 +1991,7 @@ static const struct edp_panel_entry edp_panels[] = { + + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"), +- EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"), ++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"), + EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"), + +-- +2.51.0 + diff --git a/queue-6.17/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.17/drm-panel-novatek-nt35560-fix-invalid-return-value.patch new file mode 100644 index 0000000000..5914899034 --- /dev/null +++ b/queue-6.17/drm-panel-novatek-nt35560-fix-invalid-return-value.patch @@ -0,0 +1,42 @@ +From cb55aecb4c7db9f86ec77d0234341c25fe640997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 21:23:41 -0600 +Subject: drm/panel: novatek-nt35560: Fix invalid return value + +From: Brigham Campbell + +[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ] + +Fix bug in nt35560_set_brightness() which causes the function to +erroneously report an error. mipi_dsi_dcs_write() returns either a +negative value when an error occurred or a positive number of bytes +written when no error occurred. The buggy code reports an error under +either condition. + +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Reviewed-by: Douglas Anderson +Reviewed-by: Neil Armstrong +Signed-off-by: Brigham Campbell +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index 98f0782c84111..17898a29efe87 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.17/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.17/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..16fa26f2fc --- /dev/null +++ b/queue-6.17/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From f142e834f98075f893225df87170f59748c37bb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index ac77d1246b945..811265648a582 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-6.17/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch b/queue-6.17/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch new file mode 100644 index 0000000000..3c585ccfaa --- /dev/null +++ b/queue-6.17/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch @@ -0,0 +1,71 @@ +From d6e7aa4918c197a4dce5befcea75c93cde4acb60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:28:49 +0200 +Subject: drm: re-allow no-op changes on non-primary planes in async flips +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xaver Hugl + +[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ] + +Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to +async flip") unintentionally disallowed no-op changes on non-primary +planes that the driver doesn't allow async flips on. This broke async +flips for compositors that disable the cursor plane in every async +atomic commit. To fix that, change drm_atomic_set_property to again +only run atomic_async_check if the plane would actually be changed by +the atomic commit. + +Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263 +Signed-off-by: Xaver Hugl +Reviewed-by: André Almeida +Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org +[andrealmeid: fix checkpatch warning] +Signed-off-by: André Almeida +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c +index ecc73d52bfae4..85dbdaa4a2e25 100644 +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -1078,19 +1078,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state, + } + + if (async_flip) { +- /* check if the prop does a nop change */ +- if ((prop != config->prop_fb_id && +- prop != config->prop_in_fence_fd && +- prop != config->prop_fb_damage_clips)) { +- ret = drm_atomic_plane_get_property(plane, plane_state, +- prop, &old_val); +- ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop); +- } ++ /* no-op changes are always allowed */ ++ ret = drm_atomic_plane_get_property(plane, plane_state, ++ prop, &old_val); ++ ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop); + +- /* ask the driver if this non-primary plane is supported */ +- if (plane->type != DRM_PLANE_TYPE_PRIMARY) { +- ret = -EINVAL; ++ /* fail everything that isn't no-op or a pure flip */ ++ if (ret && prop != config->prop_fb_id && ++ prop != config->prop_in_fence_fd && ++ prop != config->prop_fb_damage_clips) { ++ break; ++ } + ++ if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) { ++ /* ask the driver if this non-primary plane is supported */ + if (plane_funcs && plane_funcs->atomic_async_check) + ret = plane_funcs->atomic_async_check(plane, state, true); + +-- +2.51.0 + diff --git a/queue-6.17/drm-sched-fix-a-race-in-drm_gpu_sched_stat_no_hang-t.patch b/queue-6.17/drm-sched-fix-a-race-in-drm_gpu_sched_stat_no_hang-t.patch new file mode 100644 index 0000000000..8dc4380e33 --- /dev/null +++ b/queue-6.17/drm-sched-fix-a-race-in-drm_gpu_sched_stat_no_hang-t.patch @@ -0,0 +1,86 @@ +From fdd4d83b9979767dbf1796a052c1335261533aba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jul 2025 09:48:17 +0100 +Subject: drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tvrtko Ursulin + +[ Upstream commit 2650bc4007c15e05f995f472b4fc89e793162bc4 ] + +The "skip reset" test waits for the timeout handler to run for the +duration of 2 * MOCK_TIMEOUT, and because the mock scheduler opted to +remove the "skip reset" flag once it fires, this gives opportunity for the +timeout handler to run twice. Second time the job will be removed from the +mock scheduler job list and the drm_mock_sched_advance() call in the test +will fail. + +Fix it by making the "don't reset" flag persist for the lifetime of the +job and add a new flag to verify that the code path had executed as +expected. + +Signed-off-by: Tvrtko Ursulin +Fixes: 1472e7549f84 ("drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG") +Cc: Maíra Canal +Cc: Philipp Stanner +Reviewed-by: Maíra Canal +Signed-off-by: Philipp Stanner +Link: https://lore.kernel.org/r/20250716084817.56797-1-tvrtko.ursulin@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 2 +- + drivers/gpu/drm/scheduler/tests/sched_tests.h | 7 ++++--- + drivers/gpu/drm/scheduler/tests/tests_basic.c | 4 ++-- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c +index 65acffc3fea82..8e9ae7d980eb2 100644 +--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c ++++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c +@@ -219,7 +219,7 @@ mock_sched_timedout_job(struct drm_sched_job *sched_job) + unsigned long flags; + + if (job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET) { +- job->flags &= ~DRM_MOCK_SCHED_JOB_DONT_RESET; ++ job->flags |= DRM_MOCK_SCHED_JOB_RESET_SKIPPED; + return DRM_GPU_SCHED_STAT_NO_HANG; + } + +diff --git a/drivers/gpu/drm/scheduler/tests/sched_tests.h b/drivers/gpu/drm/scheduler/tests/sched_tests.h +index 63d4f2ac70749..5b262126b7760 100644 +--- a/drivers/gpu/drm/scheduler/tests/sched_tests.h ++++ b/drivers/gpu/drm/scheduler/tests/sched_tests.h +@@ -95,9 +95,10 @@ struct drm_mock_sched_job { + + struct completion done; + +-#define DRM_MOCK_SCHED_JOB_DONE 0x1 +-#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2 +-#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4 ++#define DRM_MOCK_SCHED_JOB_DONE 0x1 ++#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2 ++#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4 ++#define DRM_MOCK_SCHED_JOB_RESET_SKIPPED 0x8 + unsigned long flags; + + struct list_head link; +diff --git a/drivers/gpu/drm/scheduler/tests/tests_basic.c b/drivers/gpu/drm/scheduler/tests/tests_basic.c +index 55eb142bd7c5d..82a41a456b0a8 100644 +--- a/drivers/gpu/drm/scheduler/tests/tests_basic.c ++++ b/drivers/gpu/drm/scheduler/tests/tests_basic.c +@@ -317,8 +317,8 @@ static void drm_sched_skip_reset(struct kunit *test) + KUNIT_ASSERT_FALSE(test, done); + + KUNIT_ASSERT_EQ(test, +- job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET, +- 0); ++ job->flags & DRM_MOCK_SCHED_JOB_RESET_SKIPPED, ++ DRM_MOCK_SCHED_JOB_RESET_SKIPPED); + + i = drm_mock_sched_advance(sched, 1); + KUNIT_ASSERT_EQ(test, i, 1); +-- +2.51.0 + diff --git a/queue-6.17/drm-vmwgfx-fix-missing-assignment-to-ts.patch b/queue-6.17/drm-vmwgfx-fix-missing-assignment-to-ts.patch new file mode 100644 index 0000000000..ee5b8e6e26 --- /dev/null +++ b/queue-6.17/drm-vmwgfx-fix-missing-assignment-to-ts.patch @@ -0,0 +1,38 @@ +From f994869234875773886741cdb004cdff55ee1835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jun 2025 23:35:26 +0100 +Subject: drm/vmwgfx: fix missing assignment to ts + +From: Colin Ian King + +[ Upstream commit 33f8f321e7aa7715ce19560801ee5223ba8b9a7d ] + +The assignment to ts is missing on the call to ktime_to_timespec64. +Fix this by adding the missing assignment. + +Fixes: db6a94b26354 ("drm/vmwgfx: Implement dma_fence_ops properly") +Signed-off-by: Colin Ian King +Reviewed-by: Ian Forbes +Signed-off-by: Zack Rusin +Link: https://lore.kernel.org/r/20250623223526.281398-1-colin.i.king@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +index c2294abbe7534..00be92da55097 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +@@ -538,7 +538,7 @@ static void vmw_event_fence_action_seq_passed(struct dma_fence *f, + if (likely(eaction->tv_sec != NULL)) { + struct timespec64 ts; + +- ktime_to_timespec64(f->timestamp); ++ ts = ktime_to_timespec64(f->timestamp); + /* monotonic time, so no y2038 overflow */ + *eaction->tv_sec = ts.tv_sec; + *eaction->tv_usec = ts.tv_nsec / NSEC_PER_USEC; +-- +2.51.0 + diff --git a/queue-6.17/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch b/queue-6.17/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch new file mode 100644 index 0000000000..8d66b83f5f --- /dev/null +++ b/queue-6.17/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch @@ -0,0 +1,238 @@ +From afa9985de0f8909bcf566ca515462335810c8d66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 17:21:33 -0500 +Subject: dt-bindings: vendor-prefixes: Add undocumented vendor prefixes + +From: Rob Herring (Arm) + +[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ] + +Add various vendor prefixes which are in use in compatible strings +already. These were found by modifying vendor-prefixes.yaml into a +schema to check compatible strings. + +The added prefixes doesn't include various duplicate prefixes in use +such as "lge". + +Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/vendor-prefixes.yaml | 50 +++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml +index 9ec8947dfcad2..ed7fec614473d 100644 +--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml ++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml +@@ -86,6 +86,8 @@ patternProperties: + description: Allegro DVT + "^allegromicro,.*": + description: Allegro MicroSystems, Inc. ++ "^alliedtelesis,.*": ++ description: Allied Telesis, Inc. + "^alliedvision,.*": + description: Allied Vision Technologies GmbH + "^allo,.*": +@@ -229,6 +231,8 @@ patternProperties: + description: Bitmain Technologies + "^blaize,.*": + description: Blaize, Inc. ++ "^bluegiga,.*": ++ description: Bluegiga Technologies Ltd. + "^blutek,.*": + description: BluTek Power + "^boe,.*": +@@ -247,6 +251,8 @@ patternProperties: + description: Bticino International + "^buffalo,.*": + description: Buffalo, Inc. ++ "^buglabs,.*": ++ description: Bug Labs, Inc. + "^bur,.*": + description: B&R Industrial Automation GmbH + "^bytedance,.*": +@@ -325,6 +331,8 @@ patternProperties: + description: Conexant Systems, Inc. + "^colorfly,.*": + description: Colorful GRP, Shenzhen Xueyushi Technology Ltd. ++ "^compal,.*": ++ description: Compal Electronics, Inc. + "^compulab,.*": + description: CompuLab Ltd. + "^comvetia,.*": +@@ -353,6 +361,8 @@ patternProperties: + description: Guangzhou China Star Optoelectronics Technology Co., Ltd + "^csq,.*": + description: Shenzen Chuangsiqi Technology Co.,Ltd. ++ "^csr,.*": ++ description: Cambridge Silicon Radio + "^ctera,.*": + description: CTERA Networks Intl. + "^ctu,.*": +@@ -455,6 +465,8 @@ patternProperties: + description: Emtop Embedded Solutions + "^eeti,.*": + description: eGalax_eMPIA Technology Inc ++ "^egnite,.*": ++ description: egnite GmbH + "^einfochips,.*": + description: Einfochips + "^eink,.*": +@@ -485,8 +497,12 @@ patternProperties: + description: Empire Electronix + "^emtrion,.*": + description: emtrion GmbH ++ "^enbw,.*": ++ description: Energie Baden-Württemberg AG + "^enclustra,.*": + description: Enclustra GmbH ++ "^endian,.*": ++ description: Endian SRL + "^endless,.*": + description: Endless Mobile, Inc. + "^ene,.*": +@@ -554,6 +570,8 @@ patternProperties: + description: FocalTech Systems Co.,Ltd + "^forlinx,.*": + description: Baoding Forlinx Embedded Technology Co., Ltd. ++ "^foxlink,.*": ++ description: Foxlink Group + "^freebox,.*": + description: Freebox SAS + "^freecom,.*": +@@ -642,6 +660,10 @@ patternProperties: + description: Haoyu Microelectronic Co. Ltd. + "^hardkernel,.*": + description: Hardkernel Co., Ltd ++ "^hce,.*": ++ description: HCE Engineering SRL ++ "^headacoustics,.*": ++ description: HEAD acoustics + "^hechuang,.*": + description: Shenzhen Hechuang Intelligent Co. + "^hideep,.*": +@@ -725,6 +747,8 @@ patternProperties: + description: Shenzhen INANBO Electronic Technology Co., Ltd. + "^incircuit,.*": + description: In-Circuit GmbH ++ "^incostartec,.*": ++ description: INCOstartec GmbH + "^indiedroid,.*": + description: Indiedroid + "^inet-tek,.*": +@@ -933,6 +957,8 @@ patternProperties: + description: Maxim Integrated Products + "^maxlinear,.*": + description: MaxLinear Inc. ++ "^maxtor,.*": ++ description: Maxtor Corporation + "^mbvl,.*": + description: Mobiveil Inc. + "^mcube,.*": +@@ -1096,6 +1122,8 @@ patternProperties: + description: Nordic Semiconductor + "^nothing,.*": + description: Nothing Technology Limited ++ "^novatech,.*": ++ description: NovaTech Automation + "^novatek,.*": + description: Novatek + "^novtech,.*": +@@ -1191,6 +1219,8 @@ patternProperties: + description: Pervasive Displays, Inc. + "^phicomm,.*": + description: PHICOMM Co., Ltd. ++ "^phontech,.*": ++ description: Phontech + "^phytec,.*": + description: PHYTEC Messtechnik GmbH + "^picochip,.*": +@@ -1275,6 +1305,8 @@ patternProperties: + description: Ramtron International + "^raspberrypi,.*": + description: Raspberry Pi Foundation ++ "^raumfeld,.*": ++ description: Raumfeld GmbH + "^raydium,.*": + description: Raydium Semiconductor Corp. + "^rda,.*": +@@ -1313,6 +1345,8 @@ patternProperties: + description: ROHM Semiconductor Co., Ltd + "^ronbo,.*": + description: Ronbo Electronics ++ "^ronetix,.*": ++ description: Ronetix GmbH + "^roofull,.*": + description: Shenzhen Roofull Technology Co, Ltd + "^roseapplepi,.*": +@@ -1339,8 +1373,12 @@ patternProperties: + description: Schindler + "^schneider,.*": + description: Schneider Electric ++ "^schulercontrol,.*": ++ description: Schuler Group + "^sciosense,.*": + description: ScioSense B.V. ++ "^sdmc,.*": ++ description: SDMC Technology Co., Ltd + "^seagate,.*": + description: Seagate Technology PLC + "^seeed,.*": +@@ -1379,6 +1417,8 @@ patternProperties: + description: Si-En Technology Ltd. + "^si-linux,.*": + description: Silicon Linux Corporation ++ "^sielaff,.*": ++ description: Sielaff GmbH & Co. + "^siemens,.*": + description: Siemens AG + "^sifive,.*": +@@ -1447,6 +1487,8 @@ patternProperties: + description: SolidRun + "^solomon,.*": + description: Solomon Systech Limited ++ "^somfy,.*": ++ description: Somfy Systems Inc. + "^sony,.*": + description: Sony Corporation + "^sophgo,.*": +@@ -1517,6 +1559,8 @@ patternProperties: + "^synopsys,.*": + description: Synopsys, Inc. (deprecated, use snps) + deprecated: true ++ "^taos,.*": ++ description: Texas Advanced Optoelectronic Solutions Inc. + "^tbs,.*": + description: TBS Technologies + "^tbs-biometrics,.*": +@@ -1547,6 +1591,8 @@ patternProperties: + description: Teltonika Networks + "^tempo,.*": + description: Tempo Semiconductor ++ "^tenda,.*": ++ description: Shenzhen Tenda Technology Co., Ltd. + "^terasic,.*": + description: Terasic Inc. + "^tesla,.*": +@@ -1650,6 +1696,8 @@ patternProperties: + description: V3 Semiconductor + "^vaisala,.*": + description: Vaisala ++ "^valve,.*": ++ description: Valve Corporation + "^vamrs,.*": + description: Vamrs Ltd. + "^variscite,.*": +@@ -1750,6 +1798,8 @@ patternProperties: + description: Extreme Engineering Solutions (X-ES) + "^xiaomi,.*": + description: Xiaomi Technology Co., Ltd. ++ "^xicor,.*": ++ description: Xicor Inc. + "^xillybus,.*": + description: Xillybus Ltd. + "^xingbangda,.*": +-- +2.51.0 + diff --git a/queue-6.17/dts-arm-amlogic-fix-pwm-node-for-c3.patch b/queue-6.17/dts-arm-amlogic-fix-pwm-node-for-c3.patch new file mode 100644 index 0000000000..9e5d3abe8c --- /dev/null +++ b/queue-6.17/dts-arm-amlogic-fix-pwm-node-for-c3.patch @@ -0,0 +1,37 @@ +From 4e158d638ca7ccaca3f85b152e59f4074e55cc90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 17:29:54 +0800 +Subject: dts: arm: amlogic: fix pwm node for c3 + +From: Xianwei Zhao + +[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ] + +Fix reg address for c3 pwm node. + +Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM") +Signed-off-by: Xianwei Zhao +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi +index cb9ea3ca6ee0f..71b2b3b547f7c 100644 +--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi ++++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi +@@ -792,7 +792,7 @@ spicc1: spi@52000 { + pwm_mn: pwm@54000 { + compatible = "amlogic,c3-pwm", + "amlogic,meson-s4-pwm"; +- reg = <0x0 54000 0x0 0x24>; ++ reg = <0x0 0x54000 0x0 0x24>; + clocks = <&clkc_periphs CLKID_PWM_M>, + <&clkc_periphs CLKID_PWM_N>; + #pwm-cells = <3>; +-- +2.51.0 + diff --git a/queue-6.17/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch b/queue-6.17/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch new file mode 100644 index 0000000000..d7436d0c52 --- /dev/null +++ b/queue-6.17/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch @@ -0,0 +1,78 @@ +From 9b7ae8f961a7c51533f229eada69bdb613f980d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:57:07 +0800 +Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller + +From: Qiuxu Zhuo + +[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ] + +When loading the i10nm_edac driver on some Intel Granite Rapids servers, +a call trace may appear as follows: + + UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 + shift exponent -66 is negative + ... + __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 + skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] + i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] + skx_register_mci+0x159/0x220 [skx_edac_common] + i10nm_init+0xcb0/0x1ff0 [i10nm_edac] + ... + +This occurs because some BIOS may disable a memory controller if there +aren't any memory DIMMs populated on this memory controller. The DIMMMTR +register of this disabled memory controller contains the invalid value +~0, resulting in the call trace above. + +Fix this call trace by skipping DIMM enumeration on a disabled memory +controller. + +Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support") +Reported-by: Jose Jesus Ambriz Meza +Reported-by: Chia-Lin Kao (AceLan) +Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/ +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index bf4171ac191d3..9d00f247f4e0e 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -1057,6 +1057,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) + return !!GET_BITFIELD(mcmtr, 2, 2); + } + ++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) ++{ ++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); ++ ++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); ++ ++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); ++} ++ + static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + struct res_config *cfg) + { +@@ -1070,6 +1079,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + if (!imc->mbase) + continue; + ++ if (i10nm_channel_disabled(imc, i)) { ++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); ++ continue; ++ } ++ + ndimms = 0; + + if (res_cfg->type != GNR) +-- +2.51.0 + diff --git a/queue-6.17/efi-explain-ovmf-acronym-in-ovmf_debug_log-help-text.patch b/queue-6.17/efi-explain-ovmf-acronym-in-ovmf_debug_log-help-text.patch new file mode 100644 index 0000000000..1588b5b9d7 --- /dev/null +++ b/queue-6.17/efi-explain-ovmf-acronym-in-ovmf_debug_log-help-text.patch @@ -0,0 +1,44 @@ +From faacb472a62f8d6f85376334d4bf9899e06d0615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:54:29 +0200 +Subject: efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text + +From: Geert Uytterhoeven + +[ Upstream commit 05e75ac35ee9e38f96bbfebf1830ec2cace2e7f8 ] + +People not very intimate with EFI may not know the meaning of the OVMF +acronym. Write it in full, to help users with making good decisions +when configuring their kernels. + +Fixes: f393a761763c5427 ("efi: add ovmf debug log driver") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Richard Lyu +Acked-by: Gerd Hoffmann +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/Kconfig | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig +index d528c94c5859b..29e0729299f5b 100644 +--- a/drivers/firmware/efi/Kconfig ++++ b/drivers/firmware/efi/Kconfig +@@ -267,9 +267,10 @@ config OVMF_DEBUG_LOG + bool "Expose OVMF firmware debug log via sysfs" + depends on EFI + help +- Recent OVMF versions (edk2-stable202508 + newer) can write +- their debug log to a memory buffer. This driver exposes the +- log content via sysfs (/sys/firmware/efi/ovmf_debug_log). ++ Recent versions of the Open Virtual Machine Firmware ++ (edk2-stable202508 + newer) can write their debug log to a memory ++ buffer. This driver exposes the log content via sysfs ++ (/sys/firmware/efi/ovmf_debug_log). + + config UNACCEPTED_MEMORY + bool +-- +2.51.0 + diff --git a/queue-6.17/erofs-avoid-reading-more-for-fragment-maps.patch b/queue-6.17/erofs-avoid-reading-more-for-fragment-maps.patch new file mode 100644 index 0000000000..bb97b213b7 --- /dev/null +++ b/queue-6.17/erofs-avoid-reading-more-for-fragment-maps.patch @@ -0,0 +1,59 @@ +From b22ce4c634b8f8f486d96abc808dd1c78c148391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 16:48:51 +0800 +Subject: erofs: avoid reading more for fragment maps + +From: Gao Xiang + +[ Upstream commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 ] + +Since all real encoded extents (directly handled by the decompression +subsystem) have a sane, limited maximum decoded length +(Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied +if needed. + +However, it makes no sense to read more for non-encoded maps, such as +fragment extents, since such extents can be huge (up to i_size) and +there is no benefit to reading more at this layer. + +For normal images, it does not really matter, but for crafted images +generated by syzbot, excessively large fragment extents can cause +read-more to run for an overly long time. + +Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com +Fixes: b44686c8391b ("erofs: fix large fragment handling") +Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") +Reviewed-by: Hongbo Li +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 2d73297003d25..625b8ae8f67f0 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -1835,7 +1835,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f, + map->m_la = end; + err = z_erofs_map_blocks_iter(inode, map, + EROFS_GET_BLOCKS_READMORE); +- if (err) ++ if (err || !(map->m_flags & EROFS_MAP_ENCODED)) + return; + + /* expand ra for the trailing edge if readahead */ +@@ -1847,7 +1847,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f, + end = round_up(end, PAGE_SIZE); + } else { + end = round_up(map->m_la, PAGE_SIZE); +- if (!map->m_llen) ++ if (!(map->m_flags & EROFS_MAP_ENCODED) || !map->m_llen) + return; + } + +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-condition-in-__allow_reserved_blocks.patch b/queue-6.17/f2fs-fix-condition-in-__allow_reserved_blocks.patch new file mode 100644 index 0000000000..d5e8432880 --- /dev/null +++ b/queue-6.17/f2fs-fix-condition-in-__allow_reserved_blocks.patch @@ -0,0 +1,45 @@ +From f910a78c4e9df4b9e1776767abb1c108cf438c44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:03:38 +0800 +Subject: f2fs: fix condition in __allow_reserved_blocks() + +From: Chao Yu + +[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ] + +If reserve_root mount option is not assigned, __allow_reserved_blocks() +will return false, it's not correct, fix it. + +Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index b4b62ac46bc64..dac7d44885e47 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2361,8 +2361,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, + { + if (!inode) + return true; +- if (!test_opt(sbi, RESERVE_ROOT)) +- return false; + if (IS_NOQUOTA(inode)) + return true; + if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) +@@ -2383,7 +2381,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode, cap)) ++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-allow-removing-qf_name.patch b/queue-6.17/f2fs-fix-to-allow-removing-qf_name.patch new file mode 100644 index 0000000000..e1ae5b6040 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-allow-removing-qf_name.patch @@ -0,0 +1,69 @@ +From cff0634e0281875732cb4c23d7316927cde1de0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 10:09:39 +0800 +Subject: f2fs: fix to allow removing qf_name + +From: Chao Yu + +[ Upstream commit ff11d8701b77e303593fd86cf9ef74ef3ac4048e ] + +The mount behavior changed after commit d18535132523 ("f2fs: separate the +options parsing and options checking"), let's fix it. + +[Scripts] +mkfs.f2fs -f /dev/vdb +mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs +quotacheck -uc /mnt/f2fs +umount /mnt/f2fs +mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs +mount|grep f2fs +mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs +mount|grep f2fs +dmesg + +[Before commit] +mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... +mount#2: ...,quota,jqfmt=vfsold,... +kmsg: no output + +[After commit] +mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... +mount#2: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... +kmsg: "user quota file already specified" + +[After patch] +mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,... +mount#2: ...,quota,jqfmt=vfsold,... +kmsg: "remove qf_name aquota.user" + +Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") +Cc: Hongbo Li +Signed-off-by: Chao Yu +Reviewed-by: Hongbo Li +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index bf0497187bdff..8086a3456e4d3 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1189,8 +1189,11 @@ static int f2fs_check_quota_consistency(struct fs_context *fc, + goto err_jquota_change; + + if (old_qname) { +- if (new_qname && +- strcmp(old_qname, new_qname) == 0) { ++ if (!new_qname) { ++ f2fs_info(sbi, "remove qf_name %s", ++ old_qname); ++ continue; ++ } else if (strcmp(old_qname, new_qname) == 0) { + ctx->qname_mask &= ~(1 << i); + continue; + } +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-avoid-migrating-empty-section.patch b/queue-6.17/f2fs-fix-to-avoid-migrating-empty-section.patch new file mode 100644 index 0000000000..ff08cf53e6 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-avoid-migrating-empty-section.patch @@ -0,0 +1,94 @@ +From 919ba3fd4ade6fcfbe95f7d3ac65c29d3f341cec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 10:04:15 +0800 +Subject: f2fs: fix to avoid migrating empty section + +From: Chao Yu + +[ Upstream commit d625a2b08c089397d3a03bff13fa8645e4ec7a01 ] + +It reports a bug from device w/ zufs: + +F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT +F2FS-fs (dm-64): Stopped filesystem due to reason: 4 + +Thread A Thread B +- f2fs_expand_inode_data + - f2fs_allocate_pinning_section + - f2fs_gc_range + - do_garbage_collect w/ segno #x + - writepage + - f2fs_allocate_data_block + - new_curseg + - allocate segno #x + +The root cause is: fallocate on pinning file may race w/ block allocation +as above, result in do_garbage_collect() from fallocate() may migrate +segment which is just allocated by a log, the log will update segment type +in its in-memory structure, however GC will get segment type from on-disk +SSA block, once segment type changes by log, we can detect such +inconsistency, then shutdown filesystem. + +In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE), +however segno #173822 was just allocated as data type segment, so in-memory +SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA). + +Change as below to fix this issue: +- check whether current section is empty before gc +- add sanity checks on do_garbage_collect() to avoid any race case, result +in migrating segment used by log. +- btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA". + +Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices") +Cc: Daeho Jeong +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index c0f209f746882..5734e03864685 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1794,6 +1794,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + struct folio *sum_folio = filemap_get_folio(META_MAPPING(sbi), + GET_SUM_BLOCK(sbi, segno)); + ++ if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno))) { ++ f2fs_err(sbi, "%s: segment %u is used by log", ++ __func__, segno); ++ f2fs_bug_on(sbi, 1); ++ goto skip; ++ } ++ + if (get_valid_blocks(sbi, segno, false) == 0) + goto freed; + if (gc_type == BG_GC && __is_large_section(sbi) && +@@ -1805,7 +1812,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + + sum = folio_address(sum_folio); + if (type != GET_SUM_TYPE((&sum->footer))) { +- f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SSA and SIT", ++ f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SIT and SSA", + segno, type, GET_SUM_TYPE((&sum->footer))); + f2fs_stop_checkpoint(sbi, false, + STOP_CP_REASON_CORRUPTED_SUMMARY); +@@ -2068,6 +2075,13 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi, + .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS), + }; + ++ /* ++ * avoid migrating empty section, as it can be allocated by ++ * log in parallel. ++ */ ++ if (!get_valid_blocks(sbi, segno, true)) ++ continue; ++ + if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno))) + continue; + +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-avoid-null-pointer-dereference-in-f2fs_c.patch b/queue-6.17/f2fs-fix-to-avoid-null-pointer-dereference-in-f2fs_c.patch new file mode 100644 index 0000000000..bc5395d9fe --- /dev/null +++ b/queue-6.17/f2fs-fix-to-avoid-null-pointer-dereference-in-f2fs_c.patch @@ -0,0 +1,76 @@ +From b69044f23b43d9b0769db8882d4a750fd6570e76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 10:09:38 +0800 +Subject: f2fs: fix to avoid NULL pointer dereference in + f2fs_check_quota_consistency() + +From: Chao Yu + +[ Upstream commit 930a9a6ee8e7ffa20af4bffbfc2bbd21d83bf81c ] + +syzbot reported a f2fs bug as below: + +Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)} +RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284 +Call Trace: + + f2fs_check_quota_consistency fs/f2fs/super.c:1188 [inline] + f2fs_check_opt_consistency+0x1378/0x2c10 fs/f2fs/super.c:1436 + __f2fs_remount fs/f2fs/super.c:2653 [inline] + f2fs_reconfigure+0x482/0x1770 fs/f2fs/super.c:5297 + reconfigure_super+0x224/0x890 fs/super.c:1077 + do_remount fs/namespace.c:3314 [inline] + path_mount+0xd18/0xfe0 fs/namespace.c:4112 + do_mount fs/namespace.c:4133 [inline] + __do_sys_mount fs/namespace.c:4344 [inline] + __se_sys_mount+0x317/0x410 fs/namespace.c:4321 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +The direct reason is f2fs_check_quota_consistency() may suffer null-ptr-deref +issue in strcmp(). + +The bug can be reproduced w/ below scripts: +mkfs.f2fs -f /dev/vdb +mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs +quotacheck -uc /mnt/f2fs/ +umount /mnt/f2fs +mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs +mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs +umount /mnt/f2fs + +So, before old_qname and new_qname comparison, we need to check whether +they are all valid pointers, fix it. + +Reported-by: syzbot+d371efea57d5aeab877b@syzkaller.appspotmail.com +Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") +Closes: https://lore.kernel.org/linux-f2fs-devel/689ff889.050a0220.e29e5.0037.GAE@google.com +Cc: Hongbo Li +Signed-off-by: Chao Yu +Reviewed-by: Hongbo Li +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 9f2ae3ac6078e..bf0497187bdff 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1189,7 +1189,8 @@ static int f2fs_check_quota_consistency(struct fs_context *fc, + goto err_jquota_change; + + if (old_qname) { +- if (strcmp(old_qname, new_qname) == 0) { ++ if (new_qname && ++ strcmp(old_qname, new_qname) == 0) { + ctx->qname_mask &= ~(1 << i); + continue; + } +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch b/queue-6.17/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch new file mode 100644 index 0000000000..0fec8bbaab --- /dev/null +++ b/queue-6.17/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch @@ -0,0 +1,36 @@ +From 4b3c04ee2b4b0d4f15d0395eb79e8fe1f1ad2526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 14:29:10 +0800 +Subject: f2fs: fix to avoid overflow while left shift operation + +From: Chao Yu + +[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ] + +Should cast type of folio->index from pgoff_t to loff_t to avoid overflow +while left shift operation. + +Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 5c1f47e45dab4..6cd8902849cf6 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock) + + for (i = cluster_size - 1; i >= 0; i--) { + struct folio *folio = page_folio(rpages[i]); +- loff_t start = folio->index << PAGE_SHIFT; ++ loff_t start = (loff_t)folio->index << PAGE_SHIFT; + + if (from <= start) { + folio_zero_segment(folio, 0, folio_size(folio)); +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-clear-unusable_cap-for-checkpoint-enable.patch b/queue-6.17/f2fs-fix-to-clear-unusable_cap-for-checkpoint-enable.patch new file mode 100644 index 0000000000..ee59348f13 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-clear-unusable_cap-for-checkpoint-enable.patch @@ -0,0 +1,45 @@ +From 8b5f042340daad4c087d533c5049a59080ea9c64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 09:48:35 +0800 +Subject: f2fs: fix to clear unusable_cap for checkpoint=enable + +From: Chao Yu + +[ Upstream commit 2e8f4c2b2bb12fc3d40762f1bb778e95c6ddbc93 ] + +mount -t f2fs -o checkpoint=disable:10% /dev/vdb /mnt/f2fs/ +mount -t f2fs -o remount,checkpoint=enable /dev/vdb /mnt/f2fs/ + +kernel log: +F2FS-fs (vdb): Adjust unusable cap for checkpoint=disable = 204440 / 10% + +If we has assigned checkpoint=enable mount option, unusable_cap{,_perc} +parameters of checkpoint=disable should be reset, then calculation and +log print could be avoid in adjust_unusable_cap_perc(). + +Fixes: 1ae18f71cb52 ("f2fs: fix checkpoint=disable:%u%%") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index e16c4e2830c29..9f2ae3ac6078e 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -988,6 +988,10 @@ static int f2fs_parse_param(struct fs_context *fc, struct fs_parameter *param) + ctx_set_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT); + break; + case Opt_checkpoint_enable: ++ F2FS_CTX_INFO(ctx).unusable_cap_perc = 0; ++ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap_perc; ++ F2FS_CTX_INFO(ctx).unusable_cap = 0; ++ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap; + ctx_clear_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT); + break; + default: +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch b/queue-6.17/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch new file mode 100644 index 0000000000..900359eeb3 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch @@ -0,0 +1,138 @@ +From 39a25369a03715408c572f8f5982a06c785e8f64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 10:47:09 +0800 +Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() + +From: Chao Yu + +[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ] + +f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock +and page lookup, change as below to mitigate its overhead: +- check new_size before grabbing invalidate_lock +- lookup and invalidate pages only in range of [old_size, new_size] + +Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 39 +++++++++++++++++++-------------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 1aae4361d0a89..ffa045b39c01d 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -35,15 +35,23 @@ + #include + #include + +-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) ++static void f2fs_zero_post_eof_page(struct inode *inode, ++ loff_t new_size, bool lock) + { + loff_t old_size = i_size_read(inode); + + if (old_size >= new_size) + return; + ++ if (mapping_empty(inode->i_mapping)) ++ return; ++ ++ if (lock) ++ filemap_invalidate_lock(inode->i_mapping); + /* zero or drop pages only in range of [old_size, new_size] */ +- truncate_pagecache(inode, old_size); ++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); ++ if (lock) ++ filemap_invalidate_unlock(inode->i_mapping); + } + + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) +@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) + + f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); + + file_update_time(vmf->vma->vm_file); + filemap_invalidate_lock_shared(inode->i_mapping); +@@ -1149,7 +1155,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + filemap_invalidate_lock(inode->i_mapping); + + if (attr->ia_size > old_size) +- f2fs_zero_post_eof_page(inode, attr->ia_size); ++ f2fs_zero_post_eof_page(inode, attr->ia_size, false); + truncate_setsize(inode, attr->ia_size); + + if (attr->ia_size <= old_size) +@@ -1268,9 +1274,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) + if (ret) + return ret; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1555,7 +1559,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + + f2fs_lock_op(sbi); + f2fs_drop_extent_tree(inode); +@@ -1678,9 +1682,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + return ret; + +- filemap_invalidate_lock(mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1814,7 +1816,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + truncate_pagecache(inode, offset); + + while (!ret && idx > pg_start) { +@@ -1872,9 +1874,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + f2fs_balance_fs(sbi, true); + +@@ -4922,9 +4922,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, ++ iocb->ki_pos + iov_iter_count(from), true); + return count; + } + +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch b/queue-6.17/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch new file mode 100644 index 0000000000..bf09908693 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch @@ -0,0 +1,83 @@ +From 3a933f49850a4669d069c348a99eb843e03d94f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:40:24 +0800 +Subject: f2fs: fix to truncate first page in error path of f2fs_truncate() + +From: Chao Yu + +[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ] + +syzbot reports a bug as below: + +loop0: detected capacity change from 0 to 40427 +F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) +F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock +F2FS-fs (loop0): invalid crc value +F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. +------------[ cut here ]------------ +kernel BUG at fs/inode.c:753! +RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 +Call Trace: + + evict+0x504/0x9c0 fs/inode.c:810 + f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 + get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 + vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 + do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 + do_mount fs/namespace.c:4136 [inline] + __do_sys_mount fs/namespace.c:4347 [inline] + __se_sys_mount+0x317/0x410 fs/namespace.c:4324 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +During f2fs_evict_inode(), clear_inode() detects that we missed to truncate +all page cache before destorying inode, that is because in below path, we +will create page #0 in cache, but missed to drop it in error path, let's fix +it. + +- evict + - f2fs_evict_inode + - f2fs_truncate + - f2fs_convert_inline_inode + - f2fs_grab_cache_folio + : create page #0 in cache + - f2fs_convert_inline_folio + : sanity check failed, return -EFSCORRUPTED + - clear_inode detects that inode->i_data.nrpages is not zero + +Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large") +Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 42faaed6a02da..1aae4361d0a89 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -904,8 +904,16 @@ int f2fs_truncate(struct inode *inode) + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +- if (err) ++ if (err) { ++ /* ++ * Always truncate page #0 to avoid page cache ++ * leak in evict() path. ++ */ ++ truncate_inode_pages_range(inode->i_mapping, ++ F2FS_BLK_TO_BYTES(0), ++ F2FS_BLK_END_BYTES(0)); + return err; ++ } + } + + err = f2fs_truncate_blocks(inode, i_size_read(inode), true); +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch b/queue-6.17/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch new file mode 100644 index 0000000000..bc545d585f --- /dev/null +++ b/queue-6.17/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch @@ -0,0 +1,56 @@ +From f7ce1c6b4d6736e4c54885bc7cb91d0adbe1a444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:12:50 +0800 +Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() + +From: Chao Yu + +[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ] + +Script to reproduce: +mkfs.f2fs -O extra_attr,compression /dev/vdb -f +mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache +cd /mnt/f2fs +f2fs_io write 1 0 1024 rand dsync testfile +xfs_io testfile -c "fsync" +f2fs_io write 1 0 512 rand dsync testfile +xfs_io testfile -c "fsync" +cd / +umount /mnt/f2fs +mount /dev/vdb /mnt/f2fs +f2fs_io precache_extents /mnt/f2fs/testfile +umount /mnt/f2fs + +Tracepoint output: +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0 + +During precache_extents, there is off-by-one issue, we should update +map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is +valid and not contiguous to previous extent. + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 7961e0ddfca3a..838eae39d3b19 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1783,7 +1783,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + map->m_len - ofs); + } + if (map->m_next_extent) +- *map->m_next_extent = pgofs + 1; ++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; + } + f2fs_put_dnode(&dn); + unlock_out: +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch b/queue-6.17/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch new file mode 100644 index 0000000000..e16dba5225 --- /dev/null +++ b/queue-6.17/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch @@ -0,0 +1,138 @@ +From c3a746529b1a33f2ed2ae8a25dd9839887cdf8e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:11:06 +0800 +Subject: f2fs: fix to zero data after EOF for compressed file correctly + +From: Chao Yu + +[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ] + +generic/091 may fail, then it bisects to the bad commit ba8dac350faf +("f2fs: fix to zero post-eof page"). + +What will cause generic/091 to fail is something like below Testcase #1: +1. write 16k as compressed blocks +2. truncate to 12k +3. truncate to 20k +4. verify data in range of [12k, 16k], however data is not zero as +expected + +Script of Testcase #1 +mkfs.f2fs -f -O extra_attr,compression /dev/vdb +mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs +dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 +dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc +sync +truncate -s $((12*1024)) /mnt/f2fs/file +truncate -s $((20*1024)) /mnt/f2fs/file +dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 +od /mnt/f2fs/data +umount /mnt/f2fs + +Analisys: +in step 2), we will redirty all data pages from #0 to #3 in compressed +cluster, and zero page #3, +in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop +all page cache post eof, includeing dirtied page #3, +in step 4) when we read data from page #3, it will decompressed cluster +and extra random data to page #3, finally, we hit the non-zeroed data +post eof. + +However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just +let the issue be reproduced easily, w/o the commit, it can reproduce this +bug w/ below Testcase #2: +1. write 16k as compressed blocks +2. truncate to 8k +3. truncate to 12k +4. truncate to 20k +5. verify data in range of [12k, 16k], however data is not zero as +expected + +Script of Testcase #2 +mkfs.f2fs -f -O extra_attr,compression /dev/vdb +mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs +dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1 +dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc +sync +truncate -s $((8*1024)) /mnt/f2fs/file +truncate -s $((12*1024)) /mnt/f2fs/file +truncate -s $((20*1024)) /mnt/f2fs/file +echo 3 > /proc/sys/vm/drop_caches +dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3 +od /mnt/f2fs/data +umount /mnt/f2fs + +Anlysis: +in step 2), we will redirty all data pages from #0 to #3 in compressed +cluster, and zero page #2 and #3, +in step 3), we will truncate page #3 in page cache, +in step 4), expand file size, +in step 5), hit random data post eof w/ the same reason in Testcase #1. + +Root Cause: +In f2fs_truncate_partial_cluster(), after we truncate partial data block +on compressed cluster, all pages in cluster including the one post eof +will be dirtied, after another tuncation, dirty page post eof will be +dropped, however on-disk compressed cluster is still valid, it may +include non-zero data post eof, result in exposing previous non-zero data +post eof while reading. + +Fix: +In f2fs_truncate_partial_cluster(), let change as below to fix: +- call filemap_write_and_wait_range() to flush dirty page +- call truncate_pagecache() to drop pages or zero partial page post eof +- call f2fs_do_truncate_blocks() to truncate non-compress cluster to + last valid block + +Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode") +Reported-by: Jan Prusakowski +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 6cd8902849cf6..72bc05b913af7 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock) + for (i = cluster_size - 1; i >= 0; i--) { + struct folio *folio = page_folio(rpages[i]); + loff_t start = (loff_t)folio->index << PAGE_SHIFT; ++ loff_t offset = from > start ? from - start : 0; + +- if (from <= start) { +- folio_zero_segment(folio, 0, folio_size(folio)); +- } else { +- folio_zero_segment(folio, from - start, +- folio_size(folio)); ++ folio_zero_segment(folio, offset, folio_size(folio)); ++ ++ if (from >= start) + break; +- } + } + + f2fs_compress_write_end(inode, fsdata, start_idx, true); ++ ++ err = filemap_write_and_wait_range(inode->i_mapping, ++ round_down(from, cluster_size << PAGE_SHIFT), ++ LLONG_MAX); ++ if (err) ++ return err; ++ ++ truncate_pagecache(inode, from); ++ ++ err = f2fs_do_truncate_blocks(inode, ++ round_up(from, PAGE_SIZE), lock); + } +- return 0; ++ return err; + } + + static int f2fs_write_compressed_pages(struct compress_ctx *cc, +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch b/queue-6.17/f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch new file mode 100644 index 0000000000..f7bc2602a7 --- /dev/null +++ b/queue-6.17/f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch @@ -0,0 +1,109 @@ +From ecd7cf182b123ce66555f91604902752f7b74e38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 18:24:22 +0800 +Subject: f2fs: fix UAF issue in f2fs_merge_page_bio() + +From: Chao Yu + +[ Upstream commit edf7e9040fc52c922db947f9c6c36f07377c52ea ] + +As JY reported in bugzilla [1], + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 +lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 +CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 +Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +Workqueue: writeback wb_workfn (flush-254:49) +Call trace: + f2fs_is_cp_guaranteed+0x70/0x98 + f2fs_inplace_write_data+0x174/0x2f4 + f2fs_do_write_data_page+0x214/0x81c + f2fs_write_single_data_page+0x28c/0x764 + f2fs_write_data_pages+0x78c/0xce4 + do_writepages+0xe8/0x2fc + __writeback_single_inode+0x4c/0x4b4 + writeback_sb_inodes+0x314/0x540 + __writeback_inodes_wb+0xa4/0xf4 + wb_writeback+0x160/0x448 + wb_workfn+0x2f0/0x5dc + process_scheduled_works+0x1c8/0x458 + worker_thread+0x334/0x3f0 + kthread+0x118/0x1ac + ret_from_fork+0x10/0x20 + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575 + +The panic was caused by UAF issue w/ below race condition: + +kworker +- writepages + - f2fs_write_cache_pages + - f2fs_write_single_data_page + - f2fs_do_write_data_page + - f2fs_inplace_write_data + - f2fs_merge_page_bio + - add_inu_page + : cache page #1 into bio & cache bio in + io->bio_list + - f2fs_write_single_data_page + - f2fs_do_write_data_page + - f2fs_inplace_write_data + - f2fs_merge_page_bio + - add_inu_page + : cache page #2 into bio which is linked + in io->bio_list + write + - f2fs_write_begin + : write page #1 + - f2fs_folio_wait_writeback + - f2fs_submit_merged_ipu_write + - f2fs_submit_write_bio + : submit bio which inclues page #1 and #2 + + software IRQ + - f2fs_write_end_io + - fscrypt_free_bounce_page + : freed bounced page which belongs to page #2 + - inc_page_count( , WB_DATA_TYPE(data_folio), false) + : data_folio points to fio->encrypted_page + the bounced page can be freed before + accessing it in f2fs_is_cp_guarantee() + +It can reproduce w/ below testcase: +Run below script in shell #1: +for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ +-c "pwrite 0 32k" -c "fdatasync" + +Run below script in shell #2: +for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ +-c "pwrite 0 32k" -c "fdatasync" + +So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after +commit page into internal ipu cache. + +Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") +Reported-by: JY +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 6e39a15a942a9..50c90bd039235 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -911,7 +911,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio) + if (fio->io_wbc) + wbc_account_cgroup_owner(fio->io_wbc, folio, folio_size(folio)); + +- inc_page_count(fio->sbi, WB_DATA_TYPE(data_folio, false)); ++ inc_page_count(fio->sbi, WB_DATA_TYPE(folio, false)); + + *fio->last_block = fio->new_blkaddr; + *fio->bio = bio; +-- +2.51.0 + diff --git a/queue-6.17/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.17/f2fs-fix-zero-sized-extent-for-precache-extents.patch new file mode 100644 index 0000000000..013ebd7cbe --- /dev/null +++ b/queue-6.17/f2fs-fix-zero-sized-extent-for-precache-extents.patch @@ -0,0 +1,97 @@ +From 1ba26a9dc7b79c8b5c8e4905507fd81b2585e1fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:36:21 +0800 +Subject: f2fs: fix zero-sized extent for precache extents + +From: wangzijie + +[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ] + +Script to reproduce: +f2fs_io write 1 0 1881 rand dsync testfile +f2fs_io fallocate 0 7708672 4096 testfile +f2fs_io write 1 1881 1 rand buffered testfile +fsync testfile +umount +mount +f2fs_io precache_extents testfile + +When the data layout is something like this: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +During precache_extents, we map the last block(valid blkaddr) in dnode1: +map->m_flags |= F2FS_MAP_MAPPED; +map->m_pblk = blkaddr(valid blkaddr); +map->m_len = 1; +then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: +map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: + +map->m_len = 1 +ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 +ei.fofs = start_pgofs = 1882 +ei.len = map->m_len - ofs = 1 - 1 = 0 + +Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: +A,B,C is valid blkaddr +case1: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case2: +dnode1: dnode2: +[0] A [0] C (C!=B+1) +[1] A+1 [1] C+1 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case3: +dnode1: dnode2: +[0] A [0] C (C!=B+2) +[1] A+1 [1] C+1 +... .... +[1015] A+1015 +[1016] B (B!=A+1016) +[1017] B+1 [1017] 0x0 + +[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: wangzijie +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 838eae39d3b19..6e39a15a942a9 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1778,9 +1778,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) + *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; +-- +2.51.0 + diff --git a/queue-6.17/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch b/queue-6.17/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch new file mode 100644 index 0000000000..ac3475070d --- /dev/null +++ b/queue-6.17/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch @@ -0,0 +1,117 @@ +From 70d1ab39c003157c6bb45fd210856eff735574a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 16:09:13 +0200 +Subject: fanotify: Validate the return value of mnt_ns_from_dentry() before + dereferencing + +From: Anderson Nascimento + +[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ] + +The function do_fanotify_mark() does not validate if +mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns. +This causes a NULL pointer dereference in do_fanotify_mark() if the +path is not a mount namespace object. + +Fix this by checking mnt_ns_from_dentry()'s return value before +dereferencing it. + +Before the patch + +$ gcc fanotify_nullptr.c -o fanotify_nullptr +$ mkdir A +$ ./fanotify_nullptr +Fanotify fd: 3 +fanotify_mark: Operation not permitted +$ unshare -Urm +Fanotify fd: 3 +Killed + +int main(void){ + int ffd; + ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); + if(ffd < 0){ + perror("fanotify_init"); + exit(EXIT_FAILURE); + } + + printf("Fanotify fd: %d\n",ffd); + + if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, +FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){ + perror("fanotify_mark"); + exit(EXIT_FAILURE); + } + +return 0; +} + +After the patch + +$ gcc fanotify_nullptr.c -o fanotify_nullptr +$ mkdir A +$ ./fanotify_nullptr +Fanotify fd: 3 +fanotify_mark: Operation not permitted +$ unshare -Urm +Fanotify fd: 3 +fanotify_mark: Invalid argument + +[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 +[ 25.695006] #PF: supervisor read access in kernel mode +[ 25.695012] #PF: error_code(0x0000) - not-present page +[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 +[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI +[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not +tainted 6.17.0-rc4 #1 PREEMPT(lazy) +[ 25.695040] Hardware name: VMware, Inc. VMware Virtual +Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 +[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 +[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 +24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b +5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 +85 c9 +[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203 +[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 +[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 +[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000 +[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7 +[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 +[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) +knlGS:0000000000000000 +[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0 +[ 25.695201] Call Trace: +[ 25.695209] +[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30 +[ 25.695222] do_syscall_64+0x82/0x2c0 +... + +Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns") +Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com +Signed-off-by: Anderson Nascimento +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/notify/fanotify/fanotify_user.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index b192ee068a7ac..561339b4cf752 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, + user_ns = path.mnt->mnt_sb->s_user_ns; + obj = path.mnt->mnt_sb; + } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) { ++ ret = -EINVAL; + mntns = mnt_ns_from_dentry(path.dentry); ++ if (!mntns) ++ goto path_put_and_out; + user_ns = mntns->user_ns; + obj = mntns; + } +-- +2.51.0 + diff --git a/queue-6.17/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.17/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..55296edcb8 --- /dev/null +++ b/queue-6.17/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From 75c5a5dfe5a1802e1e39eb3ecffcb32f950d3c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index b8d1e00a7982c..2dfeb158e848a 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-6.17/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch b/queue-6.17/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch new file mode 100644 index 0000000000..123db64417 --- /dev/null +++ b/queue-6.17/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch @@ -0,0 +1,64 @@ +From 062f346be487173ae17de563716e7a4094c438d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:53:43 +0800 +Subject: firmware: arm_scmi: Mark VirtIO ready before registering + scmi_virtio_driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Junnan Wu + +[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ] + +After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a +standalone driver”), the VirtIO transport probes independently. During +scmi_virtio_probe, scmi_probe() is called, which intune invokes +scmi_protocol_acquire() that sends a message over the virtqueue and +waits for a reply. + +Previously, DRIVER_OK was only set after scmi_vio_probe, in the core +virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device +Initialization): + | The driver MUST NOT send any buffer available notifications to the + | device before setting DRIVER_OK. + +Some type-1 hypervisors block available-buffer notifications until the +driver is marked OK. In such cases, scmi_vio_probe stalls in +scmi_wait_for_reply(), and the probe never completes. + +Resolve this by setting DRIVER_OK immediately after the device-specific +setup, so scmi_probe() can safely send notifications. + +Note after splitting the transports into modules, the probe sequence +changed a bit. We can no longer rely on virtio_device_ready() being +called by the core in virtio_dev_probe(), because scmi_vio_probe() +doesn’t complete until the core SCMI stack runs scmi_probe(), which +immediately issues the initial BASE protocol exchanges. + +Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver") +Signed-off-by: Junnan Wu +Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/transports/virtio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c +index cb934db9b2b4a..326c4a93e44b9 100644 +--- a/drivers/firmware/arm_scmi/transports/virtio.c ++++ b/drivers/firmware/arm_scmi/transports/virtio.c +@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev) + /* Ensure initialized scmi_vdev is visible */ + smp_store_mb(scmi_vdev, vdev); + ++ /* Set device ready */ ++ virtio_device_ready(vdev); ++ + ret = platform_driver_register(&scmi_virtio_driver); + if (ret) { + vdev->priv = NULL; +-- +2.51.0 + diff --git a/queue-6.17/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.17/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..08c5fe5432 --- /dev/null +++ b/queue-6.17/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From 38d953fc453ed47ea962d33f0ba2b7afbdd496d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-6.17/fix-cc_has_asm_goto_output-on-non-x86-architectures.patch b/queue-6.17/fix-cc_has_asm_goto_output-on-non-x86-architectures.patch new file mode 100644 index 0000000000..6c1a8c0d5e --- /dev/null +++ b/queue-6.17/fix-cc_has_asm_goto_output-on-non-x86-architectures.patch @@ -0,0 +1,50 @@ +From 9dd0c00351a2f43445d02f115ac627d9e070af56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 08:54:12 -0700 +Subject: Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures + +From: Linus Torvalds + +[ Upstream commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 ] + +There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with +a working compiler it will fail on some architectures simply because it +uses the mnemonic "jmp" for testing the inline asm. + +And as reported by Geert, not all architectures use that mnemonic, so +the test fails spuriously on such platforms (including arm and riscv, +but also several other architectures). + +This issue avoided any obvious test failures because the build still +works thanks to falling back on the old non-asm-goto code, which just +generates worse code. + +Just use an empty asm statement instead. + +Reported-and-tested-by: Geert Uytterhoeven +Suggested-by: Peter Zijlstra +Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17") +Cc: Nathan Chancellor +Cc: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + init/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/init/Kconfig b/init/Kconfig +index e5d6d798994ae..87c868f86a060 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -102,7 +102,7 @@ config CC_HAS_ASM_GOTO_OUTPUT + # Detect basic support + depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null) + # Detect clang (< v17) scoped label issues +- depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto("jmp %l0"::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto("jmp %l0"::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null) ++ depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto(""::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto(""::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null) + + config CC_HAS_ASM_GOTO_TIED_OUTPUT + depends on CC_HAS_ASM_GOTO_OUTPUT +-- +2.51.0 + diff --git a/queue-6.17/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.17/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..00848da482 --- /dev/null +++ b/queue-6.17/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,87 @@ +From a6602e67153dc9d0f32fdfce533906b8b4f1a7f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 6e86d66197ef2..88550085f7457 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else { + /* The size of 'dlcn' can't be > 8. */ + return -EINVAL; + } + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-6.17/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch b/queue-6.17/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch new file mode 100644 index 0000000000..b859e74bf8 --- /dev/null +++ b/queue-6.17/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch @@ -0,0 +1,58 @@ +From 466087ee104fca6ea46947e5919f99a1dabbcb44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 10:40:16 -0700 +Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks + exist + +From: Moon Hee Lee + +[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ] + +Index allocation requires at least one bit in the $BITMAP attribute to +track usage of index entries. If the bitmap is empty while index blocks +are already present, this reflects on-disk corruption. + +syzbot triggered this condition using a malformed NTFS image. During a +rename() operation involving a long filename (which spans multiple +index entries), the empty bitmap allowed the name to be added without +valid tracking. Subsequent deletion of the original entry failed with +-ENOENT, due to unexpected index state. + +Reject such cases by verifying that the bitmap is not empty when index +blocks exist. + +Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64 +Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") +Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Signed-off-by: Moon Hee Lee +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 1bf2a6593dec6..6d1bf890929d9 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); + } + ++ /* ++ * Index blocks exist, but $BITMAP has zero valid bits. ++ * This implies an on-disk corruption and must be rejected. ++ */ ++ if (in->name == I30_NAME && ++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { ++ err = -EINVAL; ++ goto out1; ++ } ++ + bit = bmp_size << 3; + } + +-- +2.51.0 + diff --git a/queue-6.17/fuse-remove-unneeded-offset-assignment-when-filling-.patch b/queue-6.17/fuse-remove-unneeded-offset-assignment-when-filling-.patch new file mode 100644 index 0000000000..3624905ec7 --- /dev/null +++ b/queue-6.17/fuse-remove-unneeded-offset-assignment-when-filling-.patch @@ -0,0 +1,37 @@ +From e6bc4c73a791580557f5cbc2879613dfaa6baf66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 May 2025 13:16:54 -0700 +Subject: fuse: remove unneeded offset assignment when filling write pages + +From: Joanne Koong + +[ Upstream commit 6fd26f50857698c6f07a9e6b149247925fadb8fd ] + +With the change in aee03ea7ff98 ("fuse: support large folios for +writethrough writes"), this old line for setting ap->descs[0].offset is +now obsolete and unneeded. This should have been removed as part of +aee03ea7ff98. + +Signed-off-by: Joanne Koong +Fixes: aee03ea7ff98 ("fuse: support large folios for writethrough writes") +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 4adcf09d4b01a..c7351ca070652 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1175,7 +1175,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, + num = min(iov_iter_count(ii), fc->max_write); + + ap->args.in_pages = true; +- ap->descs[0].offset = offset; + + while (num && ap->num_folios < max_folios) { + size_t tmp; +-- +2.51.0 + diff --git a/queue-6.17/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch b/queue-6.17/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch new file mode 100644 index 0000000000..97a0d32198 --- /dev/null +++ b/queue-6.17/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch @@ -0,0 +1,45 @@ +From 5f791ca3f01939353148f10efbe48baf39197c55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 11:49:54 +0530 +Subject: fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() + +From: Akhilesh Patil + +[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ] + +Use kvfree() to free memory allocated by kvzalloc() instead of kfree(). +Avoid potential memory management issue considering kvzalloc() can +internally choose to use either kmalloc() or vmalloc() based on memory +request and current system memory state. Hence, use more appropriate +kvfree() which automatically determines correct free method to avoid +potential hard to debug memory issues. Fix this issue discovered by +running spatch static analysis tool using coccinelle script - +scripts/coccinelle/api/kfree_mismatch.cocci + +Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw") +Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in +Signed-off-by: Akhilesh Patil +Reviewed-by: Dave Jiang +Reviewed-by: Alison Schofield +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/fwctl/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c +index f93aa0cecdb97..4b379f695eb73 100644 +--- a/drivers/fwctl/mlx5/main.c ++++ b/drivers/fwctl/mlx5/main.c +@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, + */ + if (ret && ret != -EREMOTEIO) { + if (rpc_out != rpc_in) +- kfree(rpc_out); ++ kvfree(rpc_out); + return ERR_PTR(ret); + } + return rpc_out; +-- +2.51.0 + diff --git a/queue-6.17/genirq-add-irq_chip_-startup-shutdown-_parent.patch b/queue-6.17/genirq-add-irq_chip_-startup-shutdown-_parent.patch new file mode 100644 index 0000000000..4689a7bd30 --- /dev/null +++ b/queue-6.17/genirq-add-irq_chip_-startup-shutdown-_parent.patch @@ -0,0 +1,100 @@ +From 95e7fbdad9f1ecc22065d3d4c361e76f9463e45a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 07:28:31 +0800 +Subject: genirq: Add irq_chip_(startup/shutdown)_parent() + +From: Inochi Amaoto + +[ Upstream commit 7a721a2fee2bce01af26699a87739db8ca8ea3c8 ] + +As the MSI controller on SG2044 uses PLIC as the underlying interrupt +controller, it needs to call irq_enable() and irq_disable() to +startup/shutdown interrupts. Otherwise, the MSI interrupt can not be +startup correctly and will not respond any incoming interrupt. + +Introduce irq_chip_startup_parent() and irq_chip_shutdown_parent() to allow +the interrupt controller to call the irq_startup()/irq_shutdown() callbacks +of the parent interrupt chip. + +In case the irq_startup()/irq_shutdown() callbacks are not implemented for +the parent interrupt chip, this will fallback to irq_chip_enable_parent() +or irq_chip_disable_parent(). + +Suggested-by: Thomas Gleixner +Signed-off-by: Inochi Amaoto +Signed-off-by: Thomas Gleixner +Tested-by: Chen Wang # Pioneerbox +Reviewed-by: Chen Wang +Link: https://lore.kernel.org/all/20250813232835.43458-2-inochiama@gmail.com +Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/ +Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting") +Signed-off-by: Sasha Levin +--- + include/linux/irq.h | 2 ++ + kernel/irq/chip.c | 37 +++++++++++++++++++++++++++++++++++++ + 2 files changed, 39 insertions(+) + +diff --git a/include/linux/irq.h b/include/linux/irq.h +index 1d6b606a81efe..890e1371f5d4c 100644 +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -669,6 +669,8 @@ extern int irq_chip_set_parent_state(struct irq_data *data, + extern int irq_chip_get_parent_state(struct irq_data *data, + enum irqchip_irq_state which, + bool *state); ++extern void irq_chip_shutdown_parent(struct irq_data *data); ++extern unsigned int irq_chip_startup_parent(struct irq_data *data); + extern void irq_chip_enable_parent(struct irq_data *data); + extern void irq_chip_disable_parent(struct irq_data *data); + extern void irq_chip_ack_parent(struct irq_data *data); +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index 0d0276378c707..3ffa0d80ddd19 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -1259,6 +1259,43 @@ int irq_chip_get_parent_state(struct irq_data *data, + } + EXPORT_SYMBOL_GPL(irq_chip_get_parent_state); + ++/** ++ * irq_chip_shutdown_parent - Shutdown the parent interrupt ++ * @data: Pointer to interrupt specific data ++ * ++ * Invokes the irq_shutdown() callback of the parent if available or falls ++ * back to irq_chip_disable_parent(). ++ */ ++void irq_chip_shutdown_parent(struct irq_data *data) ++{ ++ struct irq_data *parent = data->parent_data; ++ ++ if (parent->chip->irq_shutdown) ++ parent->chip->irq_shutdown(parent); ++ else ++ irq_chip_disable_parent(data); ++} ++EXPORT_SYMBOL_GPL(irq_chip_shutdown_parent); ++ ++/** ++ * irq_chip_startup_parent - Startup the parent interrupt ++ * @data: Pointer to interrupt specific data ++ * ++ * Invokes the irq_startup() callback of the parent if available or falls ++ * back to irq_chip_enable_parent(). ++ */ ++unsigned int irq_chip_startup_parent(struct irq_data *data) ++{ ++ struct irq_data *parent = data->parent_data; ++ ++ if (parent->chip->irq_startup) ++ return parent->chip->irq_startup(parent); ++ ++ irq_chip_enable_parent(data); ++ return 0; ++} ++EXPORT_SYMBOL_GPL(irq_chip_startup_parent); ++ + /** + * irq_chip_enable_parent - Enable the parent interrupt (defaults to unmask if + * NULL) +-- +2.51.0 + diff --git a/queue-6.17/genirq-test-depend-on-sparse_irq.patch b/queue-6.17/genirq-test-depend-on-sparse_irq.patch new file mode 100644 index 0000000000..d0c88cddb4 --- /dev/null +++ b/queue-6.17/genirq-test-depend-on-sparse_irq.patch @@ -0,0 +1,52 @@ +From d6e9a3fb3a63360f830e1ad72f33ff18bd6f5909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:59:05 -0700 +Subject: genirq/test: Depend on SPARSE_IRQ + +From: Brian Norris + +[ Upstream commit 0c888bc86d672e551ce5c58b891c8b44f8967643 ] + +Some architectures have a static interrupt layout, with a limited number of +interrupts. Without SPARSE_IRQ, the test may not be able to allocate any +fake interrupts, and the test will fail. (This occurs on ARCH=m68k, for +example.) + +Additionally, managed-affinity is only supported with CONFIG_SPARSE_IRQ=y, +so irq_shutdown_depth_test() and irq_cpuhotplug_test() would fail without +it. + +Add a 'SPARSE_IRQ' dependency to avoid these problems. + +Many architectures 'select SPARSE_IRQ', so this is easy to miss. + +Notably, this also excludes ARCH=um from running any of these tests, even +though some of them might work. + +Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") +Reported-by: Guenter Roeck +Signed-off-by: Brian Norris +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: David Gow +Link: https://lore.kernel.org/all/20250822190140.2154646-5-briannorris@chromium.org +Signed-off-by: Sasha Levin +--- + kernel/irq/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig +index 08088b8e95ae9..a75df2bb9db66 100644 +--- a/kernel/irq/Kconfig ++++ b/kernel/irq/Kconfig +@@ -147,6 +147,7 @@ config GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD + config IRQ_KUNIT_TEST + bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS + depends on KUNIT=y ++ depends on SPARSE_IRQ + default KUNIT_ALL_TESTS + select IRQ_DOMAIN + imply SMP +-- +2.51.0 + diff --git a/queue-6.17/genirq-test-drop-config_generic_irq_migration-assump.patch b/queue-6.17/genirq-test-drop-config_generic_irq_migration-assump.patch new file mode 100644 index 0000000000..d9430a8c2a --- /dev/null +++ b/queue-6.17/genirq-test-drop-config_generic_irq_migration-assump.patch @@ -0,0 +1,64 @@ +From b08b38119b9d1a03d673c94801f5fbd5dade6cb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:59:06 -0700 +Subject: genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions + +From: Brian Norris + +[ Upstream commit add03fdb9d52411cabb3872fb7692df6f4c67586 ] + +Not all platforms use the generic IRQ migration code, even if they select +GENERIC_IRQ_MIGRATION. (See, for example, powerpc / pseries_cpu_disable().) + +If such platforms don't perform managed shutdown the same way, the interrupt +may not actually shut down, and these tests fail: + +[ 4.357022][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:211 +[ 4.357022][ T101] Expected irqd_is_activated(data) to be false, but is true +[ 4.358128][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:212 +[ 4.358128][ T101] Expected irqd_is_started(data) to be false, but is true +[ 4.375558][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:216 +[ 4.375558][ T101] Expected irqd_is_activated(data) to be false, but is true +[ 4.376088][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:217 +[ 4.376088][ T101] Expected irqd_is_started(data) to be false, but is true +[ 4.377851][ T1] # irq_cpuhotplug_test: pass:0 fail:1 skip:0 total:1 +[ 4.377901][ T1] not ok 4 irq_cpuhotplug_test +[ 4.378073][ T1] # irq_test_cases: pass:3 fail:1 skip:0 total:4 + +Rather than test that PowerPC performs migration the same way as the +unterrupt core, just drop the state checks. The point of the test was to +ensure that the code kept |depth| balanced, which still can be tested for. + +Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") +Reported-by: Guenter Roeck +Signed-off-by: Brian Norris +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: David Gow +Link: https://lore.kernel.org/all/20250822190140.2154646-6-briannorris@chromium.org +Signed-off-by: Sasha Levin +--- + kernel/irq/irq_test.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c +index e220e7b2fc187..37568ec714b51 100644 +--- a/kernel/irq/irq_test.c ++++ b/kernel/irq/irq_test.c +@@ -208,13 +208,9 @@ static void irq_cpuhotplug_test(struct kunit *test) + KUNIT_EXPECT_EQ(test, desc->depth, 1); + + KUNIT_EXPECT_EQ(test, remove_cpu(1), 0); +- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data)); +- KUNIT_EXPECT_FALSE(test, irqd_is_started(data)); + KUNIT_EXPECT_GE(test, desc->depth, 1); + KUNIT_EXPECT_EQ(test, add_cpu(1), 0); + +- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data)); +- KUNIT_EXPECT_FALSE(test, irqd_is_started(data)); + KUNIT_EXPECT_EQ(test, desc->depth, 1); + + enable_irq(virq); +-- +2.51.0 + diff --git a/queue-6.17/genirq-test-ensure-cpu-1-is-online-for-hotplug-test.patch b/queue-6.17/genirq-test-ensure-cpu-1-is-online-for-hotplug-test.patch new file mode 100644 index 0000000000..ea0136aa37 --- /dev/null +++ b/queue-6.17/genirq-test-ensure-cpu-1-is-online-for-hotplug-test.patch @@ -0,0 +1,51 @@ +From 4487556ceecee4ff0ed9d48dfb97a097da32fdcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:59:07 -0700 +Subject: genirq/test: Ensure CPU 1 is online for hotplug test + +From: Brian Norris + +[ Upstream commit 8ad25ebfa70e86860559b306bbc923c7db4fcac6 ] + +It's possible to run these tests on platforms that think they have a +hotpluggable CPU1, but for whatever reason, CPU1 is not online and can't be +brought online: + + # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:210 + Expected remove_cpu(1) == 0, but + remove_cpu(1) == 1 (0x1) +CPU1: failed to boot: -38 + # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:214 + Expected add_cpu(1) == 0, but + add_cpu(1) == -38 (0xffffffffffffffda) + +Check that CPU1 is actually online before trying to run the test. + +Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") +Reported-by: Guenter Roeck +Signed-off-by: Brian Norris +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: David Gow +Link: https://lore.kernel.org/all/20250822190140.2154646-7-briannorris@chromium.org +Signed-off-by: Sasha Levin +--- + kernel/irq/irq_test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c +index 37568ec714b51..f71f46fdcfd5e 100644 +--- a/kernel/irq/irq_test.c ++++ b/kernel/irq/irq_test.c +@@ -178,6 +178,8 @@ static void irq_cpuhotplug_test(struct kunit *test) + kunit_skip(test, "requires more than 1 CPU for CPU hotplug"); + if (!cpu_is_hotpluggable(1)) + kunit_skip(test, "CPU 1 must be hotpluggable"); ++ if (!cpu_online(1)) ++ kunit_skip(test, "CPU 1 must be online"); + + cpumask_copy(&affinity.mask, cpumask_of(1)); + +-- +2.51.0 + diff --git a/queue-6.17/genirq-test-fix-depth-tests-on-architectures-with-no.patch b/queue-6.17/genirq-test-fix-depth-tests-on-architectures-with-no.patch new file mode 100644 index 0000000000..222860770d --- /dev/null +++ b/queue-6.17/genirq-test-fix-depth-tests-on-architectures-with-no.patch @@ -0,0 +1,86 @@ +From 3d5f473dff3b1e3718dc015c3d83f7231d011463 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 17:45:28 +0800 +Subject: genirq/test: Fix depth tests on architectures with NOREQUEST by + default. + +From: David Gow + +[ Upstream commit c9163915a93d40e32c4e4aeb942c0adcb190d72e ] + +The new irq KUnit tests fail on some architectures (notably PowerPC and +32-bit ARM), as the request_irq() call fails due to the ARCH_IRQ_INIT_FLAGS +containing IRQ_NOREQUEST, yielding the following errors: + +[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:88 +[10:17:45] Expected ret == 0, but +[10:17:45] ret == -22 (0xffffffffffffffea) +[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:90 +[10:17:45] Expected desc->depth == 0, but +[10:17:45] desc->depth == 1 (0x1) +[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:93 +[10:17:45] Expected desc->depth == 1, but +[10:17:45] desc->depth == 2 (0x2) + +By clearing IRQ_NOREQUEST from the interrupt descriptor, these tests now +pass on ARM and PowerPC. + +Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") +Signed-off-by: David Gow +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Tested-by: Brian Norris +Reviewed-by: Brian Norris +Link: https://lore.kernel.org/all/20250816094528.3560222-2-davidgow@google.com +Signed-off-by: Sasha Levin +--- + kernel/irq/irq_test.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c +index a75abebed7f24..e220e7b2fc187 100644 +--- a/kernel/irq/irq_test.c ++++ b/kernel/irq/irq_test.c +@@ -54,6 +54,9 @@ static void irq_disable_depth_test(struct kunit *test) + desc = irq_to_desc(virq); + KUNIT_ASSERT_PTR_NE(test, desc, NULL); + ++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */ ++ irq_settings_clr_norequest(desc); ++ + ret = request_irq(virq, noop_handler, 0, "test_irq", NULL); + KUNIT_EXPECT_EQ(test, ret, 0); + +@@ -81,6 +84,9 @@ static void irq_free_disabled_test(struct kunit *test) + desc = irq_to_desc(virq); + KUNIT_ASSERT_PTR_NE(test, desc, NULL); + ++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */ ++ irq_settings_clr_norequest(desc); ++ + ret = request_irq(virq, noop_handler, 0, "test_irq", NULL); + KUNIT_EXPECT_EQ(test, ret, 0); + +@@ -120,6 +126,9 @@ static void irq_shutdown_depth_test(struct kunit *test) + desc = irq_to_desc(virq); + KUNIT_ASSERT_PTR_NE(test, desc, NULL); + ++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */ ++ irq_settings_clr_norequest(desc); ++ + data = irq_desc_get_irq_data(desc); + KUNIT_ASSERT_PTR_NE(test, data, NULL); + +@@ -180,6 +189,9 @@ static void irq_cpuhotplug_test(struct kunit *test) + desc = irq_to_desc(virq); + KUNIT_ASSERT_PTR_NE(test, desc, NULL); + ++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */ ++ irq_settings_clr_norequest(desc); ++ + data = irq_desc_get_irq_data(desc); + KUNIT_ASSERT_PTR_NE(test, data, NULL); + +-- +2.51.0 + diff --git a/queue-6.17/genirq-test-select-irq_domain.patch b/queue-6.17/genirq-test-select-irq_domain.patch new file mode 100644 index 0000000000..d9c174eb3c --- /dev/null +++ b/queue-6.17/genirq-test-select-irq_domain.patch @@ -0,0 +1,39 @@ +From f1e168d846ba580a9b3f3a47c545745e81b09d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:59:02 -0700 +Subject: genirq/test: Select IRQ_DOMAIN + +From: Brian Norris + +[ Upstream commit f8a44f9babd054ff19e20a30cab661d716ad5459 ] + +These tests use irq_domain_alloc_descs() and so require CONFIG_IRQ_DOMAIN. + +Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") +Reported-by: Guenter Roeck +Signed-off-by: Brian Norris +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: David Gow +Link: https://lore.kernel.org/all/20250822190140.2154646-2-briannorris@chromium.org +Closes: https://lore.kernel.org/lkml/ded44edf-eeb7-420c-b8a8-d6543b955e6e@roeck-us.net/ +Signed-off-by: Sasha Levin +--- + kernel/irq/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig +index 1da5e9d9da719..08088b8e95ae9 100644 +--- a/kernel/irq/Kconfig ++++ b/kernel/irq/Kconfig +@@ -148,6 +148,7 @@ config IRQ_KUNIT_TEST + bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS + depends on KUNIT=y + default KUNIT_ALL_TESTS ++ select IRQ_DOMAIN + imply SMP + help + This option enables KUnit tests for the IRQ subsystem API. These are +-- +2.51.0 + diff --git a/queue-6.17/gfs2-add-proper-lockspace-locking.patch b/queue-6.17/gfs2-add-proper-lockspace-locking.patch new file mode 100644 index 0000000000..96e9b8d50a --- /dev/null +++ b/queue-6.17/gfs2-add-proper-lockspace-locking.patch @@ -0,0 +1,212 @@ +From 3ba5405100206de3d417ba0ed56bafda4e7c10f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jul 2025 14:31:41 +0200 +Subject: gfs2: Add proper lockspace locking + +From: Andreas Gruenbacher + +[ Upstream commit 6ab26555c9ffef96c56ca16356e55ac5ab61ec93 ] + +GFS2 has been calling functions like dlm_lock() even after the lockspace +that these functions operate on has been released with +dlm_release_lockspace(). It has always assumed that those functions +would return -EINVAL in that case, but that was never guaranteed, and it +certainly is no longer the case since commit 4db41bf4f04f ("dlm: remove +ls_local_handle from struct dlm_ls"). + +To fix that, add proper lockspace locking. + +Fixes: 3e11e5304150 ("GFS2: ignore unlock failures after withdraw") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 23 +++++++++++++++-------- + fs/gfs2/glock.c | 5 ++--- + fs/gfs2/incore.h | 2 ++ + fs/gfs2/lock_dlm.c | 46 +++++++++++++++++++++++++++++++++++++--------- + 4 files changed, 56 insertions(+), 20 deletions(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 72d95185a39f6..bc67fa058c845 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1442,6 +1442,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl) + struct gfs2_inode *ip = GFS2_I(file->f_mapping->host); + struct gfs2_sbd *sdp = GFS2_SB(file->f_mapping->host); + struct lm_lockstruct *ls = &sdp->sd_lockstruct; ++ int ret; + + if (!(fl->c.flc_flags & FL_POSIX)) + return -ENOLCK; +@@ -1450,14 +1451,20 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl) + locks_lock_file_wait(file, fl); + return -EIO; + } +- if (cmd == F_CANCELLK) +- return dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl); +- else if (IS_GETLK(cmd)) +- return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl); +- else if (lock_is_unlock(fl)) +- return dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl); +- else +- return dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl); ++ down_read(&ls->ls_sem); ++ ret = -ENODEV; ++ if (likely(ls->ls_dlm != NULL)) { ++ if (cmd == F_CANCELLK) ++ ret = dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl); ++ else if (IS_GETLK(cmd)) ++ ret = dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl); ++ else if (lock_is_unlock(fl)) ++ ret = dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl); ++ else ++ ret = dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl); ++ } ++ up_read(&ls->ls_sem); ++ return ret; + } + + static void __flock_holder_uninit(struct file *file, struct gfs2_holder *fl_gh) +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 54c011ff00ddc..a6535413a0b46 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -800,9 +800,8 @@ __acquires(&gl->gl_lockref.lock) + } + clear_bit(GLF_PENDING_REPLY, &gl->gl_flags); + +- if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && +- target == LM_ST_UNLOCKED && +- test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { ++ if (ret == -ENODEV && gl->gl_target == LM_ST_UNLOCKED && ++ target == LM_ST_UNLOCKED) { + /* + * The lockspace has been released and the lock has + * been unlocked implicitly. +diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h +index c390f208654c1..3fcb7ab198d47 100644 +--- a/fs/gfs2/incore.h ++++ b/fs/gfs2/incore.h +@@ -657,6 +657,8 @@ struct lm_lockstruct { + struct completion ls_sync_wait; /* {control,mounted}_{lock,unlock} */ + char *ls_lvb_bits; + ++ struct rw_semaphore ls_sem; ++ + spinlock_t ls_recover_spin; /* protects following fields */ + unsigned long ls_recover_flags; /* DFL_ */ + uint32_t ls_recover_mount; /* gen in first recover_done cb */ +diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c +index 5daaeaaaf18dd..6db37c20587d1 100644 +--- a/fs/gfs2/lock_dlm.c ++++ b/fs/gfs2/lock_dlm.c +@@ -329,8 +329,13 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state, + */ + + again: +- error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname, +- GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast); ++ down_read(&ls->ls_sem); ++ error = -ENODEV; ++ if (likely(ls->ls_dlm != NULL)) { ++ error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname, ++ GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast); ++ } ++ up_read(&ls->ls_sem); + if (error == -EBUSY) { + msleep(20); + goto again; +@@ -379,8 +384,13 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + flags |= DLM_LKF_VALBLK; + + again: +- error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags, +- NULL, gl); ++ down_read(&ls->ls_sem); ++ error = -ENODEV; ++ if (likely(ls->ls_dlm != NULL)) { ++ error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags, ++ NULL, gl); ++ } ++ up_read(&ls->ls_sem); + if (error == -EBUSY) { + msleep(20); + goto again; +@@ -396,7 +406,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + static void gdlm_cancel(struct gfs2_glock *gl) + { + struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct; +- dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl); ++ ++ down_read(&ls->ls_sem); ++ if (likely(ls->ls_dlm != NULL)) { ++ dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl); ++ } ++ up_read(&ls->ls_sem); + } + + /* +@@ -577,7 +592,11 @@ static int sync_unlock(struct gfs2_sbd *sdp, struct dlm_lksb *lksb, char *name) + struct lm_lockstruct *ls = &sdp->sd_lockstruct; + int error; + +- error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls); ++ down_read(&ls->ls_sem); ++ error = -ENODEV; ++ if (likely(ls->ls_dlm != NULL)) ++ error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls); ++ up_read(&ls->ls_sem); + if (error) { + fs_err(sdp, "%s lkid %x error %d\n", + name, lksb->sb_lkid, error); +@@ -604,9 +623,14 @@ static int sync_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags, + memset(strname, 0, GDLM_STRNAME_BYTES); + snprintf(strname, GDLM_STRNAME_BYTES, "%8x%16x", LM_TYPE_NONDISK, num); + +- error = dlm_lock(ls->ls_dlm, mode, lksb, flags, +- strname, GDLM_STRNAME_BYTES - 1, +- 0, sync_wait_cb, ls, NULL); ++ down_read(&ls->ls_sem); ++ error = -ENODEV; ++ if (likely(ls->ls_dlm != NULL)) { ++ error = dlm_lock(ls->ls_dlm, mode, lksb, flags, ++ strname, GDLM_STRNAME_BYTES - 1, ++ 0, sync_wait_cb, ls, NULL); ++ } ++ up_read(&ls->ls_sem); + if (error) { + fs_err(sdp, "%s lkid %x flags %x mode %d error %d\n", + name, lksb->sb_lkid, flags, mode, error); +@@ -1333,6 +1357,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table) + */ + + INIT_DELAYED_WORK(&sdp->sd_control_work, gfs2_control_func); ++ ls->ls_dlm = NULL; + spin_lock_init(&ls->ls_recover_spin); + ls->ls_recover_flags = 0; + ls->ls_recover_mount = 0; +@@ -1367,6 +1392,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table) + * create/join lockspace + */ + ++ init_rwsem(&ls->ls_sem); + error = dlm_new_lockspace(fsname, cluster, flags, GDLM_LVB_SIZE, + &gdlm_lockspace_ops, sdp, &ops_result, + &ls->ls_dlm); +@@ -1446,10 +1472,12 @@ static void gdlm_unmount(struct gfs2_sbd *sdp) + + /* mounted_lock and control_lock will be purged in dlm recovery */ + release: ++ down_write(&ls->ls_sem); + if (ls->ls_dlm) { + dlm_release_lockspace(ls->ls_dlm, 2); + ls->ls_dlm = NULL; + } ++ up_write(&ls->ls_sem); + + free_recover_size(ls); + } +-- +2.51.0 + diff --git a/queue-6.17/gfs2-do_xmote-cleanup.patch b/queue-6.17/gfs2-do_xmote-cleanup.patch new file mode 100644 index 0000000000..42941aa5ed --- /dev/null +++ b/queue-6.17/gfs2-do_xmote-cleanup.patch @@ -0,0 +1,56 @@ +From 206c0ba2ab3f59d082c9340da062f1d995999ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 19:13:32 +0200 +Subject: gfs2: do_xmote cleanup + +From: Andreas Gruenbacher + +[ Upstream commit 2309a01351e56446f43c89e200d643647d47e739 ] + +Check for asynchronous completion and clear the GLF_PENDING_REPLY flag +earlier in do_xmote(). This will make future changes more readable. + +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Stable-dep-of: 6ab26555c9ff ("gfs2: Add proper lockspace locking") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 68e943e13dd53..54c011ff00ddc 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -794,6 +794,12 @@ __acquires(&gl->gl_lockref.lock) + ret = ls->ls_ops->lm_lock(gl, target, lck_flags); + spin_lock(&gl->gl_lockref.lock); + ++ if (!ret) { ++ /* The operation will be completed asynchronously. */ ++ return; ++ } ++ clear_bit(GLF_PENDING_REPLY, &gl->gl_flags); ++ + if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && + target == LM_ST_UNLOCKED && + test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { +@@ -801,14 +807,10 @@ __acquires(&gl->gl_lockref.lock) + * The lockspace has been released and the lock has + * been unlocked implicitly. + */ +- } else if (ret) { ++ } else { + fs_err(sdp, "lm_lock ret %d\n", ret); + target = gl->gl_state | LM_OUT_ERROR; +- } else { +- /* The operation will be completed asynchronously. */ +- return; + } +- clear_bit(GLF_PENDING_REPLY, &gl->gl_flags); + } + + /* Complete the operation now. */ +-- +2.51.0 + diff --git a/queue-6.17/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch b/queue-6.17/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch new file mode 100644 index 0000000000..52ae859561 --- /dev/null +++ b/queue-6.17/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch @@ -0,0 +1,37 @@ +From 4df2c6c474a6d6237adcc0978c67f80a594a9481 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 23:57:24 +0200 +Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote + +From: Andreas Gruenbacher + +[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ] + +Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS +flag a second time after it has already been cleared. Fix that. + +Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index b6fd1cb17de7b..edb105f9da059 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -805,8 +805,6 @@ __acquires(&gl->gl_lockref.lock) + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); + return; +- } else { +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/gfs2-fix-lm_flag_try-logic-in-add_to_queue.patch b/queue-6.17/gfs2-fix-lm_flag_try-logic-in-add_to_queue.patch new file mode 100644 index 0000000000..ecdb80487c --- /dev/null +++ b/queue-6.17/gfs2-fix-lm_flag_try-logic-in-add_to_queue.patch @@ -0,0 +1,127 @@ +From 18908e11c677b06a01c30da6cd7c5bf3d1e176b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 22:31:59 +0200 +Subject: gfs2: Fix LM_FLAG_TRY* logic in add_to_queue + +From: Andreas Gruenbacher + +[ Upstream commit 0c23e24164d83086e75581b0cf930f4e161636d6 ] + +The logic in add_to_queue() for determining whether a LM_FLAG_TRY or +LM_FLAG_TRY_1CB holder should be queued does not make any sense: we are +interested in wether or not the new operation will block behind an +existing or future holder in the queue, but the current code checks for +ongoing locking or ->go_inval() operations, which has little to do with +that. + +Replace that code with something more sensible, remove the incorrect +add_to_queue() function annotations, remove the similarly misguided +do_error(gl, 0) call in do_xmote(), and add a missing comment to the +same call in do_promote(). + +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 47 ++++++++++++++++++++++++----------------------- + 1 file changed, 24 insertions(+), 23 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 45dd73bb884fd..5edf125b39fe3 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -502,7 +502,7 @@ static bool do_promote(struct gfs2_glock *gl) + */ + if (list_is_first(&gh->gh_list, &gl->gl_holders)) + return false; +- do_error(gl, 0); ++ do_error(gl, 0); /* Fail queued try locks */ + break; + } + set_bit(HIF_HOLDER, &gh->gh_iflags); +@@ -713,7 +713,6 @@ __acquires(&gl->gl_lockref.lock) + if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS, + &gl->gl_flags)) + return; +- do_error(gl, 0); /* Fail queued try locks */ + } + if (!glops->go_inval && !glops->go_sync) + goto skip_inval; +@@ -1454,6 +1453,24 @@ void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...) + va_end(args); + } + ++static bool gfs2_should_queue_trylock(struct gfs2_glock *gl, ++ struct gfs2_holder *gh) ++{ ++ struct gfs2_holder *current_gh, *gh2; ++ ++ current_gh = find_first_holder(gl); ++ if (current_gh && !may_grant(gl, current_gh, gh)) ++ return false; ++ ++ list_for_each_entry(gh2, &gl->gl_holders, gh_list) { ++ if (test_bit(HIF_HOLDER, &gh2->gh_iflags)) ++ continue; ++ if (!(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) ++ return false; ++ } ++ return true; ++} ++ + static inline bool pid_is_meaningful(const struct gfs2_holder *gh) + { + if (!(gh->gh_flags & GL_NOPID)) +@@ -1472,27 +1489,20 @@ static inline bool pid_is_meaningful(const struct gfs2_holder *gh) + */ + + static inline void add_to_queue(struct gfs2_holder *gh) +-__releases(&gl->gl_lockref.lock) +-__acquires(&gl->gl_lockref.lock) + { + struct gfs2_glock *gl = gh->gh_gl; + struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; + struct gfs2_holder *gh2; +- int try_futile = 0; + + GLOCK_BUG_ON(gl, gh->gh_owner_pid == NULL); + if (test_and_set_bit(HIF_WAIT, &gh->gh_iflags)) + GLOCK_BUG_ON(gl, true); + +- if (gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) { +- if (test_bit(GLF_LOCK, &gl->gl_flags)) { +- struct gfs2_holder *current_gh; +- +- current_gh = find_first_holder(gl); +- try_futile = !may_grant(gl, current_gh, gh); +- } +- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) +- goto fail; ++ if ((gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) && ++ !gfs2_should_queue_trylock(gl, gh)) { ++ gh->gh_error = GLR_TRYFAILED; ++ gfs2_holder_wake(gh); ++ return; + } + + list_for_each_entry(gh2, &gl->gl_holders, gh_list) { +@@ -1504,15 +1514,6 @@ __acquires(&gl->gl_lockref.lock) + continue; + goto trap_recursive; + } +- list_for_each_entry(gh2, &gl->gl_holders, gh_list) { +- if (try_futile && +- !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) { +-fail: +- gh->gh_error = GLR_TRYFAILED; +- gfs2_holder_wake(gh); +- return; +- } +- } + trace_gfs2_glock_queue(gh, 1); + gfs2_glstats_inc(gl, GFS2_LKS_QCOUNT); + gfs2_sbstats_inc(gl, GFS2_LKS_QCOUNT); +-- +2.51.0 + diff --git a/queue-6.17/gfs2-further-sanitize-lock_dlm.c.patch b/queue-6.17/gfs2-further-sanitize-lock_dlm.c.patch new file mode 100644 index 0000000000..bee7e98309 --- /dev/null +++ b/queue-6.17/gfs2-further-sanitize-lock_dlm.c.patch @@ -0,0 +1,161 @@ +From bb8887438e21fc8b06ecfb899945c95a3ec2d5d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 10:21:33 +0200 +Subject: gfs2: Further sanitize lock_dlm.c + +From: Andreas Gruenbacher + +[ Upstream commit fd70ab7155c4b92a9747d42c02791a0793ab9c66 ] + +The gl_req field and GLF_BLOCKING flag are only relevant to gdlm_lock(), +its callback gdlm_ast(), and their helpers, so set and clear them inside +lock_dlm.c. + +Also, the LM_FLAG_ANY flag is relevant to gdlm_lock(), but do_xmote() +doesn't pass that flag down to gdlm_lock() as it should. Fix that by +passing down all the flags. + +In addition, document the effect of the LM_FLAG_ANY flag on locks held +in EX mode locally. + +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 6 ------ + fs/gfs2/glock.h | 4 ++++ + fs/gfs2/lock_dlm.c | 26 ++++++++++++++++++-------- + 3 files changed, 22 insertions(+), 14 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 3d5cf9c24d78b..45dd73bb884fd 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -715,12 +715,6 @@ __acquires(&gl->gl_lockref.lock) + return; + do_error(gl, 0); /* Fail queued try locks */ + } +- gl->gl_req = target; +- set_bit(GLF_BLOCKING, &gl->gl_flags); +- if ((gl->gl_req == LM_ST_UNLOCKED) || +- (gl->gl_state == LM_ST_EXCLUSIVE) || +- (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB))) +- clear_bit(GLF_BLOCKING, &gl->gl_flags); + if (!glops->go_inval && !glops->go_sync) + goto skip_inval; + +diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h +index 9339a3bff6eeb..d041b922b45e3 100644 +--- a/fs/gfs2/glock.h ++++ b/fs/gfs2/glock.h +@@ -68,6 +68,10 @@ enum { + * also be granted in SHARED. The preferred state is whichever is compatible + * with other granted locks, or the specified state if no other locks exist. + * ++ * In addition, when a lock is already held in EX mode locally, a SHARED or ++ * DEFERRED mode request with the LM_FLAG_ANY flag set will be granted. ++ * (The LM_FLAG_ANY flag is only use for SHARED mode requests currently.) ++ * + * LM_FLAG_NODE_SCOPE + * This holder agrees to share the lock within this node. In other words, + * the glock is held in EX mode according to DLM, but local holders on the +diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c +index cee5d199d2d87..5daaeaaaf18dd 100644 +--- a/fs/gfs2/lock_dlm.c ++++ b/fs/gfs2/lock_dlm.c +@@ -58,6 +58,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index, + /** + * gfs2_update_reply_times - Update locking statistics + * @gl: The glock to update ++ * @blocking: The operation may have been blocking + * + * This assumes that gl->gl_dstamp has been set earlier. + * +@@ -72,12 +73,12 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index, + * TRY_1CB flags are set are classified as non-blocking. All + * other DLM requests are counted as (potentially) blocking. + */ +-static inline void gfs2_update_reply_times(struct gfs2_glock *gl) ++static inline void gfs2_update_reply_times(struct gfs2_glock *gl, ++ bool blocking) + { + struct gfs2_pcpu_lkstats *lks; + const unsigned gltype = gl->gl_name.ln_type; +- unsigned index = test_bit(GLF_BLOCKING, &gl->gl_flags) ? +- GFS2_LKS_SRTTB : GFS2_LKS_SRTT; ++ unsigned index = blocking ? GFS2_LKS_SRTTB : GFS2_LKS_SRTT; + s64 rtt; + + preempt_disable(); +@@ -119,14 +120,18 @@ static inline void gfs2_update_request_times(struct gfs2_glock *gl) + static void gdlm_ast(void *arg) + { + struct gfs2_glock *gl = arg; ++ bool blocking; + unsigned ret; + ++ blocking = test_bit(GLF_BLOCKING, &gl->gl_flags); ++ gfs2_update_reply_times(gl, blocking); ++ clear_bit(GLF_BLOCKING, &gl->gl_flags); ++ + /* If the glock is dead, we only react to a dlm_unlock() reply. */ + if (__lockref_is_dead(&gl->gl_lockref) && + gl->gl_lksb.sb_status != -DLM_EUNLOCK) + return; + +- gfs2_update_reply_times(gl); + BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED); + + if ((gl->gl_lksb.sb_flags & DLM_SBF_VALNOTVALID) && gl->gl_lksb.sb_lvbptr) +@@ -241,7 +246,7 @@ static bool down_conversion(int cur, int req) + } + + static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags, +- const int cur, const int req) ++ const int req, bool blocking) + { + u32 lkf = 0; + +@@ -274,7 +279,7 @@ static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags, + * "upward" lock conversions or else DLM will reject the + * request as invalid. + */ +- if (!down_conversion(cur, req)) ++ if (blocking) + lkf |= DLM_LKF_QUECVT; + } + +@@ -294,14 +299,20 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state, + unsigned int flags) + { + struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct; ++ bool blocking; + int cur, req; + u32 lkf; + char strname[GDLM_STRNAME_BYTES] = ""; + int error; + ++ gl->gl_req = req_state; + cur = make_mode(gl->gl_name.ln_sbd, gl->gl_state); + req = make_mode(gl->gl_name.ln_sbd, req_state); +- lkf = make_flags(gl, flags, cur, req); ++ blocking = !down_conversion(cur, req) && ++ !(flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB)); ++ lkf = make_flags(gl, flags, req, blocking); ++ if (blocking) ++ set_bit(GLF_BLOCKING, &gl->gl_flags); + gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT); + gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT); + if (test_bit(GLF_INITIAL, &gl->gl_flags)) { +@@ -341,7 +352,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl) + return; + } + +- clear_bit(GLF_BLOCKING, &gl->gl_flags); + gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT); + gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT); + gfs2_update_request_times(gl); +-- +2.51.0 + diff --git a/queue-6.17/gfs2-get-rid-of-glf_invalidate_in_progress.patch b/queue-6.17/gfs2-get-rid-of-glf_invalidate_in_progress.patch new file mode 100644 index 0000000000..18c07e07bd --- /dev/null +++ b/queue-6.17/gfs2-get-rid-of-glf_invalidate_in_progress.patch @@ -0,0 +1,106 @@ +From 105fe0baead79bb6f28e3070a932312792ad467f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 23:26:12 +0200 +Subject: gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS + +From: Andreas Gruenbacher + +[ Upstream commit bddb53b776fb7ce81dfba7c24884d9f2c0c68e50 ] + +Get rid of the GLF_INVALIDATE_IN_PROGRESS flag: it was originally used +to indicate to add_to_queue() that the ->go_sync() and ->go_invalid() +operations were in progress, but as we have established in commit "gfs2: +Fix LM_FLAG_TRY* logic in add_to_queue", add_to_queue() has no need to +know. + +Commit d99724c3c36a describes a race in which GLF_INVALIDATE_IN_PROGRESS +is used to serialize two processes which are both in do_xmote() at the +same time. That analysis is wrong: the serialization happens via the +GLF_LOCK flag, which ensures that at most one glock operation can be +active at any time. + +Fixes: d99724c3c36a ("gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 16 +--------------- + fs/gfs2/incore.h | 1 - + fs/gfs2/trace_gfs2.h | 1 - + 3 files changed, 1 insertion(+), 17 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 93aae10d78f30..68e943e13dd53 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -703,17 +703,6 @@ __acquires(&gl->gl_lockref.lock) + lck_flags &= (LM_FLAG_TRY | LM_FLAG_TRY_1CB | LM_FLAG_NOEXP); + GLOCK_BUG_ON(gl, gl->gl_state == target); + GLOCK_BUG_ON(gl, gl->gl_state == gl->gl_target); +- if ((target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) && +- glops->go_inval) { +- /* +- * If another process is already doing the invalidate, let that +- * finish first. The glock state machine will get back to this +- * holder again later. +- */ +- if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS, +- &gl->gl_flags)) +- return; +- } + if (!glops->go_inval || !glops->go_sync) + goto skip_inval; + +@@ -732,7 +721,7 @@ __acquires(&gl->gl_lockref.lock) + goto skip_inval; + } + +- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) { ++ if (target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) { + /* + * The call to go_sync should have cleared out the ail list. + * If there are still items, we have a problem. We ought to +@@ -747,7 +736,6 @@ __acquires(&gl->gl_lockref.lock) + gfs2_dump_glock(NULL, gl, true); + } + glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA); +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + spin_lock(&gl->gl_lockref.lock); + +@@ -2313,8 +2301,6 @@ static const char *gflags2str(char *buf, const struct gfs2_glock *gl) + *p++ = 'y'; + if (test_bit(GLF_LFLUSH, gflags)) + *p++ = 'f'; +- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, gflags)) +- *p++ = 'i'; + if (test_bit(GLF_PENDING_REPLY, gflags)) + *p++ = 'R'; + if (test_bit(GLF_HAVE_REPLY, gflags)) +diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h +index d4ad82f47eeea..c390f208654c1 100644 +--- a/fs/gfs2/incore.h ++++ b/fs/gfs2/incore.h +@@ -319,7 +319,6 @@ enum { + GLF_DEMOTE_IN_PROGRESS = 5, + GLF_DIRTY = 6, + GLF_LFLUSH = 7, +- GLF_INVALIDATE_IN_PROGRESS = 8, + GLF_HAVE_REPLY = 9, + GLF_INITIAL = 10, + GLF_HAVE_FROZEN_REPLY = 11, +diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h +index 26036ffc3f338..1c2507a273180 100644 +--- a/fs/gfs2/trace_gfs2.h ++++ b/fs/gfs2/trace_gfs2.h +@@ -52,7 +52,6 @@ + {(1UL << GLF_DEMOTE_IN_PROGRESS), "p" }, \ + {(1UL << GLF_DIRTY), "y" }, \ + {(1UL << GLF_LFLUSH), "f" }, \ +- {(1UL << GLF_INVALIDATE_IN_PROGRESS), "i" }, \ + {(1UL << GLF_PENDING_REPLY), "R" }, \ + {(1UL << GLF_HAVE_REPLY), "r" }, \ + {(1UL << GLF_INITIAL), "a" }, \ +-- +2.51.0 + diff --git a/queue-6.17/gfs2-remove-duplicate-check-in-do_xmote.patch b/queue-6.17/gfs2-remove-duplicate-check-in-do_xmote.patch new file mode 100644 index 0000000000..06c8e55e62 --- /dev/null +++ b/queue-6.17/gfs2-remove-duplicate-check-in-do_xmote.patch @@ -0,0 +1,67 @@ +From 9a78f0eaa031cdc44a88a0a6511c06567b7ce03a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 23:18:45 +0200 +Subject: gfs2: Remove duplicate check in do_xmote + +From: Andreas Gruenbacher + +[ Upstream commit 9b54770b68ae793a3a8d378be4cda2bb7be6c8cc ] + +In do_xmote(), remove the duplicate check for the ->go_sync and +->go_inval glock operations. They are either both defined, or none of +them are. + +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 5edf125b39fe3..93aae10d78f30 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -714,25 +714,24 @@ __acquires(&gl->gl_lockref.lock) + &gl->gl_flags)) + return; + } +- if (!glops->go_inval && !glops->go_sync) ++ if (!glops->go_inval || !glops->go_sync) + goto skip_inval; + + spin_unlock(&gl->gl_lockref.lock); +- if (glops->go_sync) { +- ret = glops->go_sync(gl); +- /* If we had a problem syncing (due to io errors or whatever, +- * we should not invalidate the metadata or tell dlm to +- * release the glock to other nodes. +- */ +- if (ret) { +- if (cmpxchg(&sdp->sd_log_error, 0, ret)) { +- fs_err(sdp, "Error %d syncing glock\n", ret); +- gfs2_dump_glock(NULL, gl, true); +- } +- spin_lock(&gl->gl_lockref.lock); +- goto skip_inval; ++ ret = glops->go_sync(gl); ++ /* If we had a problem syncing (due to io errors or whatever, ++ * we should not invalidate the metadata or tell dlm to ++ * release the glock to other nodes. ++ */ ++ if (ret) { ++ if (cmpxchg(&sdp->sd_log_error, 0, ret)) { ++ fs_err(sdp, "Error %d syncing glock\n", ret); ++ gfs2_dump_glock(NULL, gl, true); + } ++ spin_lock(&gl->gl_lockref.lock); ++ goto skip_inval; + } ++ + if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) { + /* + * The call to go_sync should have cleared out the ail list. +-- +2.51.0 + diff --git a/queue-6.17/gfs2-remove-space-before-newline.patch b/queue-6.17/gfs2-remove-space-before-newline.patch new file mode 100644 index 0000000000..9d1ca71e90 --- /dev/null +++ b/queue-6.17/gfs2-remove-space-before-newline.patch @@ -0,0 +1,37 @@ +From eba69c0ce0af3470300bdcf6e7a8a57ae96e060c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 12:36:38 +0100 +Subject: gfs2: Remove space before newline + +From: Colin Ian King + +[ Upstream commit aa94ad9ab230d08741e6630a20fd1296b52c1009 ] + +There is an extraneous space before a newline in a fs_err message. +Remove it + +Signed-off-by: Colin Ian King +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS") +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index edb105f9da059..3d5cf9c24d78b 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -733,7 +733,7 @@ __acquires(&gl->gl_lockref.lock) + */ + if (ret) { + if (cmpxchg(&sdp->sd_log_error, 0, ret)) { +- fs_err(sdp, "Error %d syncing glock \n", ret); ++ fs_err(sdp, "Error %d syncing glock\n", ret); + gfs2_dump_glock(NULL, gl, true); + } + spin_lock(&gl->gl_lockref.lock); +-- +2.51.0 + diff --git a/queue-6.17/gpio-todo-remove-the-task-for-converting-to-the-new-.patch b/queue-6.17/gpio-todo-remove-the-task-for-converting-to-the-new-.patch new file mode 100644 index 0000000000..34c900d83c --- /dev/null +++ b/queue-6.17/gpio-todo-remove-the-task-for-converting-to-the-new-.patch @@ -0,0 +1,46 @@ +From f3ace52de88566529e304adce0d528d12533f676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 15:00:01 +0200 +Subject: gpio: TODO: remove the task for converting to the new line setters + +From: Geert Uytterhoeven + +[ Upstream commit 6ec4b94e8e959b4201ca0bfc43fa50dc946d10cb ] + +The task is complete, but this was not reflected in the TODO file. + +Fixes: d9d87d90cc0b10cd ("treewide: rename GPIO set callbacks back to their original names") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/417af7e5a110c527eb759289bd5d2fd6885f4e01.1754917104.git.geert+renesas@glider.be +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/TODO | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/gpio/TODO b/drivers/gpio/TODO +index 7a09a4f58551b..b797499e627ee 100644 +--- a/drivers/gpio/TODO ++++ b/drivers/gpio/TODO +@@ -176,18 +176,6 @@ cannot be converted yet, but watch this space! + + ------------------------------------------------------------------------------- + +-Convert all GPIO chips to using the new, value returning line setters +- +-struct gpio_chip's set() and set_multiple() callbacks are now deprecated. They +-return void and thus do not allow drivers to indicate failure to set the line +-value back to the caller. +- +-We've now added new variants - set_rv() and set_multiple_rv() that return an +-integer. Let's convert all GPIO drivers treewide to use the new callbacks, +-remove the old ones and finally rename the new ones back to the old names. +- +-------------------------------------------------------------------------------- +- + Remove legacy sysfs features + + We have two parallel per-chip class devices and per-exported-line attribute +-- +2.51.0 + diff --git a/queue-6.17/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch b/queue-6.17/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch new file mode 100644 index 0000000000..93640403b1 --- /dev/null +++ b/queue-6.17/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch @@ -0,0 +1,186 @@ +From 854deab64be97b77df698e73aae0d1a5fc01e0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:13:16 +0800 +Subject: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() + +From: Kang Chen + +[ Upstream commit bea3e1d4467bcf292c8e54f080353d556d355e26 ] + +BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186 +Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290 + +CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full) +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0xca/0x5f0 mm/kasan/report.c:482 + kasan_report+0xca/0x100 mm/kasan/report.c:595 + hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186 + hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738 + vfs_listxattr+0xbe/0x140 fs/xattr.c:493 + listxattr+0xee/0x190 fs/xattr.c:924 + filename_listxattr fs/xattr.c:958 [inline] + path_listxattrat+0x143/0x360 fs/xattr.c:988 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7fe0e9fae16d +Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 +RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 +RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000 + + +Allocated by task 14290: + kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 + kasan_save_track+0x14/0x30 mm/kasan/common.c:68 + poison_kmalloc_redzone mm/kasan/common.c:377 [inline] + __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 + kasan_kmalloc include/linux/kasan.h:260 [inline] + __do_kmalloc_node mm/slub.c:4333 [inline] + __kmalloc_noprof+0x219/0x540 mm/slub.c:4345 + kmalloc_noprof include/linux/slab.h:909 [inline] + hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21 + hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697 + vfs_listxattr+0xbe/0x140 fs/xattr.c:493 + listxattr+0xee/0x190 fs/xattr.c:924 + filename_listxattr fs/xattr.c:958 [inline] + path_listxattrat+0x143/0x360 fs/xattr.c:988 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +When hfsplus_uni2asc is called from hfsplus_listxattr, +it actually passes in a struct hfsplus_attr_unistr*. +The size of the corresponding structure is different from that of hfsplus_unistr, +so the previous fix (94458781aee6) is insufficient. +The pointer on the unicode buffer is still going beyond the allocated memory. + +This patch introduces two warpper functions hfsplus_uni2asc_xattr_str and +hfsplus_uni2asc_str to process two unicode buffers, +struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively. +When ustrlen value is bigger than the allocated memory size, +the ustrlen value is limited to an safe size. + +Fixes: 94458781aee6 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()") +Signed-off-by: Kang Chen +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Viacheslav Dubeyko +Link: https://lore.kernel.org/r/20250909031316.1647094-1-k.chen@smail.nju.edu.cn +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Sasha Levin +--- + fs/hfsplus/dir.c | 2 +- + fs/hfsplus/hfsplus_fs.h | 8 ++++++-- + fs/hfsplus/unicode.c | 24 +++++++++++++++++++----- + fs/hfsplus/xattr.c | 6 +++--- + 4 files changed, 29 insertions(+), 11 deletions(-) + +diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c +index 876bbb80fb4dc..1b3e27a0d5e03 100644 +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -204,7 +204,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx) + fd.entrylength); + type = be16_to_cpu(entry.type); + len = NLS_MAX_CHARSET_SIZE * HFSPLUS_MAX_STRLEN; +- err = hfsplus_uni2asc(sb, &fd.key->cat.name, strbuf, &len); ++ err = hfsplus_uni2asc_str(sb, &fd.key->cat.name, strbuf, &len); + if (err) + goto out; + if (type == HFSPLUS_FOLDER) { +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index 96a5c24813dd6..2311e4be4e865 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -521,8 +521,12 @@ int hfsplus_strcasecmp(const struct hfsplus_unistr *s1, + const struct hfsplus_unistr *s2); + int hfsplus_strcmp(const struct hfsplus_unistr *s1, + const struct hfsplus_unistr *s2); +-int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr, +- char *astr, int *len_p); ++int hfsplus_uni2asc_str(struct super_block *sb, ++ const struct hfsplus_unistr *ustr, char *astr, ++ int *len_p); ++int hfsplus_uni2asc_xattr_str(struct super_block *sb, ++ const struct hfsplus_attr_unistr *ustr, ++ char *astr, int *len_p); + int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr, + int max_unistr_len, const char *astr, int len); + int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str); +diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c +index 36b6cf2a3abba..862ba27f1628a 100644 +--- a/fs/hfsplus/unicode.c ++++ b/fs/hfsplus/unicode.c +@@ -119,9 +119,8 @@ static u16 *hfsplus_compose_lookup(u16 *p, u16 cc) + return NULL; + } + +-int hfsplus_uni2asc(struct super_block *sb, +- const struct hfsplus_unistr *ustr, +- char *astr, int *len_p) ++static int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr, ++ int max_len, char *astr, int *len_p) + { + const hfsplus_unichr *ip; + struct nls_table *nls = HFSPLUS_SB(sb)->nls; +@@ -134,8 +133,8 @@ int hfsplus_uni2asc(struct super_block *sb, + ip = ustr->unicode; + + ustrlen = be16_to_cpu(ustr->length); +- if (ustrlen > HFSPLUS_MAX_STRLEN) { +- ustrlen = HFSPLUS_MAX_STRLEN; ++ if (ustrlen > max_len) { ++ ustrlen = max_len; + pr_err("invalid length %u has been corrected to %d\n", + be16_to_cpu(ustr->length), ustrlen); + } +@@ -256,6 +255,21 @@ int hfsplus_uni2asc(struct super_block *sb, + return res; + } + ++inline int hfsplus_uni2asc_str(struct super_block *sb, ++ const struct hfsplus_unistr *ustr, char *astr, ++ int *len_p) ++{ ++ return hfsplus_uni2asc(sb, ustr, HFSPLUS_MAX_STRLEN, astr, len_p); ++} ++ ++inline int hfsplus_uni2asc_xattr_str(struct super_block *sb, ++ const struct hfsplus_attr_unistr *ustr, ++ char *astr, int *len_p) ++{ ++ return hfsplus_uni2asc(sb, (const struct hfsplus_unistr *)ustr, ++ HFSPLUS_ATTR_MAX_STRLEN, astr, len_p); ++} ++ + /* + * Convert one or more ASCII characters into a single unicode character. + * Returns the number of ASCII characters corresponding to the unicode char. +diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c +index 18dc3d254d218..c951fa9835aa1 100644 +--- a/fs/hfsplus/xattr.c ++++ b/fs/hfsplus/xattr.c +@@ -735,9 +735,9 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size) + goto end_listxattr; + + xattr_name_len = NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN; +- if (hfsplus_uni2asc(inode->i_sb, +- (const struct hfsplus_unistr *)&fd.key->attr.key_name, +- strbuf, &xattr_name_len)) { ++ if (hfsplus_uni2asc_xattr_str(inode->i_sb, ++ &fd.key->attr.key_name, strbuf, ++ &xattr_name_len)) { + pr_err("unicode conversion failed\n"); + res = -EIO; + goto end_listxattr; +-- +2.51.0 + diff --git a/queue-6.17/hid-hidraw-tighten-ioctl-command-parsing.patch b/queue-6.17/hid-hidraw-tighten-ioctl-command-parsing.patch new file mode 100644 index 0000000000..69bda7d6fb --- /dev/null +++ b/queue-6.17/hid-hidraw-tighten-ioctl-command-parsing.patch @@ -0,0 +1,310 @@ +From 4c65e5a16907bf64f9c93d36460d6d09fb3d40fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 18:58:51 +0200 +Subject: HID: hidraw: tighten ioctl command parsing + +From: Benjamin Tissoires + +[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ] + +The handling for variable-length ioctl commands in hidraw_ioctl() is +rather complex and the check for the data direction is incomplete. + +Simplify this code by factoring out the various ioctls grouped by dir +and size, and using a switch() statement with the size masked out, to +ensure the rest of the command is correctly matched. + +Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw") +Reported-by: Arnd Bergmann +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hidraw.c | 224 ++++++++++++++++++++---------------- + include/uapi/linux/hidraw.h | 2 + + 2 files changed, 124 insertions(+), 102 deletions(-) + +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index c887f48756f4b..bbd6f23bce789 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list) + return 0; + } + +-static long hidraw_ioctl(struct file *file, unsigned int cmd, +- unsigned long arg) ++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *arg) + { +- struct inode *inode = file_inode(file); +- unsigned int minor = iminor(inode); +- long ret = 0; +- struct hidraw *dev; +- struct hidraw_list *list = file->private_data; +- void __user *user_arg = (void __user*) arg; +- +- down_read(&minors_rwsem); +- dev = hidraw_table[minor]; +- if (!dev || !dev->exist || hidraw_is_revoked(list)) { +- ret = -ENODEV; +- goto out; +- } ++ struct hid_device *hid = dev->hid; + + switch (cmd) { + case HIDIOCGRDESCSIZE: +- if (put_user(dev->hid->rsize, (int __user *)arg)) +- ret = -EFAULT; ++ if (put_user(hid->rsize, (int __user *)arg)) ++ return -EFAULT; + break; + + case HIDIOCGRDESC: +@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, + __u32 len; + + if (get_user(len, (int __user *)arg)) +- ret = -EFAULT; +- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1) +- ret = -EINVAL; +- else if (copy_to_user(user_arg + offsetof( +- struct hidraw_report_descriptor, +- value[0]), +- dev->hid->rdesc, +- min(dev->hid->rsize, len))) +- ret = -EFAULT; ++ return -EFAULT; ++ ++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1) ++ return -EINVAL; ++ ++ if (copy_to_user(arg + offsetof( ++ struct hidraw_report_descriptor, ++ value[0]), ++ hid->rdesc, ++ min(hid->rsize, len))) ++ return -EFAULT; ++ + break; + } + case HIDIOCGRAWINFO: + { + struct hidraw_devinfo dinfo; + +- dinfo.bustype = dev->hid->bus; +- dinfo.vendor = dev->hid->vendor; +- dinfo.product = dev->hid->product; +- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo))) +- ret = -EFAULT; ++ dinfo.bustype = hid->bus; ++ dinfo.vendor = hid->vendor; ++ dinfo.product = hid->product; ++ if (copy_to_user(arg, &dinfo, sizeof(dinfo))) ++ return -EFAULT; + break; + } + case HIDIOCREVOKE: + { +- if (user_arg) +- ret = -EINVAL; +- else +- ret = hidraw_revoke(list); +- break; ++ struct hidraw_list *list = file->private_data; ++ ++ if (arg) ++ return -EINVAL; ++ ++ return hidraw_revoke(list); + } + default: +- { +- struct hid_device *hid = dev->hid; +- if (_IOC_TYPE(cmd) != 'H') { +- ret = -EINVAL; +- break; +- } ++ /* ++ * None of the above ioctls can return -EAGAIN, so ++ * use it as a marker that we need to check variable ++ * length ioctls. ++ */ ++ return -EAGAIN; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); +- break; +- } ++ return 0; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); +- break; +- } ++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ int len = _IOC_SIZE(cmd); ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCSFEATURE(0): ++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCGFEATURE(0): ++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT); ++ case HIDIOCSINPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCGINPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT); ++ case HIDIOCSOUTPUT(0): ++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ case HIDIOCGOUTPUT(0): ++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) { +- int len = _IOC_SIZE(cmd); +- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT); +- break; +- } ++ return -EINVAL; ++} + +- /* Begin Read-only ioctls. */ +- if (_IOC_DIR(cmd) != _IOC_READ) { +- ret = -EINVAL; +- break; +- } ++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd, ++ void __user *user_arg) ++{ ++ struct hid_device *hid = dev->hid; ++ int len = _IOC_SIZE(cmd); ++ int field_len; ++ ++ switch (cmd & ~IOCSIZE_MASK) { ++ case HIDIOCGRAWNAME(0): ++ field_len = strlen(hid->name) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len; ++ case HIDIOCGRAWPHYS(0): ++ field_len = strlen(hid->phys) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len; ++ case HIDIOCGRAWUNIQ(0): ++ field_len = strlen(hid->uniq) + 1; ++ if (len > field_len) ++ len = field_len; ++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len; ++ } + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) { +- int len = strlen(hid->name) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->name, len) ? +- -EFAULT : len; +- break; +- } ++ return -EINVAL; ++} + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) { +- int len = strlen(hid->phys) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->phys, len) ? +- -EFAULT : len; +- break; +- } ++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ struct inode *inode = file_inode(file); ++ unsigned int minor = iminor(inode); ++ struct hidraw *dev; ++ struct hidraw_list *list = file->private_data; ++ void __user *user_arg = (void __user *)arg; ++ int ret; + +- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) { +- int len = strlen(hid->uniq) + 1; +- if (len > _IOC_SIZE(cmd)) +- len = _IOC_SIZE(cmd); +- ret = copy_to_user(user_arg, hid->uniq, len) ? +- -EFAULT : len; +- break; +- } +- } ++ down_read(&minors_rwsem); ++ dev = hidraw_table[minor]; ++ if (!dev || !dev->exist || hidraw_is_revoked(list)) { ++ ret = -ENODEV; ++ goto out; ++ } ++ ++ if (_IOC_TYPE(cmd) != 'H') { ++ ret = -EINVAL; ++ goto out; ++ } + ++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) { + ret = -ENOTTY; ++ goto out; + } ++ ++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg); ++ if (ret != -EAGAIN) ++ goto out; ++ ++ switch (_IOC_DIR(cmd)) { ++ case (_IOC_READ | _IOC_WRITE): ++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ case _IOC_READ: ++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg); ++ break; ++ default: ++ /* Any other IOC_DIR is wrong */ ++ ret = -EINVAL; ++ } ++ + out: + up_read(&minors_rwsem); + return ret; +diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h +index d5ee269864e07..ebd701b3c18d9 100644 +--- a/include/uapi/linux/hidraw.h ++++ b/include/uapi/linux/hidraw.h +@@ -48,6 +48,8 @@ struct hidraw_devinfo { + #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len) + #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */ + ++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE) ++ + #define HIDRAW_FIRST_MINOR 0 + #define HIDRAW_MAX_DEVICES 64 + /* number of reports to buffer */ +-- +2.51.0 + diff --git a/queue-6.17/hid-i2c-hid-fix-test-in-i2c_hid_core_register_panel_.patch b/queue-6.17/hid-i2c-hid-fix-test-in-i2c_hid_core_register_panel_.patch new file mode 100644 index 0000000000..182980364f --- /dev/null +++ b/queue-6.17/hid-i2c-hid-fix-test-in-i2c_hid_core_register_panel_.patch @@ -0,0 +1,40 @@ +From ec9eda42010ce0f68f919da911e375eed80294b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:57:31 +0300 +Subject: HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower() + +From: Dan Carpenter + +[ Upstream commit 5c76c794bf29399394ebacaa5af8436b8bed0d46 ] + +Bitwise AND was intended instead of OR. With the current code the +condition is always true. + +Fixes: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled") +Signed-off-by: Dan Carpenter +Reviewed-by: Douglas Anderson +Reviewed-by: Pin-yen Lin +Acked-by: Jiri Kosina +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/aK8Au3CgZSTvfEJ6@stanley.mountain +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 99ce6386176c6..30ebde1273be3 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -1189,7 +1189,7 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid) + struct device *dev = &ihid->client->dev; + int ret; + +- if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT) ++ if (ihid->hid->initial_quirks & HID_QUIRK_POWER_ON_AFTER_BACKLIGHT) + ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs; + else + ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs; +-- +2.51.0 + diff --git a/queue-6.17/hid-i2c-hid-make-elan-touch-controllers-power-on-aft.patch b/queue-6.17/hid-i2c-hid-make-elan-touch-controllers-power-on-aft.patch new file mode 100644 index 0000000000..fa6372a0f9 --- /dev/null +++ b/queue-6.17/hid-i2c-hid-make-elan-touch-controllers-power-on-aft.patch @@ -0,0 +1,235 @@ +From 04ade47af7b516c319c1225e5a43c52ebe80a274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 19:49:34 +0800 +Subject: HID: i2c-hid: Make elan touch controllers power on after panel is + enabled + +From: Pin-yen Lin + +[ Upstream commit cbdd16b818eef876dd2de9d503fe7397a0666cbe ] + +Introduce a new HID quirk to indicate that this device has to be enabled +after the panel's backlight is enabled, and update the driver data for +the elan devices to enable this quirk. This cannot be a I2C HID quirk +because the kernel needs to acknowledge this before powering up the +device and read the VID/PID. When this quirk is enabled, register +.panel_enabled()/.panel_disabling() instead for the panel follower. + +Also rename the *panel_prepare* functions into *panel_follower* because +they could be called in other situations now. + +Fixes: bd3cba00dcc63 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens") +Fixes: d06651bebf99e ("HID: i2c-hid: elan: Add elan-ekth6a12nay timing") +Reviewed-by: Douglas Anderson +Signed-off-by: Pin-yen Lin +Acked-by: Jiri Kosina +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250818115015.2909525-2-treapking@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-core.c | 46 ++++++++++++++++----------- + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 11 ++++++- + include/linux/hid.h | 2 ++ + 3 files changed, 40 insertions(+), 19 deletions(-) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index d3912e3f2f13a..99ce6386176c6 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -112,9 +112,9 @@ struct i2c_hid { + + struct i2chid_ops *ops; + struct drm_panel_follower panel_follower; +- struct work_struct panel_follower_prepare_work; ++ struct work_struct panel_follower_work; + bool is_panel_follower; +- bool prepare_work_finished; ++ bool panel_follower_work_finished; + }; + + static const struct i2c_hid_quirks { +@@ -1110,10 +1110,10 @@ static int i2c_hid_core_probe_panel_follower(struct i2c_hid *ihid) + return ret; + } + +-static void ihid_core_panel_prepare_work(struct work_struct *work) ++static void ihid_core_panel_follower_work(struct work_struct *work) + { + struct i2c_hid *ihid = container_of(work, struct i2c_hid, +- panel_follower_prepare_work); ++ panel_follower_work); + struct hid_device *hid = ihid->hid; + int ret; + +@@ -1130,7 +1130,7 @@ static void ihid_core_panel_prepare_work(struct work_struct *work) + if (ret) + dev_warn(&ihid->client->dev, "Power on failed: %d\n", ret); + else +- WRITE_ONCE(ihid->prepare_work_finished, true); ++ WRITE_ONCE(ihid->panel_follower_work_finished, true); + + /* + * The work APIs provide a number of memory ordering guarantees +@@ -1139,12 +1139,12 @@ static void ihid_core_panel_prepare_work(struct work_struct *work) + * guarantee that a write that happened in the work is visible after + * cancel_work_sync(). We'll add a write memory barrier here to match + * with i2c_hid_core_panel_unpreparing() to ensure that our write to +- * prepare_work_finished is visible there. ++ * panel_follower_work_finished is visible there. + */ + smp_wmb(); + } + +-static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower) ++static int i2c_hid_core_panel_follower_resume(struct drm_panel_follower *follower) + { + struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower); + +@@ -1152,29 +1152,36 @@ static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower) + * Powering on a touchscreen can be a slow process. Queue the work to + * the system workqueue so we don't block the panel's power up. + */ +- WRITE_ONCE(ihid->prepare_work_finished, false); +- schedule_work(&ihid->panel_follower_prepare_work); ++ WRITE_ONCE(ihid->panel_follower_work_finished, false); ++ schedule_work(&ihid->panel_follower_work); + + return 0; + } + +-static int i2c_hid_core_panel_unpreparing(struct drm_panel_follower *follower) ++static int i2c_hid_core_panel_follower_suspend(struct drm_panel_follower *follower) + { + struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower); + +- cancel_work_sync(&ihid->panel_follower_prepare_work); ++ cancel_work_sync(&ihid->panel_follower_work); + +- /* Match with ihid_core_panel_prepare_work() */ ++ /* Match with ihid_core_panel_follower_work() */ + smp_rmb(); +- if (!READ_ONCE(ihid->prepare_work_finished)) ++ if (!READ_ONCE(ihid->panel_follower_work_finished)) + return 0; + + return i2c_hid_core_suspend(ihid, true); + } + +-static const struct drm_panel_follower_funcs i2c_hid_core_panel_follower_funcs = { +- .panel_prepared = i2c_hid_core_panel_prepared, +- .panel_unpreparing = i2c_hid_core_panel_unpreparing, ++static const struct drm_panel_follower_funcs ++ i2c_hid_core_panel_follower_prepare_funcs = { ++ .panel_prepared = i2c_hid_core_panel_follower_resume, ++ .panel_unpreparing = i2c_hid_core_panel_follower_suspend, ++}; ++ ++static const struct drm_panel_follower_funcs ++ i2c_hid_core_panel_follower_enable_funcs = { ++ .panel_enabled = i2c_hid_core_panel_follower_resume, ++ .panel_disabling = i2c_hid_core_panel_follower_suspend, + }; + + static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid) +@@ -1182,7 +1189,10 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid) + struct device *dev = &ihid->client->dev; + int ret; + +- ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_funcs; ++ if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT) ++ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs; ++ else ++ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs; + + /* + * If we're not in control of our own power up/power down then we can't +@@ -1237,7 +1247,7 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, + init_waitqueue_head(&ihid->wait); + mutex_init(&ihid->cmd_lock); + mutex_init(&ihid->reset_lock); +- INIT_WORK(&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work); ++ INIT_WORK(&ihid->panel_follower_work, ihid_core_panel_follower_work); + + /* we need to allocate the command buffer without knowing the maximum + * size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the +diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +index 3fcff6daa0d3a..0215f217f6d86 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -23,6 +24,7 @@ struct elan_i2c_hid_chip_data { + unsigned int post_power_delay_ms; + u16 hid_descriptor_address; + const char *main_supply_name; ++ bool power_after_backlight; + }; + + struct i2c_hid_of_elan { +@@ -97,6 +99,7 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client) + { + struct i2c_hid_of_elan *ihid_elan; + int ret; ++ u32 quirks = 0; + + ihid_elan = devm_kzalloc(&client->dev, sizeof(*ihid_elan), GFP_KERNEL); + if (!ihid_elan) +@@ -131,8 +134,12 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client) + } + } + ++ if (ihid_elan->chip_data->power_after_backlight) ++ quirks = HID_QUIRK_POWER_ON_AFTER_BACKLIGHT; ++ + ret = i2c_hid_core_probe(client, &ihid_elan->ops, +- ihid_elan->chip_data->hid_descriptor_address, 0); ++ ihid_elan->chip_data->hid_descriptor_address, ++ quirks); + if (ret) + goto err_deassert_reset; + +@@ -150,6 +157,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6915_chip_data = { + .post_gpio_reset_on_delay_ms = 300, + .hid_descriptor_address = 0x0001, + .main_supply_name = "vcc33", ++ .power_after_backlight = true, + }; + + static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = { +@@ -157,6 +165,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = { + .post_gpio_reset_on_delay_ms = 300, + .hid_descriptor_address = 0x0001, + .main_supply_name = "vcc33", ++ .power_after_backlight = true, + }; + + static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = { +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 2cc4f1e4ea963..c32425b5d0119 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -364,6 +364,7 @@ struct hid_item { + * | @HID_QUIRK_HAVE_SPECIAL_DRIVER: + * | @HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE: + * | @HID_QUIRK_IGNORE_SPECIAL_DRIVER ++ * | @HID_QUIRK_POWER_ON_AFTER_BACKLIGHT + * | @HID_QUIRK_FULLSPEED_INTERVAL: + * | @HID_QUIRK_NO_INIT_REPORTS: + * | @HID_QUIRK_NO_IGNORE: +@@ -391,6 +392,7 @@ struct hid_item { + #define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE BIT(20) + #define HID_QUIRK_NOINVERT BIT(21) + #define HID_QUIRK_IGNORE_SPECIAL_DRIVER BIT(22) ++#define HID_QUIRK_POWER_ON_AFTER_BACKLIGHT BIT(23) + #define HID_QUIRK_FULLSPEED_INTERVAL BIT(28) + #define HID_QUIRK_NO_INIT_REPORTS BIT(29) + #define HID_QUIRK_NO_IGNORE BIT(30) +-- +2.51.0 + diff --git a/queue-6.17/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch b/queue-6.17/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch new file mode 100644 index 0000000000..78d78091de --- /dev/null +++ b/queue-6.17/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch @@ -0,0 +1,47 @@ +From 735126cbea533089008f0196b7a484aa0e29a7d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:27:35 +0200 +Subject: HID: steelseries: Fix STEELSERIES_SRWS1 handling in + steelseries_remove() + +From: Jiri Kosina + +[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ] + +srws1_remove label can be only reached only if LEDS subsystem is enabled. To +avoid putting horryfing ifdef second time around the label, just perform +the cleanup and exit immediately directly. + +Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/ +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-steelseries.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c +index 8af98d67959e0..f98435631aa18 100644 +--- a/drivers/hid/hid-steelseries.c ++++ b/drivers/hid/hid-steelseries.c +@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev) + if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) +- goto srws1_remove; ++ hid_hw_stop(hdev); + #endif + return; + } +@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev) + cancel_delayed_work_sync(&sd->battery_work); + + hid_hw_close(hdev); +-srws1_remove: + hid_hw_stop(hdev); + } + +-- +2.51.0 + diff --git a/queue-6.17/hid-steelseries-refactor-probe-and-remove.patch b/queue-6.17/hid-steelseries-refactor-probe-and-remove.patch new file mode 100644 index 0000000000..a14bb411b0 --- /dev/null +++ b/queue-6.17/hid-steelseries-refactor-probe-and-remove.patch @@ -0,0 +1,322 @@ +From ec948b1fb3e262c43cbe022f6818d878428d1b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 20:26:43 +0900 +Subject: HID: steelseries: refactor probe() and remove() + +From: Jeongjun Park + +[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ] + +steelseries_srws1_probe() still does not use devm_kzalloc() and +devm_led_classdev_register(), so there is a lot of code to safely manage +heap, which reduces readability and may cause memory leaks due to minor +patch mistakes in the future. + +Therefore, it should be changed to use devm_kzalloc() and +devm_led_classdev_register() to easily and safely manage heap. + +Also, the current steelseries driver mainly checks sd->quriks to determine +which product a specific HID device is, which is not the correct way. + +remove(), unlike probe(), does not receive struct hid_device_id as an +argument, so it must check hdev unconditionally to know which product +it is. + +However, since struct steelseries_device and struct steelseries_srws1_data +have different structures, if SRWS1 is removed in remove(), converts +hdev->dev, which is initialized to struct steelseries_srws1_data, +to struct steelseries_device and uses it. This causes various +memory-related bugs as completely unexpected values exist in member +variables of the structure. + +Therefore, in order to modify probe() and remove() to work properly, +Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be +modified to check hdev->product when determining HID device product. + +Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox") +Signed-off-by: Jeongjun Park +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 + + drivers/hid/hid-quirks.c | 2 + + drivers/hid/hid-steelseries.c | 109 ++++++++++++---------------------- + 3 files changed, 43 insertions(+), 70 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 149798754570d..ded5348d190c5 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1296,6 +1296,8 @@ + + #define USB_VENDOR_ID_STEELSERIES 0x1038 + #define USB_DEVICE_ID_STEELSERIES_SRWS1 0x1410 ++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1 0x12b6 ++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9 0x12c2 + + #define USB_VENDOR_ID_SUN 0x0430 + #define USB_DEVICE_ID_RARITAN_KVM_DONGLE 0xcdab +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index f619ed10535d7..ffd034566e2e1 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -695,6 +695,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #endif + #if IS_ENABLED(CONFIG_HID_STEELSERIES) + { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) }, + #endif + #if IS_ENABLED(CONFIG_HID_SUNPLUS) + { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) }, +diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c +index d4bd7848b8c66..8af98d67959e0 100644 +--- a/drivers/hid/hid-steelseries.c ++++ b/drivers/hid/hid-steelseries.c +@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + { + int ret, i; + struct led_classdev *led; ++ struct steelseries_srws1_data *drv_data; + size_t name_sz; + char *name; + +- struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL); +- ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); + if (drv_data == NULL) { + hid_err(hdev, "can't alloc SRW-S1 memory\n"); + return -ENOMEM; +@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); +- goto err_free; ++ goto err; + } + + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) { + ret = -ENODEV; +- goto err_free; ++ goto err; + } + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); + if (ret) { + hid_err(hdev, "hw start failed\n"); +- goto err_free; ++ goto err; + } + + /* register led subsystem */ +@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + name_sz = strlen(hdev->uniq) + 16; + + /* 'ALL', for setting all LEDs simultaneously */ +- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL); ++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL); + if (!led) { + hid_err(hdev, "can't allocate memory for LED ALL\n"); +- goto err_led; ++ goto out; + } + + name = (void *)(&led[1]); +@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + led->brightness_set = steelseries_srws1_led_all_set_brightness; + + drv_data->led[SRWS1_NUMBER_LEDS] = led; +- ret = led_classdev_register(&hdev->dev, led); +- if (ret) +- goto err_led; ++ ret = devm_led_classdev_register(&hdev->dev, led); ++ if (ret) { ++ hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS); ++ goto out; /* let the driver continue without LEDs */ ++ } + + /* Each individual LED */ + for (i = 0; i < SRWS1_NUMBER_LEDS; i++) { +- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL); ++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL); + if (!led) { + hid_err(hdev, "can't allocate memory for LED %d\n", i); +- goto err_led; ++ break; + } + + name = (void *)(&led[1]); +@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev, + led->brightness_set = steelseries_srws1_led_set_brightness; + + drv_data->led[i] = led; +- ret = led_classdev_register(&hdev->dev, led); ++ ret = devm_led_classdev_register(&hdev->dev, led); + + if (ret) { + hid_err(hdev, "failed to register LED %d. Aborting.\n", i); +-err_led: +- /* Deregister all LEDs (if any) */ +- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) { +- led = drv_data->led[i]; +- drv_data->led[i] = NULL; +- if (!led) +- continue; +- led_classdev_unregister(led); +- kfree(led); +- } +- goto out; /* but let the driver continue without LEDs */ ++ break; /* but let the driver continue without LEDs */ + } + } + out: + return 0; +-err_free: +- kfree(drv_data); ++err: + return ret; + } +- +-static void steelseries_srws1_remove(struct hid_device *hdev) +-{ +- int i; +- struct led_classdev *led; +- +- struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev); +- +- if (drv_data) { +- /* Deregister LEDs (if any) */ +- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) { +- led = drv_data->led[i]; +- drv_data->led[i] = NULL; +- if (!led) +- continue; +- led_classdev_unregister(led); +- kfree(led); +- } +- +- } +- +- hid_hw_stop(hdev); +- kfree(drv_data); +-} + #endif + + #define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS 3000 +@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev, + + static void steelseries_headset_fetch_battery(struct hid_device *hdev) + { +- struct steelseries_device *sd = hid_get_drvdata(hdev); + int ret = 0; + +- if (sd->quirks & STEELSERIES_ARCTIS_1) ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) + ret = steelseries_headset_request_battery(hdev, + arctis_1_battery_request, sizeof(arctis_1_battery_request)); +- else if (sd->quirks & STEELSERIES_ARCTIS_9) ++ else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) + ret = steelseries_headset_request_battery(hdev, + arctis_9_battery_request, sizeof(arctis_9_battery_request)); + +@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + struct steelseries_device *sd; + int ret; + +- sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL); +- if (!sd) +- return -ENOMEM; +- hid_set_drvdata(hdev, sd); +- sd->hdev = hdev; +- sd->quirks = id->driver_data; +- +- if (sd->quirks & STEELSERIES_SRWS1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) + return steelseries_srws1_probe(hdev, id); +@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + #endif + } + ++ sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL); ++ if (!sd) ++ return -ENOMEM; ++ hid_set_drvdata(hdev, sd); ++ sd->hdev = hdev; ++ sd->quirks = id->driver_data; ++ + ret = hid_parse(hdev); + if (ret) + return ret; +@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id + + static void steelseries_remove(struct hid_device *hdev) + { +- struct steelseries_device *sd = hid_get_drvdata(hdev); ++ struct steelseries_device *sd; + unsigned long flags; + +- if (sd->quirks & STEELSERIES_SRWS1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) { + #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \ + (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES)) +- steelseries_srws1_remove(hdev); ++ goto srws1_remove; + #endif + return; + } + ++ sd = hid_get_drvdata(hdev); ++ + spin_lock_irqsave(&sd->lock, flags); + sd->removed = true; + spin_unlock_irqrestore(&sd->lock, flags); +@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev) + cancel_delayed_work_sync(&sd->battery_work); + + hid_hw_close(hdev); ++srws1_remove: + hid_hw_stop(hdev); + } + +@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev, + unsigned long flags; + + /* Not a headset */ +- if (sd->quirks & STEELSERIES_SRWS1) ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) + return 0; + +- if (sd->quirks & STEELSERIES_ARCTIS_1) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) { + hid_dbg(sd->hdev, + "Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf); + if (size < ARCTIS_1_BATTERY_RESPONSE_LEN || +@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev, + } + } + +- if (sd->quirks & STEELSERIES_ARCTIS_9) { ++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) { + hid_dbg(sd->hdev, + "Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf); + if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) { +@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = { + .driver_data = STEELSERIES_SRWS1 }, + + { /* SteelSeries Arctis 1 Wireless for XBox */ +- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6), +- .driver_data = STEELSERIES_ARCTIS_1 }, ++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1), ++ .driver_data = STEELSERIES_ARCTIS_1 }, + + { /* SteelSeries Arctis 9 Wireless for XBox */ +- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2), ++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9), + .driver_data = STEELSERIES_ARCTIS_9 }, + + { } +-- +2.51.0 + diff --git a/queue-6.17/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.17/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch new file mode 100644 index 0000000000..5767737037 --- /dev/null +++ b/queue-6.17/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch @@ -0,0 +1,81 @@ +From 073fc78eebc9afb31a734e2db256e086b8a3c26f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:02:54 +0530 +Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Deepanshu Kartikey + +[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] + +hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate +operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: +use new vma_lock for pmd sharing synchronization"), if the trylock fails +or the VMA has no lock, it should skip that VMA. Any remaining mapped +pages are handled by remove_inode_hugepages() which is called after +hugetlb_vmdelete_list() and uses proper lock ordering to guarantee +unmapping success. + +Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs +without shareable locks, the code proceeds to call unmap_hugepage_range(). +This causes assertion failures in huge_pmd_unshare() → +hugetlb_vma_assert_locked() because no lock is actually held: + + WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted + Call Trace: + hugetlb_vma_assert_locked+0x1dd/0x250 + huge_pmd_unshare+0x2c8/0x540 + __unmap_hugepage_range+0x6e3/0x1aa0 + unmap_hugepage_range+0x32e/0x410 + hugetlb_vmdelete_list+0x189/0x1f0 + +Fix by using goto to ensure locks acquired by trylock are always released, +even when skipping VMAs without shareable locks. + +Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com +Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") +Signed-off-by: Deepanshu Kartikey +Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 +Suggested-by: Andrew Morton +Cc: David Hildenbrand +Cc: Muchun Song +Cc: Oscar Salvador +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hugetlbfs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index be4be99304bc0..dbeef80811a32 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -490,6 +490,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + if (!hugetlb_vma_trylock_write(vma)) + continue; + ++ /* ++ * Skip VMAs without shareable locks. Per the design in commit ++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() ++ * called after this function with proper locking. ++ */ ++ if (!__vma_shareable_lock(vma)) ++ goto skip; ++ + v_start = vma_offset_start(vma, start); + v_end = vma_offset_end(vma, end); + +@@ -500,6 +508,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + * vmas. Therefore, lock is not held when calling + * unmap_hugepage_range for private vmas. + */ ++skip: + hugetlb_vma_unlock_write(vma); + } + } +-- +2.51.0 + diff --git a/queue-6.17/hwmon-asus-ec-sensors-narrow-lock-for-x870e-creator-.patch b/queue-6.17/hwmon-asus-ec-sensors-narrow-lock-for-x870e-creator-.patch new file mode 100644 index 0000000000..7a3c5c32ff --- /dev/null +++ b/queue-6.17/hwmon-asus-ec-sensors-narrow-lock-for-x870e-creator-.patch @@ -0,0 +1,37 @@ +From 7e320e078c7396baef0f9ff1255da3206c2ff636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 22:31:48 +0200 +Subject: hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI + +From: Eugene Shalygin + +[ Upstream commit 3aa72cf03924d04c8d20f8b319df8f73550dd26c ] + +Use mutex from the SIO device rather than the global lock. + +Signed-off-by: Eugene Shalygin + +Fixes: 3e538b52157b ("hwmon: (asus-ec-sensors) add ProArt X870E-CREATOR WIFI") +Link: https://lore.kernel.org/r/20250805203157.18446-1-eugene.shalygin@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/asus-ec-sensors.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c +index 4ac554731e98a..f43efb80aabf3 100644 +--- a/drivers/hwmon/asus-ec-sensors.c ++++ b/drivers/hwmon/asus-ec-sensors.c +@@ -396,7 +396,7 @@ static const struct ec_board_info board_info_pro_art_x870E_creator_wifi = { + .sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE | + SENSOR_TEMP_MB | SENSOR_TEMP_VRM | + SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT, +- .mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH, ++ .mutex_path = ASUS_HW_ACCESS_MUTEX_SB_PCI0_SBRG_SIO1_MUT0, + .family = family_amd_800_series, + }; + +-- +2.51.0 + diff --git a/queue-6.17/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.17/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch new file mode 100644 index 0000000000..e547328647 --- /dev/null +++ b/queue-6.17/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch @@ -0,0 +1,102 @@ +From 5398a24e6c21212e0cdcfa764c819e899058b7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:48:58 +0200 +Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from + different subsystems + +From: Vadim Pasternak + +[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ] + +Distinct between fan speed setting request coming for hwmon and +thermal subsystems. + +There are fields 'last_hwmon_state' and 'last_thermal_state' in the +structure 'mlxreg_fan_pwm', which respectively store the cooling state +set by the 'hwmon' and 'thermal' subsystem. +The purpose is to make arbitration of fan speed setting. For example, if +fan speed required to be not lower than some limit, such setting is to +be performed through 'hwmon' subsystem, thus 'thermal' subsystem will +not set fan below this limit. + +Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing +cooling state to never be set to a lower value. + +Eliminate update of 'last_thermal_state', when request is coming from +'hwmon' subsystem. + +Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index c25a54d5b39ad..0ba9195c9d713 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +-- +2.51.0 + diff --git a/queue-6.17/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.17/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..c2329d6ffb --- /dev/null +++ b/queue-6.17/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From f4311ac6a8e74d342fce44525dda0060a8fa1f22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index d8fd8a3544828..9e408144a10c1 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + if (IS_ERR(ks_sa_rng->regmap_cfg)) + return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n"); + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.17/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.17/hwrng-nomadik-add-arm_amba-dependency.patch new file mode 100644 index 0000000000..0ff98a32e4 --- /dev/null +++ b/queue-6.17/hwrng-nomadik-add-arm_amba-dependency.patch @@ -0,0 +1,44 @@ +From 5b3200f08992279357a550e82b72de846dd9235f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 17:28:00 +0200 +Subject: hwrng: nomadik - add ARM_AMBA dependency + +From: Arnd Bergmann + +[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ] + +Compile-testing this driver is only possible when the AMBA bus driver is +available in the kernel: + +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': +nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': +nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' +x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' + +The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be +specified for the COMPILE_TEST case. + +Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index c858278434475..7826fd7c4603f 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.51.0 + diff --git a/queue-6.17/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.17/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..71bec0a3dd --- /dev/null +++ b/queue-6.17/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From d20bc4ece93d218d1e0434eeffd7bfffbb4ecfca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index b4bfdd2dd35e4..e37210d6c5f26 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -314,6 +314,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-6.17/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch b/queue-6.17/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch new file mode 100644 index 0000000000..62384c3721 --- /dev/null +++ b/queue-6.17/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch @@ -0,0 +1,68 @@ +From 87a71f315fc751e4c9fd48765a579457479bcc89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:10 +0900 +Subject: i2c: designware: Fix clock issue when PM is disabled + +From: Kunihiko Hayashi + +[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ] + +When the driver is removed, the clocks are first enabled by +calling pm_runtime_get_sync(), and then disabled with +pm_runtime_put_sync(). + +If CONFIG_PM=y, clocks for this controller are disabled when it's in +the idle state. So the clocks are properly disabled when the driver +exits. + +Othewise, the clocks are always enabled and the PM functions have +no effect. Therefore, the driver exits without disabling the clocks. + + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 18 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + +To ensure that the clocks can be disabled correctly even without +CONFIG_PM=y, should add the following fixes: + +- Replace with pm_runtime_put_noidle(), which only decrements the runtime + PM usage count. +- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Tested-by: Jarkko Nikula +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index a35e4c64a1d46..b4bfdd2dd35e4 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -331,9 +331,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) + i2c_dw_disable(dev); + + pm_runtime_dont_use_autosuspend(device); +- pm_runtime_put_sync(device); ++ pm_runtime_put_noidle(device); + dw_i2c_plat_pm_cleanup(dev); + ++ i2c_dw_prepare_clk(dev, false); ++ + i2c_dw_remove_lock_support(dev); + + reset_control_assert(dev->rst); +-- +2.51.0 + diff --git a/queue-6.17/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.17/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..6e3dc6c2a8 --- /dev/null +++ b/queue-6.17/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From e830f34d565482f67b70354715bff30fad745ea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index ab456c3717db1..dee40704825cb 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-6.17/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch b/queue-6.17/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch new file mode 100644 index 0000000000..9159b53fff --- /dev/null +++ b/queue-6.17/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch @@ -0,0 +1,48 @@ +From a7fa1f68263018c26e169ed67f0562d1da8ad810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:28 +0800 +Subject: i2c: spacemit: check SDA instead of SCL after bus reset + +From: Troy Mitchell + +[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ] + +After calling spacemit_i2c_conditionally_reset_bus(), +the controller should ensure that the SDA line is release +before proceeding. + +Previously, the driver checked the SCL line instead, +which does not guarantee that the bus is truly idle. + +This patch changes the check to verify SDA. This ensures +proper bus recovery and avoids potential communication errors +after a conditional reset. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 9bf9f01aa68bd..848dfaf634f63 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + spacemit_i2c_reset(i2c); + usleep_range(10, 20); + +- /* check scl status again */ ++ /* check sda again here */ + status = readl(i2c->base + SPACEMIT_IBMR); +- if (!(status & SPACEMIT_BMR_SCL)) ++ if (!(status & SPACEMIT_BMR_SDA)) + dev_warn_ratelimited(i2c->dev, "unit reset failed\n"); + } + +-- +2.51.0 + diff --git a/queue-6.17/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch b/queue-6.17/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch new file mode 100644 index 0000000000..8f2d56c15d --- /dev/null +++ b/queue-6.17/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch @@ -0,0 +1,72 @@ +From d8a25af6715965ff2ac1e3c9646c48e75d297a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:27 +0800 +Subject: i2c: spacemit: disable SDA glitch fix to avoid restart delay + +From: Troy Mitchell + +[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ] + +The K1 I2C controller has an SDA glitch fix that introduces a small +delay on restart signals. While this feature can suppress glitches +on SDA when SCL = 0, it also delays the restart signal, which may +cause unexpected behavior in some transfers. + +The glitch itself does not affect normal I2C operation, because +the I2C specification allows SDA to change while SCL is low. + +To ensure correct transmission for every message, we disable the +SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during +initialization. + +This guarantees that restarts are issued promptly without +unintended delays. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 84f132d0504dc..9bf9f01aa68bd 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -14,6 +14,7 @@ + #define SPACEMIT_ICR 0x0 /* Control register */ + #define SPACEMIT_ISR 0x4 /* Status register */ + #define SPACEMIT_IDBR 0xc /* Data buffer register */ ++#define SPACEMIT_IRCR 0x18 /* Reset cycle counter */ + #define SPACEMIT_IBMR 0x1c /* Bus monitor register */ + + /* SPACEMIT_ICR register fields */ +@@ -76,6 +77,8 @@ + SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \ + SPACEMIT_SR_ALD) + ++#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */ ++ + /* SPACEMIT_IBMR register fields */ + #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */ + #define SPACEMIT_BMR_SCL BIT(1) /* SCL line level */ +@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c) + val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE; + + writel(val, i2c->base + SPACEMIT_ICR); ++ ++ /* ++ * The glitch fix in the K1 I2C controller introduces a delay ++ * on restart signals, so we disable the fix here. ++ */ ++ val = readl(i2c->base + SPACEMIT_IRCR); ++ val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX; ++ writel(val, i2c->base + SPACEMIT_IRCR); + } + + static inline void +-- +2.51.0 + diff --git a/queue-6.17/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch b/queue-6.17/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch new file mode 100644 index 0000000000..a8b2f97e0d --- /dev/null +++ b/queue-6.17/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch @@ -0,0 +1,53 @@ +From c22edce1f8346674f17b2d146a722e076578b490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:25 +0800 +Subject: i2c: spacemit: ensure bus release check runs when wait_bus_idle() + fails + +From: Troy Mitchell + +[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ] + +spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative +error code on failure. + +Since 'ret' can never be positive, the final 'else' branch was +unreachable, and spacemit_i2c_check_bus_release() was never called. + +This commit guarantees we attempt to release the bus whenever waiting for +an idle bus fails. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Reviewed-by: Aurelien Jarno +Signed-off-by: Troy Mitchell +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index b68a21fff0b56..ee08811f4087c 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in + spacemit_i2c_enable(i2c); + + ret = spacemit_i2c_wait_bus_idle(i2c); +- if (!ret) ++ if (!ret) { + ret = spacemit_i2c_xfer_msg(i2c); +- else if (ret < 0) +- dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret); +- else ++ if (ret < 0) ++ dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret); ++ } else { + spacemit_i2c_check_bus_release(i2c); ++ } + + spacemit_i2c_disable(i2c); + +-- +2.51.0 + diff --git a/queue-6.17/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch b/queue-6.17/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch new file mode 100644 index 0000000000..ffe837be5d --- /dev/null +++ b/queue-6.17/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch @@ -0,0 +1,101 @@ +From 2b19bc4ed9a85ee7198ddf0d6d1d024db00d569b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:29 +0800 +Subject: i2c: spacemit: ensure SDA is released after bus reset + +From: Troy Mitchell + +[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ] + +After performing a conditional bus reset, the controller must ensure +that the SDA line is actually released. + +Previously, the reset routine only performed a single check, +which could leave the bus in a locked state in some situations. + +This patch introduces a loop that toggles the reset cycle and issues +a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking +SDA after each attempt. If SDA is released before the maximum count, +the function returns early. Otherwise, a warning is emitted. + +This change improves bus recovery reliability. + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Signed-off-by: Troy Mitchell +Reviewed-by: Aurelien Jarno +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index 848dfaf634f63..6b918770e612e 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2024-2025 Troy Mitchell + */ + ++#include + #include + #include + #include +@@ -26,7 +27,8 @@ + #define SPACEMIT_CR_MODE_FAST BIT(8) /* bus mode (master operation) */ + /* Bit 9 is reserved */ + #define SPACEMIT_CR_UR BIT(10) /* unit reset */ +-/* Bits 11-12 are reserved */ ++#define SPACEMIT_CR_RSTREQ BIT(11) /* i2c bus reset request */ ++/* Bit 12 is reserved */ + #define SPACEMIT_CR_SCLE BIT(13) /* master clock enable */ + #define SPACEMIT_CR_IUE BIT(14) /* unit enable */ + /* Bits 15-17 are reserved */ +@@ -78,6 +80,8 @@ + SPACEMIT_SR_ALD) + + #define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */ ++/* the cycles of SCL during bus reset */ ++#define SPACEMIT_RCR_FIELD_RST_CYC GENMASK(3, 0) + + /* SPACEMIT_IBMR register fields */ + #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */ +@@ -91,6 +95,8 @@ + + #define SPACEMIT_SR_ERR (SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD) + ++#define SPACEMIT_BUS_RESET_CLK_CNT_MAX 9 ++ + enum spacemit_i2c_state { + SPACEMIT_STATE_IDLE, + SPACEMIT_STATE_START, +@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c) + static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + { + u32 status; ++ u8 clk_cnt; + + /* if bus is locked, reset unit. 0: locked */ + status = readl(i2c->base + SPACEMIT_IBMR); +@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c) + spacemit_i2c_reset(i2c); + usleep_range(10, 20); + ++ for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) { ++ status = readl(i2c->base + SPACEMIT_IBMR); ++ if (status & SPACEMIT_BMR_SDA) ++ return; ++ ++ /* There's nothing left to save here, we are about to exit */ ++ writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1), ++ i2c->base + SPACEMIT_IRCR); ++ writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR); ++ usleep_range(20, 30); ++ } ++ + /* check sda again here */ + status = readl(i2c->base + SPACEMIT_IBMR); + if (!(status & SPACEMIT_BMR_SDA)) +-- +2.51.0 + diff --git a/queue-6.17/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch b/queue-6.17/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch new file mode 100644 index 0000000000..725e4e5603 --- /dev/null +++ b/queue-6.17/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch @@ -0,0 +1,87 @@ +From aa42421b22922a7340603c9d8ed702816188e5ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 10:02:26 +0800 +Subject: i2c: spacemit: remove stop function to avoid bus error + +From: Troy Mitchell + +[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ] + +Previously, STOP handling was split into two separate steps: + 1) clear TB/STOP/START/ACK bits + 2) issue STOP by calling spacemit_i2c_stop() + +This left a small window where the control register was updated +twice, which can confuse the controller. While this race has not +been observed with interrupt-driven transfers, it reliably causes +bus errors in PIO mode. + +Inline the STOP sequence into the IRQ handler and ensure that +control register bits are updated atomically in a single writel(). + +Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") +Signed-off-by: Troy Mitchell +Reviewed-by: Aurelien Jarno +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-k1.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c +index ee08811f4087c..84f132d0504dc 100644 +--- a/drivers/i2c/busses/i2c-k1.c ++++ b/drivers/i2c/busses/i2c-k1.c +@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c) + writel(val, i2c->base + SPACEMIT_ICR); + } + +-static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c) +-{ +- u32 val; +- +- val = readl(i2c->base + SPACEMIT_ICR); +- val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB; +- +- if (i2c->read) +- val |= SPACEMIT_CR_ACKNAK; +- +- writel(val, i2c->base + SPACEMIT_ICR); +-} +- + static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c) + { + unsigned long time_left; +@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid) + + val = readl(i2c->base + SPACEMIT_ICR); + val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START); +- writel(val, i2c->base + SPACEMIT_ICR); + + switch (i2c->state) { + case SPACEMIT_STATE_START: +@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid) + } + + if (i2c->state != SPACEMIT_STATE_IDLE) { ++ val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE; ++ + if (spacemit_i2c_is_last_msg(i2c)) { + /* trigger next byte with stop */ +- spacemit_i2c_stop(i2c); +- } else { +- /* trigger next byte */ +- val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB; +- writel(val, i2c->base + SPACEMIT_ICR); ++ val |= SPACEMIT_CR_STOP; ++ ++ if (i2c->read) ++ val |= SPACEMIT_CR_ACKNAK; + } ++ writel(val, i2c->base + SPACEMIT_ICR); + } + + err_out: +-- +2.51.0 + diff --git a/queue-6.17/i3c-fix-big-endian-fifo-transfers.patch b/queue-6.17/i3c-fix-big-endian-fifo-transfers.patch new file mode 100644 index 0000000000..997a9e1962 --- /dev/null +++ b/queue-6.17/i3c-fix-big-endian-fifo-transfers.patch @@ -0,0 +1,73 @@ +From 2acd6d8f84f4d7f1ac2186b398bbde7273af539a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 22:18:33 +0200 +Subject: i3c: fix big-endian FIFO transfers + +From: Arnd Bergmann + +[ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ] + +Short MMIO transfers that are not a multiple of four bytes in size need +a special case for the final bytes, however the existing implementation +is not endian-safe and introduces an incorrect byteswap on big-endian +kernels. + +This usually does not cause problems because most systems are +little-endian and most transfers are multiple of four bytes long, but +still needs to be fixed to avoid the extra byteswap. + +Change the special case for both i3c_writel_fifo() and i3c_readl_fifo() +to use non-byteswapping writesl() and readsl() with a single element +instead of the byteswapping writel()/readl() that are meant for individual +MMIO registers. As data is copied between a FIFO and a memory buffer, +the writesl()/readsl() loops are typically based on __raw_readl()/ +__raw_writel(), resulting in the order of bytes in the FIFO to match +the order in the buffer, regardless of the CPU endianess. + +The earlier versions in the dw-i3c and i3c-master-cdns had a correct +implementation, but the generic version that was recently added broke it. + +Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()") +Cc: Manikanta Guntupalli +Signed-off-by: Arnd Bergmann +Reviewed-by: Jorge Marques +Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/internals.h | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h +index 0d857cc68cc5d..79ceaa5f5afd6 100644 +--- a/drivers/i3c/internals.h ++++ b/drivers/i3c/internals.h +@@ -38,7 +38,11 @@ static inline void i3c_writel_fifo(void __iomem *addr, const void *buf, + u32 tmp = 0; + + memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3); +- writel(tmp, addr); ++ /* ++ * writesl() instead of writel() to keep FIFO ++ * byteorder on big-endian targets ++ */ ++ writesl(addr, &tmp, 1); + } + } + +@@ -55,7 +59,11 @@ static inline void i3c_readl_fifo(const void __iomem *addr, void *buf, + if (nbytes & 3) { + u32 tmp; + +- tmp = readl(addr); ++ /* ++ * readsl() instead of readl() to keep FIFO ++ * byteorder on big-endian targets ++ */ ++ readsl(addr, &tmp, 1); + memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3); + } + } +-- +2.51.0 + diff --git a/queue-6.17/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.17/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..9ed0f3f1be --- /dev/null +++ b/queue-6.17/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From dc52c429da3625fac729c2cdd980dca458d3e821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 8e7b4ab919e3d..9641e66a4e5f2 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.17/i3c-master-svc-use-manual-response-for-ibi-events.patch new file mode 100644 index 0000000000..c65ad1f468 --- /dev/null +++ b/queue-6.17/i3c-master-svc-use-manual-response-for-ibi-events.patch @@ -0,0 +1,96 @@ +From ded243482a7e82068a1e75161d3cbd9e90ac2333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:08 +0800 +Subject: i3c: master: svc: Use manual response for IBI events + +From: Stanley Chu + +[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ] + +Driver wants to nack the IBI request when the target is not in the +known address list. In below code, svc_i3c_master_nack_ibi() will +cause undefined behavior when using AUTOIBI with auto response rule, +because hw always auto ack the IBI request. + + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); + if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) + svc_i3c_master_nack_ibi(master); + ... + break; + +AutoIBI has another issue that the controller doesn't quit AutoIBI state +after IBIWON polling timeout when there is a SDA glitch(high->low->high). +1. SDA high->low: raising an interrupt to execute IBI ISR +2. SDA low->high +3. Driver writes an AutoIBI request +4. AutoIBI process does not start because SDA is not low +5. IBIWON polling times out +6. Controller reamins in AutoIBI state and doesn't accept EmitStop request + +Emitting broadcast address with IBIRESP_MANUAL avoids both issues. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 701ae165b25b7..8e7b4ab919e3d 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +-- +2.51.0 + diff --git a/queue-6.17/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.17/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..3a21bb31b4 --- /dev/null +++ b/queue-6.17/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From 9a9e61194fb13c062772e16336eefe44ca7d0cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 53571e6b3162c..66df5bed6a562 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch b/queue-6.17/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch new file mode 100644 index 0000000000..4028dacb51 --- /dev/null +++ b/queue-6.17/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch @@ -0,0 +1,50 @@ +From d3b548fa3cbe12f87a8dd67264f1e8f4b437fe78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 11:02:10 -0700 +Subject: idpf: fix mismatched free function for dma_alloc_coherent + +From: Alok Tiwari + +[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ] + +The mailbox receive path allocates coherent DMA memory with +dma_alloc_coherent(), but frees it with dmam_free_coherent(). +This is incorrect since dmam_free_coherent() is only valid for +buffers allocated with dmam_alloc_coherent(). + +Fix the mismatch by using dma_free_coherent() instead of +dmam_free_coherent + +Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg") +Signed-off-by: Alok Tiwari +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Jacob Keller +Reviewed-by: Madhu Chittim +Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +index 6330d4a0ae075..c1f34381333d1 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +@@ -702,9 +702,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter) + /* If post failed clear the only buffer we supplied */ + if (post_err) { + if (dma_mem) +- dmam_free_coherent(&adapter->pdev->dev, +- dma_mem->size, dma_mem->va, +- dma_mem->pa); ++ dma_free_coherent(&adapter->pdev->dev, ++ dma_mem->size, dma_mem->va, ++ dma_mem->pa); + break; + } + +-- +2.51.0 + diff --git a/queue-6.17/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch b/queue-6.17/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch new file mode 100644 index 0000000000..c7e6e45f03 --- /dev/null +++ b/queue-6.17/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch @@ -0,0 +1,56 @@ +From 47e26ff0c9eabfbe1f7e10e4197c308220e5d2b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:54:56 +0200 +Subject: idpf: fix Rx descriptor ready check barrier in splitq + +From: Alexander Lobakin + +[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ] + +No idea what the current barrier position was meant for. At that point, +nothing is read from the descriptor, only the pointer to the actual one +is fetched. +The correct barrier usage here is after the generation check, so that +only the first qword is read if the descriptor is not yet ready and we +need to stop polling. Debatable on coherent DMA as the Rx descriptor +size is <= cacheline size, but anyway, the current barrier position +only makes the codegen worse. + +Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") +Reviewed-by: Maciej Fijalkowski +Signed-off-by: Alexander Lobakin +Tested-by: Ramu R +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +index eaad52a83b04c..50f90ed3107ec 100644 +--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c ++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c +@@ -3187,18 +3187,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget) + /* get the Rx desc from Rx queue based on 'next_to_clean' */ + rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb; + +- /* This memory barrier is needed to keep us from reading +- * any other fields out of the rx_desc +- */ +- dma_rmb(); +- + /* if the descriptor isn't done, no work yet to do */ + gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id, + VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M); +- + if (idpf_queue_has(GEN_CHK, rxq) != gen_id) + break; + ++ dma_rmb(); ++ + rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M, + rx_desc->rxdid_ucast); + if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) { +-- +2.51.0 + diff --git a/queue-6.17/iio-consumers-fix-handling-of-negative-channel-scale.patch b/queue-6.17/iio-consumers-fix-handling-of-negative-channel-scale.patch new file mode 100644 index 0000000000..8adca27bbe --- /dev/null +++ b/queue-6.17/iio-consumers-fix-handling-of-negative-channel-scale.patch @@ -0,0 +1,121 @@ +From c4220fc792655466bffb2ebd5dcfb5958c1c473e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:20 +0200 +Subject: iio: consumers: Fix handling of negative channel scale in + iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ] + +There is an issue with the handling of negative channel scales +in iio_convert_raw_to_processed_unlocked() when the channel-scale +is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type: + +Things work for channel-scale values > -1.0 and < 0.0 because of +the use of signed values in: + + *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); + +Things will break however for scale values < -1.0. Lets for example say +that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5. + +The result should then be 2 * 10 * -1.5 = -30. + +channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000, +now lets see what gets stored in processed: + +1. *processed = raw64 * scale_val * scale; +2. *processed += raw64 * scale_val2 * scale / 1000000LL; + +1. Sets processed to 2 * -1 * 10 = -20 +2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed + +And the end result is processed = -20 + 10 = -10, which is not correct. + +Fix this by always using the abs value of both scale_val and scale_val2 +and if either is negative multiply the end-result by -1. + +Note there seems to be an unwritten rule about negative +IIO_VAL_INT_PLUS_[MICRO|NANO] values that: + +i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx +ii. values <= -1.0 are written as val=-xxx val2=xxx + +But iio_format_value() will also correctly display a third option: + +iii. values <= -1.0 written as val=-xxx val2=-xxx + +Since iio_format_value() uses abs(val) when val2 < 0. + +This fix also makes iio_convert_raw_to_processed() properly handle +channel-scales using this third option. + +Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") +Cc: Matteo Martelli +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index c174ebb7d5e6d..d36a80a7b8a93 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + { + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; +- s64 raw64 = raw; ++ s64 denominator, raw64 = raw; + + offset_type = iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); +@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000LL); +- break; + case IIO_VAL_INT_PLUS_NANO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000000LL); ++ switch (scale_type) { ++ case IIO_VAL_INT_PLUS_MICRO: ++ denominator = MICRO; ++ break; ++ case IIO_VAL_INT_PLUS_NANO: ++ denominator = NANO; ++ break; ++ } ++ *processed = raw64 * scale * abs(scale_val); ++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); ++ if (scale_val < 0 || scale_val2 < 0) ++ *processed *= -1; + break; + case IIO_VAL_FRACTIONAL: + *processed = div_s64(raw64 * (s64)scale_val * scale, +-- +2.51.0 + diff --git a/queue-6.17/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.17/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..f5a19e4b7b --- /dev/null +++ b/queue-6.17/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From 383d7d6ee2c09eab4a193f113f74bbadecbfcb15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index d36a80a7b8a93..642beb4b3360d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch b/queue-6.17/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch new file mode 100644 index 0000000000..f76daab546 --- /dev/null +++ b/queue-6.17/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch @@ -0,0 +1,83 @@ +From ccca6de71ff5170107cdaf20470afa3fd1e71efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:30:51 +0000 +Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup() + +From: Eric Dumazet + +[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ] + +We need to check socket netns before considering them in ping_get_port(). +Otherwise, one malicious netns could 'consume' all ports. + +Add corresponding check in ping_lookup(). + +Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Reviewed-by: Yue Haibing +Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ping.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 031df4c19fcc5..d2c3480df8f77 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, + + int ping_get_port(struct sock *sk, unsigned short ident) + { ++ struct net *net = sock_net(sk); + struct inet_sock *isk, *isk2; + struct hlist_head *hlist; + struct sock *sk2 = NULL; +@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + for (i = 0; i < (1L << 16); i++, result++) { + if (!result) + result++; /* avoid zero */ +- hlist = ping_hashslot(&ping_table, sock_net(sk), +- result); ++ hlist = ping_hashslot(&ping_table, net, result); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + if (isk2->inet_num == result) +@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + if (i >= (1L << 16)) + goto fail; + } else { +- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); ++ hlist = ping_hashslot(&ping_table, net, ident); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + /* BUG? Why is this reuse and not reuseaddr? ping.c +@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) + pr_debug("was not hashed\n"); + sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); +- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ sock_prot_inuse_add(net, sk->sk_prot, 1); + } + spin_unlock(&ping_table.lock); + return 0; +@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + } + + sk_for_each_rcu(sk, hslot) { ++ if (!net_eq(sock_net(sk), net)) ++ continue; + isk = inet_sk(sk); + + pr_debug("iterate\n"); +-- +2.51.0 + diff --git a/queue-6.17/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.17/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch new file mode 100644 index 0000000000..30413f4381 --- /dev/null +++ b/queue-6.17/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch @@ -0,0 +1,39 @@ +From dbceb988426885b8f8f65fd0b46a9771c4db05eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:11:05 +0200 +Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD + +From: Geert Uytterhoeven + +[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ] + +INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and +init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to +prevent asking the user about this feature when configuring a kernel +without initramfs support. + +Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Martin Wilck +Reviewed-by: David Disseldorp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index ecddb94db8dc0..e5d6d798994ae 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1504,6 +1504,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +-- +2.51.0 + diff --git a/queue-6.17/iommu-selftest-prevent-use-of-uninitialized-variable.patch b/queue-6.17/iommu-selftest-prevent-use-of-uninitialized-variable.patch new file mode 100644 index 0000000000..0e61b53cba --- /dev/null +++ b/queue-6.17/iommu-selftest-prevent-use-of-uninitialized-variable.patch @@ -0,0 +1,69 @@ +From f4d2072bec18c2f2774d897a2ce5f513fe86b34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:16:28 +0200 +Subject: iommu/selftest: prevent use of uninitialized variable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alessandro Zanni + +[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ] + +Fix to avoid the usage of the `res` variable uninitialized in the +following macro expansions. + +It solves the following warning: +In function ‘iommufd_viommu_vdevice_alloc’, + inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1: +../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized] + 760 | if (!(__exp _t __seen)) { \ + | ^ +../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’ + 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1) + | ^~~~~~~~ +iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’ + 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents)) + | ^~~~~~~~~ +iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’ + 2924 | test_cmd_trigger_vevents(dev_id, 3); + | ^~~~~~~~~~~~~~~~~~~~~~~~ + +The issue can be reproduced, building the tests, with the command: make -C +tools/testing/selftests TARGETS=iommu + +Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com +Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage") +Signed-off-by: Alessandro Zanni +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd_utils.h | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h +index 3c3e08b8c90eb..772ca1db6e597 100644 +--- a/tools/testing/selftests/iommu/iommufd_utils.h ++++ b/tools/testing/selftests/iommu/iommufd_utils.h +@@ -1042,15 +1042,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents) + .dev_id = dev_id, + }, + }; +- int ret; + + while (nvevents--) { +- ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), +- &trigger_vevent_cmd); +- if (ret < 0) ++ if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT), ++ &trigger_vevent_cmd)) + return -1; + } +- return ret; ++ return 0; + } + + #define test_cmd_trigger_vevents(dev_id, nvevents) \ +-- +2.51.0 + diff --git a/queue-6.17/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch b/queue-6.17/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch new file mode 100644 index 0000000000..e9142e545f --- /dev/null +++ b/queue-6.17/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch @@ -0,0 +1,79 @@ +From 2ec2c1bfa79ba489e3637eefec15a176710df917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 13:01:59 +0800 +Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic + +From: Vineeth Pillai (Google) + +[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ] + +In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR +maybe uninitialized or zero in that case and may cause oops like: + + Oops: general protection fault, probably for non-canonical address + 0xf00087d3f000f000: 0000 [#1] SMP NOPTI + CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 + RIP: 0010:pgtable_walk_level+0x98/0x150 + RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 + RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e + RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 + RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 + R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 + R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 + FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 + PKRU: 55555554 + Call Trace: + + pgtable_walk_level+0x88/0x150 + domain_translation_struct_show.isra.0+0x2d9/0x300 + dev_domain_translation_struct_show+0x20/0x40 + seq_read_iter+0x12d/0x490 +... + +Avoid walking the page table if TT is not 00b or 01b. + +Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") +Signed-off-by: Vineeth Pillai (Google) +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c +index affbf4a1558de..5aa7f46a420b5 100644 +--- a/drivers/iommu/intel/debugfs.c ++++ b/drivers/iommu/intel/debugfs.c +@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, + } + pgd &= VTD_PAGE_MASK; + } else { /* legacy mode */ +- pgd = context->lo & VTD_PAGE_MASK; +- agaw = context->hi & 7; ++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; ++ ++ /* ++ * According to Translation Type(TT), ++ * get the page table pointer(SSPTPTR). ++ */ ++ switch (tt) { ++ case CONTEXT_TT_MULTI_LEVEL: ++ case CONTEXT_TT_DEV_IOTLB: ++ pgd = context->lo & VTD_PAGE_MASK; ++ agaw = context->hi & 7; ++ break; ++ default: ++ goto iommu_unlock; ++ } + } + + seq_printf(m, "Device %04x:%02x:%02x.%x ", +-- +2.51.0 + diff --git a/queue-6.17/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch b/queue-6.17/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch new file mode 100644 index 0000000000..67403bde5e --- /dev/null +++ b/queue-6.17/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch @@ -0,0 +1,52 @@ +From 27770bc4f267074c6e5db9f59d7ea8a9defdb711 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 10:41:30 +0800 +Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk + +From: Lu Baolu + +[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ] + +Dirty page tracking relies on the IOMMU atomically updating the dirty bit +in the paging-structure entry. For this operation to succeed, the paging- +structure memory must be coherent between the IOMMU and the CPU. In +another word, if the iommu page walk is incoherent, dirty page tracking +doesn't work. + +The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: + +"Remapping hardware encountering the need to atomically update A/EA/D bits + in a paging-structure entry that is not snooped will result in a non- + recoverable fault." + +To prevent an IOMMU from being incorrectly configured for dirty page +tracking when it is operating in an incoherent mode, mark SSADS as +supported only when both ecap_slads and ecap_smpwc are supported. + +Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") +Signed-off-by: Lu Baolu +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h +index d09b928716592..2c261c069001c 100644 +--- a/drivers/iommu/intel/iommu.h ++++ b/drivers/iommu/intel/iommu.h +@@ -541,7 +541,8 @@ enum { + #define pasid_supported(iommu) (sm_supported(iommu) && \ + ecap_pasid((iommu)->ecap)) + #define ssads_supported(iommu) (sm_supported(iommu) && \ +- ecap_slads((iommu)->ecap)) ++ ecap_slads((iommu)->ecap) && \ ++ ecap_smpwc(iommu->ecap)) + #define nested_supported(iommu) (sm_supported(iommu) && \ + ecap_nest((iommu)->ecap)) + +-- +2.51.0 + diff --git a/queue-6.17/iommufd-register-iommufd-mock-devices-with-fwspec.patch b/queue-6.17/iommufd-register-iommufd-mock-devices-with-fwspec.patch new file mode 100644 index 0000000000..1e90bf2b62 --- /dev/null +++ b/queue-6.17/iommufd-register-iommufd-mock-devices-with-fwspec.patch @@ -0,0 +1,129 @@ +From ccb291e1426a650baabb2993683749602f171527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 13:47:30 +0800 +Subject: iommufd: Register iommufd mock devices with fwspec + +From: Guixin Liu + +[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ] + +Since the bus ops were retired the iommu subsystem changed to using fwspec +to match the iommu driver to the iommu device. If a device has a NULL +fwspec then it is matched to the first iommu driver with a NULL fwspec, +effectively disabling support for systems with more than one non-fwspec +iommu driver. + +Thus, if the iommufd selfest are run in an x86 system that registers a +non-fwspec iommu driver they fail to bind their mock devices to the mock +iommu driver. + +Fix this by allocating a software fwnode for mock iommu driver's +iommu_device, and set it to the device which mock iommu driver created. + +This is done by adding a new helper iommu_mock_device_add() which abuses +the internals of the fwspec system to establish a fwspec before the device +is added and is careful not to leak it. A matching dummy fwspec is +automatically added to the mock iommu driver. + +Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests": +PASSED: 229 / 229 tests passed. + +In addition, this issue is also can be found on amd platform, and +also tested on a amd machine. + +Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com +Fixes: 17de3f5fdd35 ("iommu: Retire bus ops") +Signed-off-by: Guixin Liu +Reviewed-by: Lu Baolu +Tested-by: Qinyun Tan +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu-priv.h | 2 ++ + drivers/iommu/iommu.c | 26 ++++++++++++++++++++++++++ + drivers/iommu/iommufd/selftest.c | 2 +- + 3 files changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h +index e236b932e7668..c95394cd03a77 100644 +--- a/drivers/iommu/iommu-priv.h ++++ b/drivers/iommu/iommu-priv.h +@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu, + const struct bus_type *bus, + struct notifier_block *nb); + ++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu); ++ + struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group, + ioasid_t pasid, + unsigned int type); +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 060ebe330ee16..59244c744eabd 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu, + struct notifier_block *nb) + { + bus_unregister_notifier(bus, nb); ++ fwnode_remove_software_node(iommu->fwnode); + iommu_device_unregister(iommu); + } + EXPORT_SYMBOL_GPL(iommu_device_unregister_bus); +@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu, + if (err) + return err; + ++ iommu->fwnode = fwnode_create_software_node(NULL, NULL); ++ if (IS_ERR(iommu->fwnode)) { ++ bus_unregister_notifier(bus, nb); ++ return PTR_ERR(iommu->fwnode); ++ } ++ + spin_lock(&iommu_device_lock); + list_add_tail(&iommu->list, &iommu_device_list); + spin_unlock(&iommu_device_lock); +@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu, + iommu_device_unregister_bus(iommu, bus, nb); + return err; + } ++ WRITE_ONCE(iommu->ready, true); + return 0; + } + EXPORT_SYMBOL_GPL(iommu_device_register_bus); ++ ++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu) ++{ ++ int rc; ++ ++ mutex_lock(&iommu_probe_device_lock); ++ rc = iommu_fwspec_init(dev, iommu->fwnode); ++ mutex_unlock(&iommu_probe_device_lock); ++ ++ if (rc) ++ return rc; ++ ++ rc = device_add(dev); ++ if (rc) ++ iommu_fwspec_free(dev); ++ return rc; ++} ++EXPORT_SYMBOL_GPL(iommu_mock_device_add); + #endif + + static struct dev_iommu *dev_iommu_get(struct device *dev) +diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c +index 61686603c7693..de178827a078a 100644 +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -1126,7 +1126,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags) + goto err_put; + } + +- rc = device_add(&mdev->dev); ++ rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev); + if (rc) + goto err_put; + return mdev; +-- +2.51.0 + diff --git a/queue-6.17/ipv4-start-using-dst_dev_rcu.patch b/queue-6.17/ipv4-start-using-dst_dev_rcu.patch new file mode 100644 index 0000000000..e918e75a1e --- /dev/null +++ b/queue-6.17/ipv4-start-using-dst_dev_rcu.patch @@ -0,0 +1,127 @@ +From 4ee1e2f0b508f603f0fc235c8b6e37da04fa5a5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:23 +0000 +Subject: ipv4: start using dst_dev_rcu() + +From: Eric Dumazet + +[ Upstream commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 ] + +Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. + +Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), +ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu(). + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-9-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 6 +++--- + net/ipv4/ip_fragment.c | 6 ++++-- + net/ipv4/ipmr.c | 6 +++--- + net/ipv4/route.c | 4 ++-- + 4 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index c48c572f024da..1be0d91620a38 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -318,17 +318,17 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + return true; + + /* No rate limit on loopback */ +- dev = dst_dev(dst); ++ rcu_read_lock(); ++ dev = dst_dev_rcu(dst); + if (dev && (dev->flags & IFF_LOOPBACK)) + goto out; + +- rcu_read_lock(); + peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, + l3mdev_master_ifindex_rcu(dev)); + rc = inet_peer_xrlim_allow(peer, + READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); +- rcu_read_unlock(); + out: ++ rcu_read_unlock(); + if (!rc) + __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST); + else +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index b2584cce90ae1..f7012479713ba 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -476,14 +476,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, + /* Process an incoming IP datagram fragment. */ + int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) + { +- struct net_device *dev = skb->dev ? : skb_dst_dev(skb); +- int vif = l3mdev_master_ifindex_rcu(dev); ++ struct net_device *dev; + struct ipq *qp; ++ int vif; + + __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS); + + /* Lookup (or create) queue header */ + rcu_read_lock(); ++ dev = skb->dev ? : skb_dst_dev_rcu(skb); ++ vif = l3mdev_master_ifindex_rcu(dev); + qp = ip_find(net, ip_hdr(skb), user, vif); + if (qp) { + int ret, refs = 0; +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index e86a8a862c411..8c568fbddb5fb 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -1904,7 +1904,7 @@ static int ipmr_prepare_xmit(struct net *net, struct mr_table *mrt, + return -1; + } + +- encap += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; ++ encap += LL_RESERVED_SPACE(dst_dev_rcu(&rt->dst)) + rt->dst.header_len; + + if (skb_cow(skb, encap)) { + ip_rt_put(rt); +@@ -1957,7 +1957,7 @@ static void ipmr_queue_fwd_xmit(struct net *net, struct mr_table *mrt, + * result in receiving multiple packets. + */ + NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, +- net, NULL, skb, skb->dev, rt->dst.dev, ++ net, NULL, skb, skb->dev, dst_dev_rcu(&rt->dst), + ipmr_forward_finish); + return; + +@@ -2301,7 +2301,7 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb) + + guard(rcu)(); + +- dev = rt->dst.dev; ++ dev = dst_dev_rcu(&rt->dst); + + if (IPCB(skb)->flags & IPSKB_FORWARDED) + goto mc_output; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 97b96275a775d..5582ccd673eeb 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -413,11 +413,11 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst, + const void *daddr) + { + const struct rtable *rt = container_of(dst, struct rtable, dst); +- struct net_device *dev = dst_dev(dst); ++ struct net_device *dev; + struct neighbour *n; + + rcu_read_lock(); +- ++ dev = dst_dev_rcu(dst); + if (likely(rt->rt_gw_family == AF_INET)) { + n = ip_neigh_gw4(dev, rt->rt_gw4); + } else if (rt->rt_gw_family == AF_INET6) { +-- +2.51.0 + diff --git a/queue-6.17/ipv6-mcast-add-ip6_mc_find_idev-helper.patch b/queue-6.17/ipv6-mcast-add-ip6_mc_find_idev-helper.patch new file mode 100644 index 0000000000..85d282828b --- /dev/null +++ b/queue-6.17/ipv6-mcast-add-ip6_mc_find_idev-helper.patch @@ -0,0 +1,143 @@ +From 1b415225d411a6a9cc37ff07d169e62cae58f100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:40:51 +0800 +Subject: ipv6: mcast: Add ip6_mc_find_idev() helper + +From: Yue Haibing + +[ Upstream commit 60c481d4caa569001c708d4e9622d19650b6bedc ] + +Extract the same code logic from __ipv6_sock_mc_join() and +ip6_mc_find_dev(), also add new helper ip6_mc_find_idev() to +reduce redundancy and enhance readability. + +No functional changes intended. + +Signed-off-by: Yue Haibing +Reviewed-by: Dawid Osuchowski +Link: https://patch.msgid.link/20250822064051.2991480-1-yuehaibing@huawei.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: b775ecf1655c ("ipv6: start using dst_dev_rcu()") +Signed-off-by: Sasha Levin +--- + net/ipv6/mcast.c | 67 ++++++++++++++++++++++-------------------------- + 1 file changed, 31 insertions(+), 36 deletions(-) + +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 36ca27496b3c0..55c49dc14b1bd 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -169,6 +169,29 @@ static int unsolicited_report_interval(struct inet6_dev *idev) + return iv > 0 ? iv : 1; + } + ++static struct net_device *ip6_mc_find_dev(struct net *net, ++ const struct in6_addr *group, ++ int ifindex) ++{ ++ struct net_device *dev = NULL; ++ struct rt6_info *rt; ++ ++ if (ifindex == 0) { ++ rcu_read_lock(); ++ rt = rt6_lookup(net, group, NULL, 0, NULL, 0); ++ if (rt) { ++ dev = dst_dev(&rt->dst); ++ dev_hold(dev); ++ ip6_rt_put(rt); ++ } ++ rcu_read_unlock(); ++ } else { ++ dev = dev_get_by_index(net, ifindex); ++ } ++ ++ return dev; ++} ++ + /* + * socket join on multicast group + */ +@@ -191,28 +214,13 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex, + } + + mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL); +- + if (!mc_lst) + return -ENOMEM; + + mc_lst->next = NULL; + mc_lst->addr = *addr; + +- if (ifindex == 0) { +- struct rt6_info *rt; +- +- rcu_read_lock(); +- rt = rt6_lookup(net, addr, NULL, 0, NULL, 0); +- if (rt) { +- dev = dst_dev(&rt->dst); +- dev_hold(dev); +- ip6_rt_put(rt); +- } +- rcu_read_unlock(); +- } else { +- dev = dev_get_by_index(net, ifindex); +- } +- ++ dev = ip6_mc_find_dev(net, addr, ifindex); + if (!dev) { + sock_kfree_s(sk, mc_lst, sizeof(*mc_lst)); + return -ENODEV; +@@ -302,27 +310,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) + } + EXPORT_SYMBOL(ipv6_sock_mc_drop); + +-static struct inet6_dev *ip6_mc_find_dev(struct net *net, +- const struct in6_addr *group, +- int ifindex) ++static struct inet6_dev *ip6_mc_find_idev(struct net *net, ++ const struct in6_addr *group, ++ int ifindex) + { +- struct net_device *dev = NULL; ++ struct net_device *dev; + struct inet6_dev *idev; + +- if (ifindex == 0) { +- struct rt6_info *rt; +- +- rcu_read_lock(); +- rt = rt6_lookup(net, group, NULL, 0, NULL, 0); +- if (rt) { +- dev = dst_dev(&rt->dst); +- dev_hold(dev); +- ip6_rt_put(rt); +- } +- rcu_read_unlock(); +- } else { +- dev = dev_get_by_index(net, ifindex); +- } ++ dev = ip6_mc_find_dev(net, group, ifindex); + if (!dev) + return NULL; + +@@ -374,7 +369,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk, + if (!ipv6_addr_is_multicast(group)) + return -EINVAL; + +- idev = ip6_mc_find_dev(net, group, pgsr->gsr_interface); ++ idev = ip6_mc_find_idev(net, group, pgsr->gsr_interface); + if (!idev) + return -ENODEV; + +@@ -509,7 +504,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, + gsf->gf_fmode != MCAST_EXCLUDE) + return -EINVAL; + +- idev = ip6_mc_find_dev(net, group, gsf->gf_interface); ++ idev = ip6_mc_find_idev(net, group, gsf->gf_interface); + if (!idev) + return -ENODEV; + +-- +2.51.0 + diff --git a/queue-6.17/ipv6-snmp-do-not-track-per-idev-icmp6_mib_ratelimith.patch b/queue-6.17/ipv6-snmp-do-not-track-per-idev-icmp6_mib_ratelimith.patch new file mode 100644 index 0000000000..5be1742c8e --- /dev/null +++ b/queue-6.17/ipv6-snmp-do-not-track-per-idev-icmp6_mib_ratelimith.patch @@ -0,0 +1,70 @@ +From d171a64f4d37398d120555942dfaa5101768d252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 16:58:07 +0000 +Subject: ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST + +From: Eric Dumazet + +[ Upstream commit 2fab94bcf313480336b0a41eb45a24ffd5087490 ] + +Blamed commit added a critical false sharing on a single +atomic_long_t under DOS, like receiving UDP packets +to closed ports. + +Per netns ICMP6_MIB_RATELIMITHOST tracking uses per-cpu +storage and is enough, we do not need per-device and slow tracking. + +Fixes: d0941130c9351 ("icmp: Add counters for rate limits") +Signed-off-by: Eric Dumazet +Cc: Jamie Bainbridge +Cc: Abhishek Rawal +Link: https://patch.msgid.link/20250905165813.1470708-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/icmp.c | 3 +-- + net/ipv6/proc.c | 6 +++++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 95cdd4cacb004..56c974cf75d15 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -230,8 +230,7 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, + } + rcu_read_unlock(); + if (!res) +- __ICMP6_INC_STATS(net, ip6_dst_idev(dst), +- ICMP6_MIB_RATELIMITHOST); ++ __ICMP6_INC_STATS(net, NULL, ICMP6_MIB_RATELIMITHOST); + else + icmp_global_consume(net); + dst_release(dst); +diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c +index 1a20d088bb13c..eb268b0700258 100644 +--- a/net/ipv6/proc.c ++++ b/net/ipv6/proc.c +@@ -94,6 +94,7 @@ static const struct snmp_mib snmp6_icmp6_list[] = { + SNMP_MIB_ITEM("Icmp6OutMsgs", ICMP6_MIB_OUTMSGS), + SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS), + SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS), ++/* ICMP6_MIB_RATELIMITHOST needs to be last, see snmp6_dev_seq_show(). */ + SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST), + }; + +@@ -242,8 +243,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v) + snmp6_ipstats_list, + ARRAY_SIZE(snmp6_ipstats_list), + offsetof(struct ipstats_mib, syncp)); ++ ++ /* Per idev icmp stats do not have ICMP6_MIB_RATELIMITHOST */ + snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs, +- snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list)); ++ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list) - 1); ++ + snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/ipv6-snmp-do-not-use-snmp_mib_sentinel-anymore.patch b/queue-6.17/ipv6-snmp-do-not-use-snmp_mib_sentinel-anymore.patch new file mode 100644 index 0000000000..27cba43808 --- /dev/null +++ b/queue-6.17/ipv6-snmp-do-not-use-snmp_mib_sentinel-anymore.patch @@ -0,0 +1,190 @@ +From 5915bcfb87ed1375951f6a971dea224b96edd8de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 16:58:06 +0000 +Subject: ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore + +From: Eric Dumazet + +[ Upstream commit ceac1fb2290d230eb83aff3761058c559440de13 ] + +Use ARRAY_SIZE(), so that we know the limit at compile time. + +Following patch needs this preliminary change. + +Signed-off-by: Eric Dumazet +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20250905165813.1470708-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 2fab94bcf313 ("ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST") +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 24 ++++++++++++++++++++++++ + net/ipv6/proc.c | 43 ++++++++++++++++++++++++------------------- + 2 files changed, 48 insertions(+), 19 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index 6dbd2bf8fa9c9..a1624e8db1abd 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -338,6 +338,19 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o + } \ + } + ++#define snmp_get_cpu_field64_batch_cnt(buff64, stats_list, cnt, \ ++ mib_statistic, offset) \ ++{ \ ++ int i, c; \ ++ for_each_possible_cpu(c) { \ ++ for (i = 0; i < cnt; i++) \ ++ buff64[i] += snmp_get_cpu_field64( \ ++ mib_statistic, \ ++ c, stats_list[i].entry, \ ++ offset); \ ++ } \ ++} ++ + #define snmp_get_cpu_field_batch(buff, stats_list, mib_statistic) \ + { \ + int i, c; \ +@@ -349,6 +362,17 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o + } \ + } + ++#define snmp_get_cpu_field_batch_cnt(buff, stats_list, cnt, mib_statistic) \ ++{ \ ++ int i, c; \ ++ for_each_possible_cpu(c) { \ ++ for (i = 0; i < cnt; i++) \ ++ buff[i] += snmp_get_cpu_field( \ ++ mib_statistic, \ ++ c, stats_list[i].entry); \ ++ } \ ++} ++ + static inline void inet_get_local_port_range(const struct net *net, int *low, int *high) + { + u32 range = READ_ONCE(net->ipv4.ip_local_ports.range); +diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c +index 752327b10dde7..1a20d088bb13c 100644 +--- a/net/ipv6/proc.c ++++ b/net/ipv6/proc.c +@@ -85,7 +85,6 @@ static const struct snmp_mib snmp6_ipstats_list[] = { + SNMP_MIB_ITEM("Ip6InECT0Pkts", IPSTATS_MIB_ECT0PKTS), + SNMP_MIB_ITEM("Ip6InCEPkts", IPSTATS_MIB_CEPKTS), + SNMP_MIB_ITEM("Ip6OutTransmits", IPSTATS_MIB_OUTPKTS), +- SNMP_MIB_SENTINEL + }; + + static const struct snmp_mib snmp6_icmp6_list[] = { +@@ -96,7 +95,6 @@ static const struct snmp_mib snmp6_icmp6_list[] = { + SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS), + SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS), + SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST), +- SNMP_MIB_SENTINEL + }; + + /* RFC 4293 v6 ICMPMsgStatsTable; named items for RFC 2466 compatibility */ +@@ -129,7 +127,6 @@ static const struct snmp_mib snmp6_udp6_list[] = { + SNMP_MIB_ITEM("Udp6InCsumErrors", UDP_MIB_CSUMERRORS), + SNMP_MIB_ITEM("Udp6IgnoredMulti", UDP_MIB_IGNOREDMULTI), + SNMP_MIB_ITEM("Udp6MemErrors", UDP_MIB_MEMERRORS), +- SNMP_MIB_SENTINEL + }; + + static const struct snmp_mib snmp6_udplite6_list[] = { +@@ -141,7 +138,6 @@ static const struct snmp_mib snmp6_udplite6_list[] = { + SNMP_MIB_ITEM("UdpLite6SndbufErrors", UDP_MIB_SNDBUFERRORS), + SNMP_MIB_ITEM("UdpLite6InCsumErrors", UDP_MIB_CSUMERRORS), + SNMP_MIB_ITEM("UdpLite6MemErrors", UDP_MIB_MEMERRORS), +- SNMP_MIB_SENTINEL + }; + + static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib) +@@ -182,35 +178,37 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib) + */ + static void snmp6_seq_show_item(struct seq_file *seq, void __percpu *pcpumib, + atomic_long_t *smib, +- const struct snmp_mib *itemlist) ++ const struct snmp_mib *itemlist, ++ int cnt) + { + unsigned long buff[SNMP_MIB_MAX]; + int i; + + if (pcpumib) { +- memset(buff, 0, sizeof(unsigned long) * SNMP_MIB_MAX); ++ memset(buff, 0, sizeof(unsigned long) * cnt); + +- snmp_get_cpu_field_batch(buff, itemlist, pcpumib); +- for (i = 0; itemlist[i].name; i++) ++ snmp_get_cpu_field_batch_cnt(buff, itemlist, cnt, pcpumib); ++ for (i = 0; i < cnt; i++) + seq_printf(seq, "%-32s\t%lu\n", + itemlist[i].name, buff[i]); + } else { +- for (i = 0; itemlist[i].name; i++) ++ for (i = 0; i < cnt; i++) + seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name, + atomic_long_read(smib + itemlist[i].entry)); + } + } + + static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib, +- const struct snmp_mib *itemlist, size_t syncpoff) ++ const struct snmp_mib *itemlist, ++ int cnt, size_t syncpoff) + { + u64 buff64[SNMP_MIB_MAX]; + int i; + +- memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX); ++ memset(buff64, 0, sizeof(u64) * cnt); + +- snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff); +- for (i = 0; itemlist[i].name; i++) ++ snmp_get_cpu_field64_batch_cnt(buff64, itemlist, cnt, mib, syncpoff); ++ for (i = 0; i < cnt; i++) + seq_printf(seq, "%-32s\t%llu\n", itemlist[i].name, buff64[i]); + } + +@@ -219,14 +217,19 @@ static int snmp6_seq_show(struct seq_file *seq, void *v) + struct net *net = (struct net *)seq->private; + + snmp6_seq_show_item64(seq, net->mib.ipv6_statistics, +- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp)); ++ snmp6_ipstats_list, ++ ARRAY_SIZE(snmp6_ipstats_list), ++ offsetof(struct ipstats_mib, syncp)); + snmp6_seq_show_item(seq, net->mib.icmpv6_statistics, +- NULL, snmp6_icmp6_list); ++ NULL, snmp6_icmp6_list, ++ ARRAY_SIZE(snmp6_icmp6_list)); + snmp6_seq_show_icmpv6msg(seq, net->mib.icmpv6msg_statistics->mibs); + snmp6_seq_show_item(seq, net->mib.udp_stats_in6, +- NULL, snmp6_udp6_list); ++ NULL, snmp6_udp6_list, ++ ARRAY_SIZE(snmp6_udp6_list)); + snmp6_seq_show_item(seq, net->mib.udplite_stats_in6, +- NULL, snmp6_udplite6_list); ++ NULL, snmp6_udplite6_list, ++ ARRAY_SIZE(snmp6_udplite6_list)); + return 0; + } + +@@ -236,9 +239,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v) + + seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex); + snmp6_seq_show_item64(seq, idev->stats.ipv6, +- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp)); ++ snmp6_ipstats_list, ++ ARRAY_SIZE(snmp6_ipstats_list), ++ offsetof(struct ipstats_mib, syncp)); + snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs, +- snmp6_icmp6_list); ++ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list)); + snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/ipv6-start-using-dst_dev_rcu.patch b/queue-6.17/ipv6-start-using-dst_dev_rcu.patch new file mode 100644 index 0000000000..6d11d00054 --- /dev/null +++ b/queue-6.17/ipv6-start-using-dst_dev_rcu.patch @@ -0,0 +1,171 @@ +From 7e75f210fa98a98750298a00a13828d57cfbf9ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:17 +0000 +Subject: ipv6: start using dst_dev_rcu() + +From: Eric Dumazet + +[ Upstream commit b775ecf1655cedbc465fd6699ab18a2bc4e7a352 ] + +Refactor icmpv6_xrlim_allow() and ip6_dst_hoplimit() +so that we acquire rcu_read_lock() a bit longer +to be able to use dst_dev_rcu() instead of dst_dev(). + +__ip6_rt_update_pmtu() and rt6_do_redirect can directly +use dst_dev_rcu() in sections already holding rcu_read_lock(). + +Small changes to use dst_dev_net_rcu() in +ip6_default_advmss(), ipv6_sock_ac_join(), +ip6_mc_find_dev() and ndisc_send_skb(). + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/anycast.c | 2 +- + net/ipv6/icmp.c | 6 +++--- + net/ipv6/mcast.c | 2 +- + net/ipv6/ndisc.c | 2 +- + net/ipv6/output_core.c | 8 +++++--- + net/ipv6/route.c | 7 +++---- + 6 files changed, 14 insertions(+), 13 deletions(-) + +diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c +index f8a8e46286b8e..52599584422bf 100644 +--- a/net/ipv6/anycast.c ++++ b/net/ipv6/anycast.c +@@ -104,7 +104,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr) + rcu_read_lock(); + rt = rt6_lookup(net, addr, NULL, 0, NULL, 0); + if (rt) { +- dev = dst_dev(&rt->dst); ++ dev = dst_dev_rcu(&rt->dst); + netdev_hold(dev, &dev_tracker, GFP_ATOMIC); + ip6_rt_put(rt); + } else if (ishost) { +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 44550957fd4e3..95cdd4cacb004 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -209,7 +209,8 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, + * this lookup should be more aggressive (not longer than timeout). + */ + dst = ip6_route_output(net, sk, fl6); +- dev = dst_dev(dst); ++ rcu_read_lock(); ++ dev = dst_dev_rcu(dst); + if (dst->error) { + IP6_INC_STATS(net, ip6_dst_idev(dst), + IPSTATS_MIB_OUTNOROUTES); +@@ -224,11 +225,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, + if (rt->rt6i_dst.plen < 128) + tmo >>= ((128 - rt->rt6i_dst.plen)>>5); + +- rcu_read_lock(); + peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr); + res = inet_peer_xrlim_allow(peer, tmo); +- rcu_read_unlock(); + } ++ rcu_read_unlock(); + if (!res) + __ICMP6_INC_STATS(net, ip6_dst_idev(dst), + ICMP6_MIB_RATELIMITHOST); +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 55c49dc14b1bd..016b572e7d6f0 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -180,7 +180,7 @@ static struct net_device *ip6_mc_find_dev(struct net *net, + rcu_read_lock(); + rt = rt6_lookup(net, group, NULL, 0, NULL, 0); + if (rt) { +- dev = dst_dev(&rt->dst); ++ dev = dst_dev_rcu(&rt->dst); + dev_hold(dev); + ip6_rt_put(rt); + } +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 7d5abb3158ec9..d6bb1e2f6192e 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -505,7 +505,7 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, + + ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len); + +- dev = dst_dev(dst); ++ dev = dst_dev_rcu(dst); + idev = __in6_dev_get(dev); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS); + +diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c +index d21fe27fe21e3..1c9b283a4132d 100644 +--- a/net/ipv6/output_core.c ++++ b/net/ipv6/output_core.c +@@ -104,18 +104,20 @@ EXPORT_SYMBOL(ip6_find_1stfragopt); + int ip6_dst_hoplimit(struct dst_entry *dst) + { + int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT); ++ ++ rcu_read_lock(); + if (hoplimit == 0) { +- struct net_device *dev = dst_dev(dst); ++ struct net_device *dev = dst_dev_rcu(dst); + struct inet6_dev *idev; + +- rcu_read_lock(); + idev = __in6_dev_get(dev); + if (idev) + hoplimit = READ_ONCE(idev->cnf.hop_limit); + else + hoplimit = READ_ONCE(dev_net(dev)->ipv6.devconf_all->hop_limit); +- rcu_read_unlock(); + } ++ rcu_read_unlock(); ++ + return hoplimit; + } + EXPORT_SYMBOL(ip6_dst_hoplimit); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 3299cfa12e21c..3371f16b7a3e6 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2943,7 +2943,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + + if (res.f6i->nh) { + struct fib6_nh_match_arg arg = { +- .dev = dst_dev(dst), ++ .dev = dst_dev_rcu(dst), + .gw = &rt6->rt6i_gateway, + }; + +@@ -3238,7 +3238,6 @@ EXPORT_SYMBOL_GPL(ip6_sk_redirect); + + static unsigned int ip6_default_advmss(const struct dst_entry *dst) + { +- struct net_device *dev = dst_dev(dst); + unsigned int mtu = dst_mtu(dst); + struct net *net; + +@@ -3246,7 +3245,7 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst) + + rcu_read_lock(); + +- net = dev_net_rcu(dev); ++ net = dst_dev_net_rcu(dst); + if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss) + mtu = net->ipv6.sysctl.ip6_rt_min_advmss; + +@@ -4301,7 +4300,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu + + if (res.f6i->nh) { + struct fib6_nh_match_arg arg = { +- .dev = dst_dev(dst), ++ .dev = dst_dev_rcu(dst), + .gw = &rt->rt6i_gateway, + }; + +-- +2.51.0 + diff --git a/queue-6.17/ipv6-use-rcu-in-ip6_output.patch b/queue-6.17/ipv6-use-rcu-in-ip6_output.patch new file mode 100644 index 0000000000..17c2661ded --- /dev/null +++ b/queue-6.17/ipv6-use-rcu-in-ip6_output.patch @@ -0,0 +1,118 @@ +From 5e4485bbdc7ee7884a7b5a7a3b191400f7267df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:19 +0000 +Subject: ipv6: use RCU in ip6_output() + +From: Eric Dumazet + +[ Upstream commit 11709573cc4e48dc34c80fc7ab9ce5b159e29695 ] + +Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent +possible UAF. + +We can remove rcu_read_lock()/rcu_read_unlock() pairs +from ip6_finish_output2(). + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_output.c | 29 +++++++++++++++-------------- + 1 file changed, 15 insertions(+), 14 deletions(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index e234640433d6b..9d64c13bab5ea 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -60,7 +60,7 @@ + static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +- struct net_device *dev = dst_dev(dst); ++ struct net_device *dev = dst_dev_rcu(dst); + struct inet6_dev *idev = ip6_dst_idev(dst); + unsigned int hh_len = LL_RESERVED_SPACE(dev); + const struct in6_addr *daddr, *nexthop; +@@ -70,15 +70,12 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + + /* Be paranoid, rather than too clever. */ + if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) { +- /* Make sure idev stays alive */ +- rcu_read_lock(); ++ /* idev stays alive because we hold rcu_read_lock(). */ + skb = skb_expand_head(skb, hh_len); + if (!skb) { + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); +- rcu_read_unlock(); + return -ENOMEM; + } +- rcu_read_unlock(); + } + + hdr = ipv6_hdr(skb); +@@ -123,7 +120,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); + +- rcu_read_lock(); + nexthop = rt6_nexthop(dst_rt6_info(dst), daddr); + neigh = __ipv6_neigh_lookup_noref(dev, nexthop); + +@@ -131,7 +127,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + if (unlikely(!neigh)) + neigh = __neigh_create(&nd_tbl, nexthop, dev, false); + if (IS_ERR(neigh)) { +- rcu_read_unlock(); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTNOROUTES); + kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_CREATEFAIL); + return -EINVAL; +@@ -139,7 +134,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + } + sock_confirm_neigh(skb, neigh); + ret = neigh_output(neigh, skb, false); +- rcu_read_unlock(); + return ret; + } + +@@ -233,22 +227,29 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +- struct net_device *dev = dst_dev(dst), *indev = skb->dev; +- struct inet6_dev *idev = ip6_dst_idev(dst); ++ struct net_device *dev, *indev = skb->dev; ++ struct inet6_dev *idev; ++ int ret; + + skb->protocol = htons(ETH_P_IPV6); ++ rcu_read_lock(); ++ dev = dst_dev_rcu(dst); ++ idev = ip6_dst_idev(dst); + skb->dev = dev; + + if (unlikely(!idev || READ_ONCE(idev->cnf.disable_ipv6))) { + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); ++ rcu_read_unlock(); + kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED); + return 0; + } + +- return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, +- net, sk, skb, indev, dev, +- ip6_finish_output, +- !(IP6CB(skb)->flags & IP6SKB_REROUTED)); ++ ret = NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, ++ net, sk, skb, indev, dev, ++ ip6_finish_output, ++ !(IP6CB(skb)->flags & IP6SKB_REROUTED)); ++ rcu_read_unlock(); ++ return ret; + } + EXPORT_SYMBOL(ip6_output); + +-- +2.51.0 + diff --git a/queue-6.17/ipv6-use-rcu-in-ip6_xmit.patch b/queue-6.17/ipv6-use-rcu-in-ip6_xmit.patch new file mode 100644 index 0000000000..9e46d34d3f --- /dev/null +++ b/queue-6.17/ipv6-use-rcu-in-ip6_xmit.patch @@ -0,0 +1,112 @@ +From e9030d1809a6422f05b394363043a207a4be26a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:18 +0000 +Subject: ipv6: use RCU in ip6_xmit() + +From: Eric Dumazet + +[ Upstream commit 9085e56501d93af9f2d7bd16f7fcfacdde47b99c ] + +Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent +possible UAF. + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_output.c | 35 +++++++++++++++++++++-------------- + 1 file changed, 21 insertions(+), 14 deletions(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 1e1410237b6ef..e234640433d6b 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -268,35 +268,36 @@ bool ip6_autoflowlabel(struct net *net, const struct sock *sk) + int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + __u32 mark, struct ipv6_txoptions *opt, int tclass, u32 priority) + { +- struct net *net = sock_net(sk); + const struct ipv6_pinfo *np = inet6_sk(sk); + struct in6_addr *first_hop = &fl6->daddr; + struct dst_entry *dst = skb_dst(skb); +- struct net_device *dev = dst_dev(dst); + struct inet6_dev *idev = ip6_dst_idev(dst); + struct hop_jumbo_hdr *hop_jumbo; + int hoplen = sizeof(*hop_jumbo); ++ struct net *net = sock_net(sk); + unsigned int head_room; ++ struct net_device *dev; + struct ipv6hdr *hdr; + u8 proto = fl6->flowi6_proto; + int seg_len = skb->len; +- int hlimit = -1; ++ int ret, hlimit = -1; + u32 mtu; + ++ rcu_read_lock(); ++ ++ dev = dst_dev_rcu(dst); + head_room = sizeof(struct ipv6hdr) + hoplen + LL_RESERVED_SPACE(dev); + if (opt) + head_room += opt->opt_nflen + opt->opt_flen; + + if (unlikely(head_room > skb_headroom(skb))) { +- /* Make sure idev stays alive */ +- rcu_read_lock(); ++ /* idev stays alive while we hold rcu_read_lock(). */ + skb = skb_expand_head(skb, head_room); + if (!skb) { + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); +- rcu_read_unlock(); +- return -ENOBUFS; ++ ret = -ENOBUFS; ++ goto unlock; + } +- rcu_read_unlock(); + } + + if (opt) { +@@ -358,17 +359,21 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + * skb to its handler for processing + */ + skb = l3mdev_ip6_out((struct sock *)sk, skb); +- if (unlikely(!skb)) +- return 0; ++ if (unlikely(!skb)) { ++ ret = 0; ++ goto unlock; ++ } + + /* hooks should never assume socket lock is held. + * we promote our socket to non const + */ +- return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, +- net, (struct sock *)sk, skb, NULL, dev, +- dst_output); ++ ret = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, ++ net, (struct sock *)sk, skb, NULL, dev, ++ dst_output); ++ goto unlock; + } + ++ ret = -EMSGSIZE; + skb->dev = dev; + /* ipv6_local_error() does not require socket lock, + * we promote our socket to non const +@@ -377,7 +382,9 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + + IP6_INC_STATS(net, idev, IPSTATS_MIB_FRAGFAILS); + kfree_skb(skb); +- return -EMSGSIZE; ++unlock: ++ rcu_read_unlock(); ++ return ret; + } + EXPORT_SYMBOL(ip6_xmit); + +-- +2.51.0 + diff --git a/queue-6.17/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.17/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..4acf7cc017 --- /dev/null +++ b/queue-6.17/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From 5314fd05084527a5353df7c69f24ad50564eaf22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index d8a284999544b..206c6700e2006 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-6.17/ipvs-use-read_once-write_once-for-ipvs-enable.patch b/queue-6.17/ipvs-use-read_once-write_once-for-ipvs-enable.patch new file mode 100644 index 0000000000..3b4c7d55c8 --- /dev/null +++ b/queue-6.17/ipvs-use-read_once-write_once-for-ipvs-enable.patch @@ -0,0 +1,223 @@ +From 8c08dbc73f59570ab8f53b305c9a0462a61d0b95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 21:46:54 +0800 +Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable + +From: Zhang Tengfei + +[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ] + +KCSAN reported a data-race on the `ipvs->enable` flag, which is +written in the control path and read concurrently from many other +contexts. + +Following a suggestion by Julian, this patch fixes the race by +converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. +This lightweight approach ensures atomic access and acts as a +compiler barrier, preventing unsafe optimizations where the flag +is checked in loops (e.g., in ip_vs_est.c). + +Additionally, the `enable` checks in the fast-path hooks +(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are +removed. These are unnecessary since commit 857ca89711de +("ipvs: register hooks only with services"). The `enable=0` +condition they check for can only occur in two rare and non-fatal +scenarios: 1) after hooks are registered but before the flag is set, +and 2) after hooks are unregistered on cleanup_net. In the worst +case, a single packet might be mishandled (e.g., dropped), which +does not lead to a system crash or data corruption. Adding a check +in the performance-critical fast-path to handle this harmless +condition is not a worthwhile trade-off. + +Fixes: 857ca89711de ("ipvs: register hooks only with services") +Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 +Suggested-by: Julian Anastasov +Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ +Signed-off-by: Zhang Tengfei +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + net/netfilter/ipvs/ip_vs_core.c | 11 ++++------- + net/netfilter/ipvs/ip_vs_ctl.c | 6 +++--- + net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++-------- + 4 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 965f3c8e5089d..37ebb0cb62b8b 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t) + * conntrack cleanup for the net. + */ + smp_rmb(); +- if (ipvs->enable) ++ if (READ_ONCE(ipvs->enable)) + ip_vs_conn_drop_conntrack(cp); + } + +@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) + cond_resched_rcu(); + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + break; + } + rcu_read_unlock(); +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index c7a8a08b73089..5ea7ab8bf4dcc 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat + if (unlikely(!skb_dst(skb))) + return NF_ACCEPT; + +- if (!ipvs->enable) +- return NF_ACCEPT; +- + ip_vs_fill_iph_skb(af, skb, false, &iph); + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state + return NF_ACCEPT; + } + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + ip_vs_fill_iph_skb(af, skb, false, &iph); +@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, + int r; + + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + if (state->pf == NFPROTO_IPV4) { +@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net) + return -ENOMEM; + + /* Hold the beast until a service is registered */ +- ipvs->enable = 0; ++ WRITE_ONCE(ipvs->enable, 0); + ipvs->net = net; + /* Counters used for creating unique names */ + ipvs->gen = atomic_read(&ipvs_netns_cnt); +@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) + ipvs = net_ipvs(net); + ip_vs_unregister_hooks(ipvs, AF_INET); + ip_vs_unregister_hooks(ipvs, AF_INET6); +- ipvs->enable = 0; /* Disable packet reception */ ++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 6a6fc44785337..4c8fa22be88ad 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) + struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock; + if (!kd) + continue; +@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + + *svc_p = svc; + +- if (!ipvs->enable) { ++ if (!READ_ONCE(ipvs->enable)) { + /* Now there is a service - full throttle */ +- ipvs->enable = 1; ++ WRITE_ONCE(ipvs->enable, 1); + + /* Start estimation for first time */ + ip_vs_est_reload_start(ipvs); +diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c +index 15049b8267327..93a925f1ed9b8 100644 +--- a/net/netfilter/ipvs/ip_vs_est.c ++++ b/net/netfilter/ipvs/ip_vs_est.c +@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data) + void ip_vs_est_reload_start(struct netns_ipvs *ipvs) + { + /* Ignore reloads before first service is added */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + return; + ip_vs_est_stopped_recalc(ipvs); + /* Bump the kthread configuration genid */ +@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + int i; + + if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && +- ipvs->enable && ipvs->est_max_threads) ++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) + return -EINVAL; + + mutex_lock(&ipvs->est_mutex); +@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + } + + /* Start kthread tasks only when services are present */ +- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { ++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { + ret = ip_vs_est_kthread_start(ipvs, kd); + if (ret < 0) + goto out; +@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) + struct ip_vs_estimator *est = &stats->est; + int ret; + +- if (!ipvs->est_max_threads && ipvs->enable) ++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) + ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); + + est->ktid = -1; +@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + /* Wait for cpufreq frequency transition */ + wait_event_idle_timeout(wq, kthread_should_stop(), + HZ / 50); +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + } + +@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + rcu_read_unlock(); + local_bh_enable(); + +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + cond_resched(); + +@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + mutex_lock(&ipvs->est_mutex); + for (id = 1; id < ipvs->est_kt_count; id++) { + /* netns clean up started, abort */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock2; + kd = ipvs->est_kt_arr[id]; + if (!kd) +@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + id = ipvs->est_kt_count; + + next_kt: +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto unlock; + id--; + if (id < 0) +-- +2.51.0 + diff --git a/queue-6.17/irqchip-gic-v5-fix-error-handling-in-gicv5_its_irq_d.patch b/queue-6.17/irqchip-gic-v5-fix-error-handling-in-gicv5_its_irq_d.patch new file mode 100644 index 0000000000..0a2d0398c9 --- /dev/null +++ b/queue-6.17/irqchip-gic-v5-fix-error-handling-in-gicv5_its_irq_d.patch @@ -0,0 +1,78 @@ +From 1195c2328d4ee735861c48cb7e2fb30703b88587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 10:27:45 +0200 +Subject: irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() + +From: Dan Carpenter + +[ Upstream commit a186120c780e21e4cfd186a925e34f718e30de88 ] + +Code in gicv5_its_irq_domain_alloc() has two issues: + + - it checks the wrong return value/variable when calling gicv5_alloc_lpi() + + - The cleanup code does not take previous loop iterations into account + +Fix both issues at once by adding the right gicv5_alloc_lpi() variable +check and by reworking the function cleanup code to take into account +current and previous iterations. + +[ lpieralisi: Reworded commit message ] + +Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") +Signed-off-by: Dan Carpenter +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Thomas Gleixner +Reviewed-by: Zenghui Yu +Link: https://lore.kernel.org/all/20250908082745.113718-4-lpieralisi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v5-its.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c +index 4701ef62b8b27..2fb58d76f5214 100644 +--- a/drivers/irqchip/irq-gic-v5-its.c ++++ b/drivers/irqchip/irq-gic-v5-its.c +@@ -949,15 +949,18 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi + device_id = its_dev->device_id; + + for (i = 0; i < nr_irqs; i++) { +- lpi = gicv5_alloc_lpi(); ++ ret = gicv5_alloc_lpi(); + if (ret < 0) { + pr_debug("Failed to find free LPI!\n"); +- goto out_eventid; ++ goto out_free_irqs; + } ++ lpi = ret; + + ret = irq_domain_alloc_irqs_parent(domain, virq + i, 1, &lpi); +- if (ret) +- goto out_free_lpi; ++ if (ret) { ++ gicv5_free_lpi(lpi); ++ goto out_free_irqs; ++ } + + /* + * Store eventid and deviceid into the hwirq for later use. +@@ -977,8 +980,13 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi + + return 0; + +-out_free_lpi: +- gicv5_free_lpi(lpi); ++out_free_irqs: ++ while (--i >= 0) { ++ irqd = irq_domain_get_irq_data(domain, virq + i); ++ gicv5_free_lpi(irqd->parent_data->hwirq); ++ irq_domain_reset_irq_data(irqd); ++ irq_domain_free_irqs_parent(domain, virq + i, 1); ++ } + out_eventid: + gicv5_its_free_eventid(its_dev, event_id_base, nr_irqs); + return ret; +-- +2.51.0 + diff --git a/queue-6.17/irqchip-gic-v5-fix-loop-in-gicv5_its_create_itt_two_.patch b/queue-6.17/irqchip-gic-v5-fix-loop-in-gicv5_its_create_itt_two_.patch new file mode 100644 index 0000000000..fb5abec0ce --- /dev/null +++ b/queue-6.17/irqchip-gic-v5-fix-loop-in-gicv5_its_create_itt_two_.patch @@ -0,0 +1,45 @@ +From 60ecadda130b396a541e04ed76a65693ffe966ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 10:27:44 +0200 +Subject: irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup + path + +From: Dan Carpenter + +[ Upstream commit bfcd1fdaae92faa8cae880eb4c3aaaa60c54bf0d ] + +The "i" variable in gicv5_its_create_itt_two_level() needs to be signed +otherwise it can cause a forever loop in the function's cleanup path. + +[ lpieralisi: Reworded commit message ] + +Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") +Signed-off-by: Dan Carpenter +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Thomas Gleixner +Reviewed-by: Zenghui Yu +Link: https://lore.kernel.org/all/20250908082745.113718-3-lpieralisi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v5-its.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c +index 9290ac741949c..4701ef62b8b27 100644 +--- a/drivers/irqchip/irq-gic-v5-its.c ++++ b/drivers/irqchip/irq-gic-v5-its.c +@@ -191,9 +191,9 @@ static int gicv5_its_create_itt_two_level(struct gicv5_its_chip_data *its, + unsigned int num_events) + { + unsigned int l1_bits, l2_bits, span, events_per_l2_table; +- unsigned int i, complete_tables, final_span, num_ents; ++ unsigned int complete_tables, final_span, num_ents; + __le64 *itt_l1, *itt_l2, **l2ptrs; +- int ret; ++ int i, ret; + u64 val; + + ret = gicv5_its_l2sz_to_l2_bits(itt_l2sz); +-- +2.51.0 + diff --git a/queue-6.17/irqchip-sg2042-msi-fix-broken-affinity-setting.patch b/queue-6.17/irqchip-sg2042-msi-fix-broken-affinity-setting.patch new file mode 100644 index 0000000000..858a30c987 --- /dev/null +++ b/queue-6.17/irqchip-sg2042-msi-fix-broken-affinity-setting.patch @@ -0,0 +1,87 @@ +From 0fac4f9520e07c38c0a2f80e6d74a2337e4a6027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 07:28:33 +0800 +Subject: irqchip/sg2042-msi: Fix broken affinity setting + +From: Inochi Amaoto + +[ Upstream commit 9d8c41816bac518b4824f83b346ae30a1be83f68 ] + +When using NVME on SG2044, the NVME drvier always complains about "I/O tag +XXX (XXX) QID XX timeout, completion polled", which is caused by the broken +affinity setting mechanism of the sg2042-msi driver. + +The PLIC driver can only the set the affinity when enabled, but the +sg2042-msi driver invokes the affinity setter in disabled state, which +causes the change to be lost. + +Cure this by implementing the irq_startup()/shutdown() callbacks, which +allow to startup (enabled) the underlying PLIC first. + +Fixes: e96b93a97c90 ("irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller") +Reported-by: Han Gao +Suggested-by: Thomas Gleixner +Signed-off-by: Inochi Amaoto +Signed-off-by: Thomas Gleixner +Tested-by: Chen Wang # Pioneerbox +Reviewed-by: Chen Wang +Link: https://lore.kernel.org/all/20250813232835.43458-4-inochiama@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-sg2042-msi.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/irqchip/irq-sg2042-msi.c b/drivers/irqchip/irq-sg2042-msi.c +index bcfddc51bc6a1..2fd4d94f9bd76 100644 +--- a/drivers/irqchip/irq-sg2042-msi.c ++++ b/drivers/irqchip/irq-sg2042-msi.c +@@ -85,6 +85,8 @@ static void sg2042_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m + + static const struct irq_chip sg2042_msi_middle_irq_chip = { + .name = "SG2042 MSI", ++ .irq_startup = irq_chip_startup_parent, ++ .irq_shutdown = irq_chip_shutdown_parent, + .irq_ack = sg2042_msi_irq_ack, + .irq_mask = irq_chip_mask_parent, + .irq_unmask = irq_chip_unmask_parent, +@@ -114,6 +116,8 @@ static void sg2044_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m + + static struct irq_chip sg2044_msi_middle_irq_chip = { + .name = "SG2044 MSI", ++ .irq_startup = irq_chip_startup_parent, ++ .irq_shutdown = irq_chip_shutdown_parent, + .irq_ack = sg2044_msi_irq_ack, + .irq_mask = irq_chip_mask_parent, + .irq_unmask = irq_chip_unmask_parent, +@@ -185,8 +189,10 @@ static const struct irq_domain_ops sg204x_msi_middle_domain_ops = { + .select = msi_lib_irq_domain_select, + }; + +-#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \ +- MSI_FLAG_USE_DEF_CHIP_OPS) ++#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \ ++ MSI_FLAG_USE_DEF_CHIP_OPS | \ ++ MSI_FLAG_PCI_MSI_MASK_PARENT | \ ++ MSI_FLAG_PCI_MSI_STARTUP_PARENT) + + #define SG2042_MSI_FLAGS_SUPPORTED MSI_GENERIC_FLAGS_MASK + +@@ -200,10 +206,12 @@ static const struct msi_parent_ops sg2042_msi_parent_ops = { + .init_dev_msi_info = msi_lib_init_dev_msi_info, + }; + +-#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \ +- MSI_FLAG_USE_DEF_CHIP_OPS) ++#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \ ++ MSI_FLAG_USE_DEF_CHIP_OPS | \ ++ MSI_FLAG_PCI_MSI_MASK_PARENT | \ ++ MSI_FLAG_PCI_MSI_STARTUP_PARENT) + +-#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \ ++#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \ + MSI_FLAG_PCI_MSIX) + + static const struct msi_parent_ops sg2044_msi_parent_ops = { +-- +2.51.0 + diff --git a/queue-6.17/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch b/queue-6.17/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch new file mode 100644 index 0000000000..607cbffe87 --- /dev/null +++ b/queue-6.17/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch @@ -0,0 +1,47 @@ +From 64db51cb165339c15e0f41548761fa83d78407f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 15:26:39 -0500 +Subject: kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact + +From: Kienan Stewart + +[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ] + +In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b +("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts") +artifacts required for building out-of-tree kernel modules had +$(objtree) prepended to them to prepare for building in other +directories. + +When building external modules for powerpc, +arch/powerpc/lib/crtsavres.o is required for certain +configurations. This artifact is missing the prepended $(objtree). + +Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=") +Acked-by: Masahiro Yamada +Reviewed-by: Nicolas Schier +Tested-by: Nicolas Schier +Signed-off-by: Kienan Stewart +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 9753fb87217c3..a58b1029592ce 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy) + # There is a corresponding test in arch/powerpc/lib/Makefile + KBUILD_LDFLAGS_MODULE += --save-restore-funcs + else +-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o ++KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o + endif + + ifdef CONFIG_CPU_LITTLE_ENDIAN +-- +2.51.0 + diff --git a/queue-6.17/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch b/queue-6.17/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch new file mode 100644 index 0000000000..a66585112f --- /dev/null +++ b/queue-6.17/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch @@ -0,0 +1,85 @@ +From 7612e9e865bccabd71f673f21c9ced85b69d5089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 21:15:50 +0000 +Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing + +From: Fan Wu + +[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ] + +Fix the X.509 Basic Constraints CA flag parsing to correctly handle +the ASN.1 DER encoded structure. The parser was incorrectly treating +the length field as the boolean value. + +Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. +According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: + +Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) + +The basicConstraints extension with CA:TRUE is encoded as: + + SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) + ^-- v[2] ^-- v[3] ^-- v[4] + +The parser was checking v[3] (the length field, always 0x01) instead +of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). + +Also handle the case where the extension is an empty SEQUENCE (30 00), +which is valid for CA:FALSE when the default value is omitted as +required by DER encoding rules (X.690 section 11.5). + +Per ITU-T X.690-0207: +- Section 11.5: Default values must be omitted in DER +- Section 11.1: DER requires TRUE to be encoded as 0xFF + +Link: https://datatracker.ietf.org/doc/html/rfc5280 +Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf +Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") +Signed-off-by: Fan Wu +Reviewed-by: Lukas Wunner +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 2ffe4ae90bea0..8df3fa60a44f8 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen, + /* + * Get hold of the basicConstraints + * v[1] is the encoding size +- * (Expect 0x2 or greater, making it 1 or more bytes) ++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or ++ * 0x03 or greater for non-empty SEQUENCE) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) +- * v[3] is the contents of the ASN1_BOOL +- * (Expect 1 if the CA is TRUE) ++ * v[3] is the length of the ASN1_BOOL ++ * (Expect 1 for a single byte boolean) ++ * v[4] is the contents of the ASN1_BOOL ++ * (Expect 0xFF if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) +@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen, + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; +- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) ++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ ++ if (v[1] == 0) ++ return 0; ++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; ++ else ++ return -EBADMSG; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/kselftest-arm64-gcs-correctly-check-return-value-whe.patch b/queue-6.17/kselftest-arm64-gcs-correctly-check-return-value-whe.patch new file mode 100644 index 0000000000..e7e7ca1fd1 --- /dev/null +++ b/queue-6.17/kselftest-arm64-gcs-correctly-check-return-value-whe.patch @@ -0,0 +1,40 @@ +From 8310df23bb067b2e4799c7c06e69bbc0cf832824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 17:13:02 +0200 +Subject: kselftest/arm64/gcs: Correctly check return value when disabling GCS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ] + +The return value was not assigned to 'ret', so the check afterwards +does not do anything. + +Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c +index 54f9c888249d7..100d2a983155f 100644 +--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c ++++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c +@@ -410,7 +410,7 @@ int main(void) + } + + /* One last test: disable GCS, we can do this one time */ +- my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0); ++ ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0); + if (ret != 0) + ksft_print_msg("Failed to disable GCS: %d\n", ret); + +-- +2.51.0 + diff --git a/queue-6.17/leds-flash-leds-qcom-flash-update-torch-current-clam.patch b/queue-6.17/leds-flash-leds-qcom-flash-update-torch-current-clam.patch new file mode 100644 index 0000000000..cd120e679a --- /dev/null +++ b/queue-6.17/leds-flash-leds-qcom-flash-update-torch-current-clam.patch @@ -0,0 +1,141 @@ +From 8f56a8e3a51c6c44961f07ac0778cefc231dca81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 12:51:22 +0800 +Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting + +From: Fenglin Wu + +[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ] + +There is a register to clamp the flash current per LED channel when +safety timer is disabled. It needs to be updated according to the +maximum torch LED current setting to ensure the torch current won't +be clamped unexpectedly. + +Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") +Signed-off-by: Fenglin Wu +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------ + 1 file changed, 36 insertions(+), 26 deletions(-) + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index 89cf5120f5d55..db7c2c743adc7 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -114,36 +114,39 @@ enum { + REG_THERM_THRSH1, + REG_THERM_THRSH2, + REG_THERM_THRSH3, ++ REG_TORCH_CLAMP, + REG_MAX_COUNT, + }; + + static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x08, 0, 7), /* status1 */ +- REG_FIELD(0x09, 0, 7), /* status2 */ +- REG_FIELD(0x0a, 0, 7), /* status3 */ +- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ +- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x47, 0, 5), /* iresolution */ +- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ +- REG_FIELD(0x4c, 0, 2), /* chan_en */ +- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ +- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ ++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), ++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), ++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), ++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), + }; + + static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x06, 0, 7), /* status1 */ +- REG_FIELD(0x07, 0, 6), /* status2 */ +- REG_FIELD(0x09, 0, 7), /* status3 */ +- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ +- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x49, 0, 3), /* iresolution */ +- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ +- REG_FIELD(0x4e, 0, 3), /* chan_en */ +- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ ++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), ++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), ++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), + }; + + struct qcom_flash_data { +@@ -156,6 +159,7 @@ struct qcom_flash_data { + u8 max_channels; + u8 chan_en_bits; + u8 revision; ++ u8 torch_clamp; + }; + + struct qcom_flash_led { +@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, + u32 current_ua, timeout_us; + u32 channels[4]; + int i, rc, count; ++ u8 torch_clamp; + + count = fwnode_property_count_u32(node, "led-sources"); + if (count <= 0) { +@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, + current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); + led->max_torch_current_ma = current_ua / UA_PER_MA; + ++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; ++ if (torch_clamp != 0) ++ torch_clamp--; ++ ++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); ++ + if (fwnode_property_present(node, "flash-max-microamp")) { + flash->led_cdev.flags |= LED_DEV_CAP_FLASH; + +@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) + flash_data->leds_count++; + } + +- return 0; +- ++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); + release: + while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) + v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]); +-- +2.51.0 + diff --git a/queue-6.17/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch b/queue-6.17/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch new file mode 100644 index 0000000000..fcb03c7dfb --- /dev/null +++ b/queue-6.17/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch @@ -0,0 +1,64 @@ +From a407667e7f018f4eb2342c2c2bed613c6f8f5d59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:47:12 +0200 +Subject: leds: leds-lp55xx: Use correct address for memory programming + +From: Andrei Lalaev + +[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ] + +Memory programming doesn't work for devices without page support. +For example, LP5562 has 3 engines but doesn't support pages, +the start address is changed depending on engine number. +According to datasheet [1], the PROG MEM register addresses for each +engine are as follows: + + Engine 1: 0x10 + Engine 2: 0x30 + Engine 3: 0x50 + +However, the current implementation incorrectly calculates the address +of PROG MEM register using the engine index starting from 1: + + prog_mem_base = 0x10 + LP55xx_BYTES_PER_PAGE = 0x20 + + Engine 1: 0x10 + 0x20 * 1 = 0x30 + Engine 2: 0x10 + 0x20 * 2 = 0x50 + Engine 3: 0x10 + 0x20 * 3 = 0x70 + +This results in writing to the wrong engine memory, causing pattern +programming to fail. + +To correct it, the engine index should be decreased: + Engine 1: 0x10 + 0x20 * 0 = 0x10 + Engine 2: 0x10 + 0x20 * 1 = 0x30 + Engine 3: 0x10 + 0x20 * 2 = 0x50 + +1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf + +Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function") +Signed-off-by: Andrei Lalaev +Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp55xx-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c +index e71456a56ab8d..fd447eb7eb15e 100644 +--- a/drivers/leds/leds-lp55xx-common.c ++++ b/drivers/leds/leds-lp55xx-common.c +@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip, + * For LED chip that support page, PAGE is already set in load_engine. + */ + if (!cfg->pages_per_engine) +- start_addr += LP55xx_BYTES_PER_PAGE * idx; ++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1); + + for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) { + /* Write to the next page each 32 bytes (if supported) */ +-- +2.51.0 + diff --git a/queue-6.17/leds-max77705-function-return-instead-of-variable-as.patch b/queue-6.17/leds-max77705-function-return-instead-of-variable-as.patch new file mode 100644 index 0000000000..b2bf1fbc21 --- /dev/null +++ b/queue-6.17/leds-max77705-function-return-instead-of-variable-as.patch @@ -0,0 +1,40 @@ +From 7ef018b2c891694f2aa0f3f1d81328ff3fc69798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jul 2025 07:56:45 +0000 +Subject: leds: max77705: Function return instead of variable assignment + +From: Len Bao + +[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ] + +Coverity noticed that assigning value -EINVAL to 'ret' in the if +statement is useless because 'ret' is overwritten a few lines later. +However, after inspect the code, this warning reveals that we need to +return -EINVAL instead of the variable assignment. So, fix it. + +Coverity-id: 1646104 +Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support") +Signed-off-by: Len Bao +Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-max77705.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c +index 933cb4f19be9b..b7403b3fcf5e7 100644 +--- a/drivers/leds/leds-max77705.c ++++ b/drivers/leds/leds-max77705.c +@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw + + ret = fwnode_property_read_u32(np, "reg", ®); + if (ret || reg >= MAX77705_LED_NUM_LEDS) +- ret = -EINVAL; ++ return -EINVAL; + + info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL); + if (!info) +-- +2.51.0 + diff --git a/queue-6.17/libbpf-export-bpf_object__prepare-symbol.patch b/queue-6.17/libbpf-export-bpf_object__prepare-symbol.patch new file mode 100644 index 0000000000..ef93223645 --- /dev/null +++ b/queue-6.17/libbpf-export-bpf_object__prepare-symbol.patch @@ -0,0 +1,38 @@ +From b2f628a50688cacc40ca5361f510d5cdfe3ab338 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 22:51:19 +0100 +Subject: libbpf: Export bpf_object__prepare symbol + +From: Mykyta Yatsenko + +[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ] + +Add missing LIBBPF_API macro for bpf_object__prepare function to enable +its export. libbpf.map had bpf_object__prepare already listed. + +Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load") +Signed-off-by: Mykyta Yatsenko +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h +index 455a957cb702c..2b86e21190d37 100644 +--- a/tools/lib/bpf/libbpf.h ++++ b/tools/lib/bpf/libbpf.h +@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz, + * @return 0, on success; negative error code, otherwise, error code is + * stored in errno + */ +-int bpf_object__prepare(struct bpf_object *obj); ++LIBBPF_API int bpf_object__prepare(struct bpf_object *obj); + + /** + * @brief **bpf_object__load()** loads BPF object into kernel. +-- +2.51.0 + diff --git a/queue-6.17/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch b/queue-6.17/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch new file mode 100644 index 0000000000..77aaefd3e4 --- /dev/null +++ b/queue-6.17/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch @@ -0,0 +1,121 @@ +From 0f519272424ac06f98acd83d0a2053daad7647ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 15:17:51 +0800 +Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf + +From: D. Wythe + +[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ] + +When a module registers a struct_ops, the struct_ops type and its +corresponding map_value type ("bpf_struct_ops_") may reside in different +btf objects, here are four possible case: + ++--------+---------------+-------------+---------------------------------+ +| |bpf_struct_ops_| xxx_ops | | ++--------+---------------+-------------+---------------------------------+ +| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux | ++--------+---------------+-------------+---------------------------------+ +| case 1 | btf_vmlinux | mod_btf | INVALID | ++--------+---------------+-------------+---------------------------------+ +| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in | +| | | | vmlinux and mod. | ++--------+---------------+-------------+---------------------------------+ +| case 3 | mod_btf | mod_btf | be used and reg only in mod | ++--------+---------------+-------------+---------------------------------+ + +Currently we figure out the mod_btf by searching with the struct_ops type, +which makes it impossible to figure out the mod_btf when the struct_ops +type is in btf_vmlinux while it's corresponding map_value type is in +mod_btf (case 2). + +The fix is to use the corresponding map_value type ("bpf_struct_ops_") +as the lookup anchor instead of the struct_ops type to figure out the +`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate +the kern_type_id via btf__find_by_name_kind() with the `btf` we just +obtained from find_ksym_btf_id(). + +With this change the lookup obtains the correct btf and mod_btf for case 2, +preserves correct behavior for other valid cases, and still fails as +expected for the invalid scenario (case 1). + +Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") +Signed-off-by: D. Wythe +Signed-off-by: Andrii Nakryiko +Acked-by: Andrii Nakryiko +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index fe4fc5438678c..8f9261279b921 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + const struct btf_member *kern_data_member; + struct btf *btf = NULL; + __s32 kern_vtype_id, kern_type_id; +- char tname[256]; ++ char tname[192], stname[256]; + __u32 i; + + snprintf(tname, sizeof(tname), "%.*s", + (int)bpf_core_essential_name_len(tname_raw), tname_raw); + +- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT, +- &btf, mod_btf); +- if (kern_type_id < 0) { +- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", +- tname); +- return kern_type_id; +- } +- kern_type = btf__type_by_id(btf, kern_type_id); ++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname); + +- /* Find the corresponding "map_value" type that will be used +- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example, +- * find "struct bpf_struct_ops_tcp_congestion_ops" from the +- * btf_vmlinux. ++ /* Look for the corresponding "map_value" type that will be used ++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf ++ * and the mod_btf. ++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops". + */ +- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX, +- tname, BTF_KIND_STRUCT); ++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf); + if (kern_vtype_id < 0) { +- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n", +- STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname); + return kern_vtype_id; + } + kern_vtype = btf__type_by_id(btf, kern_vtype_id); + ++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT); ++ if (kern_type_id < 0) { ++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname); ++ return kern_type_id; ++ } ++ kern_type = btf__type_by_id(btf, kern_type_id); ++ + /* Find "struct tcp_congestion_ops" from + * struct bpf_struct_ops_tcp_congestion_ops { + * [ ... ] +@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw, + break; + } + if (i == btf_vlen(kern_vtype)) { +- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n", +- tname, STRUCT_OPS_VALUE_PREFIX, tname); ++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n", ++ tname, stname); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.17/libbpf-fix-reuse-of-devmap.patch b/queue-6.17/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..d3cc105421 --- /dev/null +++ b/queue-6.17/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From cca29f54ecd0cc0a8f2ddd8ecc2f9206ce770784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 8f5a81b672e1b..fe4fc5438678c 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-6.17/lsm-config_lsm-can-depend-on-config_security.patch b/queue-6.17/lsm-config_lsm-can-depend-on-config_security.patch new file mode 100644 index 0000000000..7d2dacfdcb --- /dev/null +++ b/queue-6.17/lsm-config_lsm-can-depend-on-config_security.patch @@ -0,0 +1,39 @@ +From 9c9fb3e18ef6b085dc65e4471d12dbbf8f00349f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 15:28:00 -0700 +Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY + +From: Randy Dunlap + +[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ] + +When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does +not need to be visible and settable since builtin_lsm_order is defined in +security.o, which is only built when CONFIG_SECURITY=y. + +So make CONFIG_LSM depend on CONFIG_SECURITY. + +Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM") +Signed-off-by: Randy Dunlap +[PM: subj tweak] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/Kconfig b/security/Kconfig +index 4816fc74f81eb..285f284dfcac4 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -269,6 +269,7 @@ endchoice + + config LSM + string "Ordered list of enabled LSMs" ++ depends on SECURITY + default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK + default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR + default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO +-- +2.51.0 + diff --git a/queue-6.17/media-i2c-vd55g1-fix-duster-register-address.patch b/queue-6.17/media-i2c-vd55g1-fix-duster-register-address.patch new file mode 100644 index 0000000000..7f3ea0965e --- /dev/null +++ b/queue-6.17/media-i2c-vd55g1-fix-duster-register-address.patch @@ -0,0 +1,39 @@ +From c2d3b88201c1406171eadff96e22f02b2680907c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 15:50:58 +0200 +Subject: media: i2c: vd55g1: Fix duster register address + +From: Benjamin Mugnier + +[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ] + +The duster register needs to be disabled on test patterns. While the +code is correctly doing so, the register address contained a typo, thus +not disabling the duster correctly. Fix the typo. + +Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor") + +Signed-off-by: Benjamin Mugnier +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/vd55g1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c +index 7c39183dd44bf..4a62d35006829 100644 +--- a/drivers/media/i2c/vd55g1.c ++++ b/drivers/media/i2c/vd55g1.c +@@ -66,7 +66,7 @@ + #define VD55G1_REG_READOUT_CTRL CCI_REG8(0x052e) + #define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL 0 + #define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2 1 +-#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ea) ++#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ae) + #define VD55G1_DUSTER_ENABLE BIT(0) + #define VD55G1_DUSTER_DISABLE 0 + #define VD55G1_DUSTER_DYN_ENABLE BIT(1) +-- +2.51.0 + diff --git a/queue-6.17/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.17/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..8d5311f610 --- /dev/null +++ b/queue-6.17/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From 27f052a0b71b50a23d183eb6543eb3f1f67f8861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index b7ca39f63dba8..6dfc912168510 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client) + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-6.17/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.17/media-st-delta-avoid-excessive-stack-usage.patch new file mode 100644 index 0000000000..3a9d8ed7e5 --- /dev/null +++ b/queue-6.17/media-st-delta-avoid-excessive-stack-usage.patch @@ -0,0 +1,92 @@ +From 2c4f94e06f81e23435c68eeaa1dcc10f3d824808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 11:31:56 +0200 +Subject: media: st-delta: avoid excessive stack usage + +From: Arnd Bergmann + +[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ] + +Building with a reduced stack warning limit shows that delta_mjpeg_decode() +copies a giant structure to the stack each time but only uses three of +its members: + +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] + +Open-code the passing of the structure members that are actually used here. + +Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d24..a078f1107300e 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +-- +2.51.0 + diff --git a/queue-6.17/media-staging-ipu7-cleanup-the-mmu-correctly-in-ipu7.patch b/queue-6.17/media-staging-ipu7-cleanup-the-mmu-correctly-in-ipu7.patch new file mode 100644 index 0000000000..43cfb7acca --- /dev/null +++ b/queue-6.17/media-staging-ipu7-cleanup-the-mmu-correctly-in-ipu7.patch @@ -0,0 +1,51 @@ +From b389dcb61cf0332bd97079f9691f90d6da235da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:20:37 +0800 +Subject: media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release + +From: Bingbu Cao + +[ Upstream commit 01a80b6649e69e4889b8521de022d3ee4bc5cb6f ] + +IPU7 ISYS and PSYS auxiliary devices are released after +ipu7_bus_del_devices(), so driver can not reference the MMU devices +from ISYS and PSYS auxiliary devices, so move the MMUs cleanup before +releasing the auxiliary devices. + +Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") +Signed-off-by: Bingbu Cao +[Sakari Ailus: Drop extra newline.] +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu7/ipu7.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c +index aef931d235108..ee6b63717ed36 100644 +--- a/drivers/staging/media/ipu7/ipu7.c ++++ b/drivers/staging/media/ipu7/ipu7.c +@@ -2644,6 +2644,9 @@ static void ipu7_pci_remove(struct pci_dev *pdev) + if (!IS_ERR_OR_NULL(isp->fw_code_region)) + vfree(isp->fw_code_region); + ++ ipu7_mmu_cleanup(isp->isys->mmu); ++ ipu7_mmu_cleanup(isp->psys->mmu); ++ + ipu7_bus_del_devices(pdev); + + pm_runtime_forbid(&pdev->dev); +@@ -2652,9 +2655,6 @@ static void ipu7_pci_remove(struct pci_dev *pdev) + ipu_buttress_exit(isp); + + release_firmware(isp->cpd_fw); +- +- ipu7_mmu_cleanup(isp->psys->mmu); +- ipu7_mmu_cleanup(isp->isys->mmu); + } + + static void ipu7_pci_reset_prepare(struct pci_dev *pdev) +-- +2.51.0 + diff --git a/queue-6.17/media-staging-ipu7-convert-to-use-pci_alloc_irq_vect.patch b/queue-6.17/media-staging-ipu7-convert-to-use-pci_alloc_irq_vect.patch new file mode 100644 index 0000000000..593c860dba --- /dev/null +++ b/queue-6.17/media-staging-ipu7-convert-to-use-pci_alloc_irq_vect.patch @@ -0,0 +1,79 @@ +From 4b30ac40b81687fe34b7894182dfa2407b19130b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:20:35 +0800 +Subject: media: staging/ipu7: convert to use pci_alloc_irq_vectors() API + +From: Bingbu Cao + +[ Upstream commit 283f7638c26c0f36e4ef5e147884e241b24fbebd ] + +pci_enable_msi() is a deprecated API, thus switch to use modern +pci_alloc_irq_vectors(). + +Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") +Signed-off-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu7/ipu7.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c +index 1b4f01db13ca2..a8e8b0e231989 100644 +--- a/drivers/staging/media/ipu7/ipu7.c ++++ b/drivers/staging/media/ipu7/ipu7.c +@@ -2248,20 +2248,13 @@ void ipu7_dump_fw_error_log(const struct ipu7_bus_device *adev) + } + EXPORT_SYMBOL_NS_GPL(ipu7_dump_fw_error_log, "INTEL_IPU7"); + +-static int ipu7_pci_config_setup(struct pci_dev *dev) ++static void ipu7_pci_config_setup(struct pci_dev *dev) + { + u16 pci_command; +- int ret; + + pci_read_config_word(dev, PCI_COMMAND, &pci_command); + pci_command |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER; + pci_write_config_word(dev, PCI_COMMAND, pci_command); +- +- ret = pci_enable_msi(dev); +- if (ret) +- dev_err(&dev->dev, "Failed to enable msi (%d)\n", ret); +- +- return ret; + } + + static int ipu7_map_fw_code_region(struct ipu7_bus_device *sys, +@@ -2510,13 +2503,15 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + dma_set_max_seg_size(dev, UINT_MAX); + +- ret = ipu7_pci_config_setup(pdev); +- if (ret) +- return ret; ++ ipu7_pci_config_setup(pdev); ++ ++ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); ++ if (ret < 0) ++ return dev_err_probe(dev, ret, "Failed to alloc irq vector\n"); + + ret = ipu_buttress_init(isp); + if (ret) +- return ret; ++ goto pci_irq_free; + + dev_info(dev, "firmware cpd file: %s\n", isp->cpd_fw_name); + +@@ -2632,6 +2627,8 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + release_firmware(isp->cpd_fw); + buttress_exit: + ipu_buttress_exit(isp); ++pci_irq_free: ++ pci_free_irq_vectors(pdev); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.17/media-staging-ipu7-don-t-set-name-for-ipu7-pci-devic.patch b/queue-6.17/media-staging-ipu7-don-t-set-name-for-ipu7-pci-devic.patch new file mode 100644 index 0000000000..529c1bfe89 --- /dev/null +++ b/queue-6.17/media-staging-ipu7-don-t-set-name-for-ipu7-pci-devic.patch @@ -0,0 +1,36 @@ +From 9e832ff533f77836decc14274976371087a0bd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:20:36 +0800 +Subject: media: staging/ipu7: Don't set name for IPU7 PCI device + +From: Bingbu Cao + +[ Upstream commit 8abb489f9aa181882ece7c24712ad39cbb9dab81 ] + +Driver better not dev_set_name() to change the PCI device +name, so remove it. + +Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver") +Signed-off-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu7/ipu7.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c +index a8e8b0e231989..aef931d235108 100644 +--- a/drivers/staging/media/ipu7/ipu7.c ++++ b/drivers/staging/media/ipu7/ipu7.c +@@ -2428,7 +2428,6 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (!isp) + return -ENOMEM; + +- dev_set_name(dev, "intel-ipu7"); + isp->pdev = pdev; + INIT_LIST_HEAD(&isp->devices); + +-- +2.51.0 + diff --git a/queue-6.17/media-zoran-remove-zoran_fh-structure.patch b/queue-6.17/media-zoran-remove-zoran_fh-structure.patch new file mode 100644 index 0000000000..f3a2ab6110 --- /dev/null +++ b/queue-6.17/media-zoran-remove-zoran_fh-structure.patch @@ -0,0 +1,63 @@ +From cb04579c5bc172da542deb91285064836ccda8a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 04:30:15 +0300 +Subject: media: zoran: Remove zoran_fh structure + +From: Jacopo Mondi + +[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ] + +The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been +mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), +but the structure stayed by mistake. It is now used in a single +location, assigned from a void pointer and then recast to a void +pointer, without being every accessed. Drop it. + +Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") +Signed-off-by: Jacopo Mondi +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/zoran/zoran.h | 6 ------ + drivers/media/pci/zoran/zoran_driver.c | 3 +-- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 1cd990468d3de..d05e222b39215 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index f42f596d3e629..ec7fc1da4cc02 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +-- +2.51.0 + diff --git a/queue-6.17/mfd-max77705-max77705_charger-move-active-discharge-.patch b/queue-6.17/mfd-max77705-max77705_charger-move-active-discharge-.patch new file mode 100644 index 0000000000..082a9e6470 --- /dev/null +++ b/queue-6.17/mfd-max77705-max77705_charger-move-active-discharge-.patch @@ -0,0 +1,57 @@ +From 896bcf8502523eee9f6f7224e76aad9f0ce44d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 20:06:46 +0300 +Subject: mfd: max77705: max77705_charger: move active discharge setting to mfd + parent + +From: Dzmitry Sankouski + +[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ] + +Active discharge setting is a part of MFD top level i2c device, hence +cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1 +register from charger driver is a mistake. + +Move active discharge setting to MFD parent driver. + +Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") +Signed-off-by: Dzmitry Sankouski +Acked-by: Lee Jones +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/mfd/max77705.c | 3 +++ + drivers/power/supply/max77705_charger.c | 3 --- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c +index 6b263bacb8c28..ff07d0e0d5f8e 100644 +--- a/drivers/mfd/max77705.c ++++ b/drivers/mfd/max77705.c +@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c) + if (pmic_rev != MAX77705_PASS3) + return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev); + ++ /* Active Discharge Enable */ ++ regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1); ++ + ret = devm_regmap_add_irq_chip(dev, max77705->regmap, + i2c->irq, + IRQF_ONESHOT | IRQF_SHARED, 0, +diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c +index 329b430d0e506..3b75c82b9b9ea 100644 +--- a/drivers/power/supply/max77705_charger.c ++++ b/drivers/power/supply/max77705_charger.c +@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg) + regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00, + MAX77705_WDTEN_MASK, 0); + +- /* Active Discharge Enable */ +- regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1); +- + /* VBYPSET=5.0V */ + regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0); + +-- +2.51.0 + diff --git a/queue-6.17/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch b/queue-6.17/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch new file mode 100644 index 0000000000..302a0b4adb --- /dev/null +++ b/queue-6.17/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch @@ -0,0 +1,93 @@ +From d596aaba3590aad148bb014a8751b96a4c1448dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 21:23:07 +0300 +Subject: mfd: max77705: Setup the core driver as an interrupt controller + +From: Dzmitry Sankouski + +[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ] + +Current implementation describes only MFD's own topsys interrupts. +However, max77705 has a register which indicates interrupt source, i.e. +it acts as an interrupt controller. There's 4 interrupt sources in +max77705: topsys, charger, fuelgauge, usb type-c manager. + +Setup max77705 MFD parent as an interrupt controller. Delete topsys +interrupts because currently unused. + +Remove shared interrupt flag, because we're are an interrupt controller +now, and subdevices should request interrupts from us. + +Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC") + +Signed-off-by: Dzmitry Sankouski +Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/max77705.c | 35 ++++++++++++++--------------------- + 1 file changed, 14 insertions(+), 21 deletions(-) + +diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c +index ff07d0e0d5f8e..e1a9bfd658560 100644 +--- a/drivers/mfd/max77705.c ++++ b/drivers/mfd/max77705.c +@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = { + .max_register = MAX77705_PMIC_REG_USBC_RESET, + }; + +-static const struct regmap_irq max77705_topsys_irqs[] = { +- { .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, }, +- { .mask = MAX77705_SYSTEM_IRQ_TM_INT, }, ++static const struct regmap_irq max77705_irqs[] = { ++ { .mask = MAX77705_SRC_IRQ_CHG, }, ++ { .mask = MAX77705_SRC_IRQ_TOP, }, ++ { .mask = MAX77705_SRC_IRQ_FG, }, ++ { .mask = MAX77705_SRC_IRQ_USBC, }, + }; + +-static const struct regmap_irq_chip max77705_topsys_irq_chip = { +- .name = "max77705-topsys", +- .status_base = MAX77705_PMIC_REG_SYSTEM_INT, +- .mask_base = MAX77705_PMIC_REG_SYSTEM_INT_MASK, ++static const struct regmap_irq_chip max77705_irq_chip = { ++ .name = "max77705", ++ .status_base = MAX77705_PMIC_REG_INTSRC, ++ .ack_base = MAX77705_PMIC_REG_INTSRC, ++ .mask_base = MAX77705_PMIC_REG_INTSRC_MASK, + .num_regs = 1, +- .irqs = max77705_topsys_irqs, +- .num_irqs = ARRAY_SIZE(max77705_topsys_irqs), ++ .irqs = max77705_irqs, ++ .num_irqs = ARRAY_SIZE(max77705_irqs), + }; + + static int max77705_i2c_probe(struct i2c_client *i2c) +@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c) + + ret = devm_regmap_add_irq_chip(dev, max77705->regmap, + i2c->irq, +- IRQF_ONESHOT | IRQF_SHARED, 0, +- &max77705_topsys_irq_chip, ++ IRQF_ONESHOT, 0, ++ &max77705_irq_chip, + &irq_data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add IRQ chip\n"); + +- /* Unmask interrupts from all blocks in interrupt source register */ +- ret = regmap_update_bits(max77705->regmap, +- MAX77705_PMIC_REG_INTSRC_MASK, +- MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL); +- if (ret < 0) +- return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n"); +- + domain = regmap_irq_get_domain(irq_data); + + ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, +-- +2.51.0 + diff --git a/queue-6.17/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.17/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..e5bd256802 --- /dev/null +++ b/queue-6.17/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From 168ad90b0b861e1c97775f3918a7964a5390a221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-6.17/misc-pci_endpoint_test-fix-array-underflow-in-pci_en.patch b/queue-6.17/misc-pci_endpoint_test-fix-array-underflow-in-pci_en.patch new file mode 100644 index 0000000000..18868b748d --- /dev/null +++ b/queue-6.17/misc-pci_endpoint_test-fix-array-underflow-in-pci_en.patch @@ -0,0 +1,42 @@ +From dfcdda3a18c0a25db09e68ed171c612104d9694b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 20:03:35 +0300 +Subject: misc: pci_endpoint_test: Fix array underflow in + pci_endpoint_test_ioctl() + +From: Dan Carpenter + +[ Upstream commit 1ad82f9db13d85667366044acdfb02009d576c5a ] + +Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") +added NO_BAR (-1) to the pci_barno enum which, in practical terms, +changes the enum from an unsigned int to a signed int. If the user +passes a negative number in pci_endpoint_test_ioctl() then it results in +an array underflow in pci_endpoint_test_bar(). + +Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") +Signed-off-by: Dan Carpenter +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/aIzzZ4vc6ZrmM9rI@suswa +Signed-off-by: Sasha Levin +--- + drivers/misc/pci_endpoint_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c +index 1c156a3f845e1..f935175d8bf55 100644 +--- a/drivers/misc/pci_endpoint_test.c ++++ b/drivers/misc/pci_endpoint_test.c +@@ -937,7 +937,7 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd, + switch (cmd) { + case PCITEST_BAR: + bar = arg; +- if (bar > BAR_5) ++ if (bar <= NO_BAR || bar > BAR_5) + goto ret; + if (is_am654_pci_dev(pdev) && bar == BAR_0) + goto ret; +-- +2.51.0 + diff --git a/queue-6.17/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch b/queue-6.17/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch new file mode 100644 index 0000000000..56ac8ecf2c --- /dev/null +++ b/queue-6.17/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch @@ -0,0 +1,49 @@ +From 429dbb2e04e94b5c1b89ce6d9309520dd0de9ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 14:23:14 +0800 +Subject: mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal + +From: Kuan-Wei Chiu + +[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ] + +The comparison function cmp_loc_by_count() used for sorting stack trace +locations in debugfs currently returns -1 if a->count > b->count and 1 +otherwise. This breaks the antisymmetry property required by sort(), +because when two counts are equal, both cmp(a, b) and cmp(b, a) return +1. + +This can lead to undefined or incorrect ordering results. Fix it by +updating the comparison logic to explicitly handle the case when counts +are equal, and use cmp_int() to ensure the comparison function adheres +to the required mathematical properties of antisymmetry. + +Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces") +Reviewed-by: Joshua Hahn +Signed-off-by: Kuan-Wei Chiu +Reviewed-by: Harry Yoo +Signed-off-by: Vlastimil Babka +Signed-off-by: Sasha Levin +--- + mm/slub.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/mm/slub.c b/mm/slub.c +index d257141896c95..264fc76455d73 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -7731,10 +7731,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data) + struct location *loc1 = (struct location *)a; + struct location *loc2 = (struct location *)b; + +- if (loc1->count > loc2->count) +- return -1; +- else +- return 1; ++ return cmp_int(loc2->count, loc1->count); + } + + static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos) +-- +2.51.0 + diff --git a/queue-6.17/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch b/queue-6.17/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch new file mode 100644 index 0000000000..7788b507ca --- /dev/null +++ b/queue-6.17/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch @@ -0,0 +1,56 @@ +From 032ada895dae155952252d2b67efe54d77e2fb22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:06:05 +0200 +Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() + +From: Bean Huo + +[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ] + +Rename the inner 'frm' variable to 'resp_frm' in the write path of +mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable. + +The function declares 'frm' at function scope pointing to the request +frame, but then redeclares another 'frm' variable inside the write +block pointing to the response frame. This shadowing makes the code +confusing and error-prone. + +Using 'resp_frm' for the response frame makes the distinction clear +and improves code readability. + +Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") +Reviewed-by: Avri Altman +Reviewed-by: Jens Wiklander +Signed-off-by: Bean Huo +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 9cc47bf94804b..dd6cffc0df729 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req, + return -ENOMEM; + + if (write) { +- struct rpmb_frame *frm = (struct rpmb_frame *)resp; ++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp; + + /* Send write request frame(s) */ + set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK, + 1 | MMC_CMD23_ARG_REL_WR, req, req_len); + + /* Send result request frame */ +- memset(frm, 0, sizeof(*frm)); +- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); ++ memset(resp_frm, 0, sizeof(*resp_frm)); ++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ); + set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp, + resp_len); + +-- +2.51.0 + diff --git a/queue-6.17/mmc-select-regmap_mmio-with-mmc_loongson2.patch b/queue-6.17/mmc-select-regmap_mmio-with-mmc_loongson2.patch new file mode 100644 index 0000000000..682f78a2f9 --- /dev/null +++ b/queue-6.17/mmc-select-regmap_mmio-with-mmc_loongson2.patch @@ -0,0 +1,41 @@ +From d2ff8a2336be63db213127372668b1d3efad56e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 11:33:16 +0300 +Subject: mmc: select REGMAP_MMIO with MMC_LOONGSON2 + +From: Mikko Rapeli + +[ Upstream commit 67da3f16e5f97a864a0beb4f9758d09e1890a76e ] + +COMPILE_TEST with MMC_LOONGSON2 failed to link due to +undeclared dependency: + +ERROR: modpost: "__devm_regmap_init_mmio_clk" +[drivers/mmc/host/loongson2-mmc.ko] undefined! + +Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver") + +Suggested-by: Arnd Bergmann +Suggested-by: Binbin Zhou +Signed-off-by: Mikko Rapeli +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 7232de1c06887..5cc415ba4f550 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -1115,6 +1115,7 @@ config MMC_LOONGSON2 + tristate "Loongson-2K SD/SDIO/eMMC Host Interface support" + depends on LOONGARCH || COMPILE_TEST + depends on HAS_DMA ++ select REGMAP_MMIO + help + This selects support for the SD/SDIO/eMMC Host Controller on + Loongson-2K series CPUs. +-- +2.51.0 + diff --git a/queue-6.17/mptcp-call-dst_release-in-mptcp_active_enable.patch b/queue-6.17/mptcp-call-dst_release-in-mptcp_active_enable.patch new file mode 100644 index 0000000000..3674c1f588 --- /dev/null +++ b/queue-6.17/mptcp-call-dst_release-in-mptcp_active_enable.patch @@ -0,0 +1,43 @@ +From e50a6ebf2d313dee86ab6768f981a15886d29367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:24 +0000 +Subject: mptcp: Call dst_release() in mptcp_active_enable(). + +From: Kuniyuki Iwashima + +[ Upstream commit 108a86c71c93ff28087994e6107bc99ebe336629 ] + +mptcp_active_enable() calls sk_dst_get(), which returns dst with its +refcount bumped, but forgot dst_release(). + +Let's add missing dst_release(). + +Cc: stable@vger.kernel.org +Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Matthieu Baerts (NGI0) +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-7-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 893c49a78d9f ("mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().") +Signed-off-by: Sasha Levin +--- + net/mptcp/ctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c +index fed40dae5583a..c0e516872b4b5 100644 +--- a/net/mptcp/ctrl.c ++++ b/net/mptcp/ctrl.c +@@ -505,6 +505,8 @@ void mptcp_active_enable(struct sock *sk) + + if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)) + atomic_set(&pernet->active_disable_times, 0); ++ ++ dst_release(dst); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/mptcp-fix-up-subflow-s-memcg-when-config_sock_cgroup.patch b/queue-6.17/mptcp-fix-up-subflow-s-memcg-when-config_sock_cgroup.patch new file mode 100644 index 0000000000..84217e5fe3 --- /dev/null +++ b/queue-6.17/mptcp-fix-up-subflow-s-memcg-when-config_sock_cgroup.patch @@ -0,0 +1,123 @@ +From 2ab9a9c91241d32bec41a7cba7c0466411f5ad60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 20:16:09 +0000 +Subject: mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n. + +From: Kuniyuki Iwashima + +[ Upstream commit 68889dfd547bd8eabc5a98b58475d7b901cf5129 ] + +When sk_alloc() allocates a socket, mem_cgroup_sk_alloc() sets +sk->sk_memcg based on the current task. + +MPTCP subflow socket creation is triggered from userspace or +an in-kernel worker. + +In the latter case, sk->sk_memcg is not what we want. So, we fix +it up from the parent socket's sk->sk_memcg in mptcp_attach_cgroup(). + +Although the code is placed under #ifdef CONFIG_MEMCG, it is buried +under #ifdef CONFIG_SOCK_CGROUP_DATA. + +The two configs are orthogonal. If CONFIG_MEMCG is enabled without +CONFIG_SOCK_CGROUP_DATA, the subflow's memory usage is not charged +correctly. + +Let's move the code out of the wrong ifdef guard. + +Note that sk->sk_memcg is freed in sk_prot_free() and the parent +sk holds the refcnt of memcg->css here, so we don't need to use +css_tryget(). + +Fixes: 3764b0c5651e3 ("mptcp: attach subflow socket to parent cgroup") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Acked-by: Matthieu Baerts (NGI0) +Acked-by: Shakeel Butt +Link: https://patch.msgid.link/20250815201712.1745332-2-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/memcontrol.h | 6 ++++++ + mm/memcontrol.c | 13 +++++++++++++ + net/mptcp/subflow.c | 11 +++-------- + 3 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index 785173aa0739c..25921fbec6856 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -1604,6 +1604,7 @@ extern struct static_key_false memcg_sockets_enabled_key; + #define mem_cgroup_sockets_enabled static_branch_unlikely(&memcg_sockets_enabled_key) + void mem_cgroup_sk_alloc(struct sock *sk); + void mem_cgroup_sk_free(struct sock *sk); ++void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk); + + #if BITS_PER_LONG < 64 + static inline void mem_cgroup_set_socket_pressure(struct mem_cgroup *memcg) +@@ -1661,6 +1662,11 @@ void reparent_shrinker_deferred(struct mem_cgroup *memcg); + #define mem_cgroup_sockets_enabled 0 + static inline void mem_cgroup_sk_alloc(struct sock *sk) { }; + static inline void mem_cgroup_sk_free(struct sock *sk) { }; ++ ++static inline void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk) ++{ ++} ++ + static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg) + { + return false; +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 8dd7fbed5a942..46713b9ece063 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5024,6 +5024,19 @@ void mem_cgroup_sk_free(struct sock *sk) + css_put(&sk->sk_memcg->css); + } + ++void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk) ++{ ++ if (sk->sk_memcg == newsk->sk_memcg) ++ return; ++ ++ mem_cgroup_sk_free(newsk); ++ ++ if (sk->sk_memcg) ++ css_get(&sk->sk_memcg->css); ++ ++ newsk->sk_memcg = sk->sk_memcg; ++} ++ + /** + * mem_cgroup_charge_skmem - charge socket memory + * @memcg: memcg to charge +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index f31a3a79531a2..e8325890a3223 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1721,19 +1721,14 @@ static void mptcp_attach_cgroup(struct sock *parent, struct sock *child) + /* only the additional subflows created by kworkers have to be modified */ + if (cgroup_id(sock_cgroup_ptr(parent_skcd)) != + cgroup_id(sock_cgroup_ptr(child_skcd))) { +-#ifdef CONFIG_MEMCG +- struct mem_cgroup *memcg = parent->sk_memcg; +- +- mem_cgroup_sk_free(child); +- if (memcg && css_tryget(&memcg->css)) +- child->sk_memcg = memcg; +-#endif /* CONFIG_MEMCG */ +- + cgroup_sk_free(child_skcd); + *child_skcd = *parent_skcd; + cgroup_sk_clone(child_skcd); + } + #endif /* CONFIG_SOCK_CGROUP_DATA */ ++ ++ if (mem_cgroup_sockets_enabled) ++ mem_cgroup_sk_inherit(parent, child); + } + + static void mptcp_subflow_ops_override(struct sock *ssk) +-- +2.51.0 + diff --git a/queue-6.17/mptcp-use-__sk_dst_get-and-dst_dev_rcu-in-mptcp_acti.patch b/queue-6.17/mptcp-use-__sk_dst_get-and-dst_dev_rcu-in-mptcp_acti.patch new file mode 100644 index 0000000000..0580d1d74a --- /dev/null +++ b/queue-6.17/mptcp-use-__sk_dst_get-and-dst_dev_rcu-in-mptcp_acti.patch @@ -0,0 +1,55 @@ +From 5141c48379e7203a433d5300b29025af3b194864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:25 +0000 +Subject: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). + +From: Kuniyuki Iwashima + +[ Upstream commit 893c49a78d9f85e4b8081b908fb7c407d018106a ] + +mptcp_active_enable() is called from subflow_finish_connect(), +which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always +under RCU. + +Using sk_dst_get(sk)->dev could trigger UAF. + +Let's use __sk_dst_get() and dst_dev_rcu(). + +Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Matthieu Baerts (NGI0) +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/ctrl.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c +index c0e516872b4b5..e8ffa62ec183f 100644 +--- a/net/mptcp/ctrl.c ++++ b/net/mptcp/ctrl.c +@@ -501,12 +501,15 @@ void mptcp_active_enable(struct sock *sk) + struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk)); + + if (atomic_read(&pernet->active_disable_times)) { +- struct dst_entry *dst = sk_dst_get(sk); ++ struct net_device *dev; ++ struct dst_entry *dst; + +- if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)) ++ rcu_read_lock(); ++ dst = __sk_dst_get(sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ if (dev && (dev->flags & IFF_LOOPBACK)) + atomic_set(&pernet->active_disable_times, 0); +- +- dst_release(dst); ++ rcu_read_unlock(); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.17/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch new file mode 100644 index 0000000000..a0a434a242 --- /dev/null +++ b/queue-6.17/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch @@ -0,0 +1,50 @@ +From 24caca85637c6d46a1ab0047919eaeb0b089f310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 14:07:27 +0300 +Subject: mtd: rawnand: atmel: Fix error handling path in + atmel_nand_controller_add_nands + +From: Erick Karanja + +[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ] + +In case of a jump to the err label due to atmel_nand_create() or +atmel_nand_controller_add_nand() failure, the reference to nand_np +need to be released + +Use for_each_child_of_node_scoped() to fix the issue. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") + +Signed-off-by: Erick Karanja +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index db94d14a3807f..49e00458eebeb 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +-- +2.51.0 + diff --git a/queue-6.17/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.17/nbd-restrict-sockets-to-tcp-and-udp.patch new file mode 100644 index 0000000000..38c0971d26 --- /dev/null +++ b/queue-6.17/nbd-restrict-sockets-to-tcp-and-udp.patch @@ -0,0 +1,54 @@ +From 68ed2102e5f4590c65a4c299d96aecdd754cbadc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:22:43 +0000 +Subject: nbd: restrict sockets to TCP and UDP + +From: Eric Dumazet + +[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] + +Recently, syzbot started to abuse NBD with all kinds of sockets. + +Commit cf1b2326b734 ("nbd: verify socket is supported during setup") +made sure the socket supported a shutdown() method. + +Explicitely accept TCP and UNIX stream sockets. + +Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") +Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 +Signed-off-by: Eric Dumazet +Cc: Mike Christie +Cc: Richard W.M. Jones +Cc: Jens Axboe +Cc: Yu Kuai +Cc: linux-block@vger.kernel.org +Cc: nbd@other.debian.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 6463d0e8d0cef..87b0b78249da3 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.17/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..9d9e33cdf8 --- /dev/null +++ b/queue-6.17/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From 92645982a7d9b34632e357ed2ac4f3a33aff8865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 6bbf6e5584e54..1996d2e4e3e2c 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -964,15 +964,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-6.17/net-dst-introduce-dst-dev_rcu.patch b/queue-6.17/net-dst-introduce-dst-dev_rcu.patch new file mode 100644 index 0000000000..bd861a5b4b --- /dev/null +++ b/queue-6.17/net-dst-introduce-dst-dev_rcu.patch @@ -0,0 +1,110 @@ +From 67854d8be06cbb29db1e97d2d92410f208bd1bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:16 +0000 +Subject: net: dst: introduce dst->dev_rcu + +From: Eric Dumazet + +[ Upstream commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 ] + +Followup of commit 88fe14253e18 ("net: dst: add four helpers +to annotate data-races around dst->dev"). + +We want to gradually add explicit RCU protection to dst->dev, +including lockdep support. + +Add an union to alias dst->dev_rcu and dst->dev. + +Add dst_dev_net_rcu() helper. + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/dst.h | 16 +++++++++++----- + net/core/dst.c | 2 +- + net/ipv4/route.c | 4 ++-- + 3 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/include/net/dst.h b/include/net/dst.h +index bab01363bb975..f8aa1239b4db6 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -24,7 +24,10 @@ + struct sk_buff; + + struct dst_entry { +- struct net_device *dev; ++ union { ++ struct net_device *dev; ++ struct net_device __rcu *dev_rcu; ++ }; + struct dst_ops *ops; + unsigned long _metrics; + unsigned long expires; +@@ -570,9 +573,12 @@ static inline struct net_device *dst_dev(const struct dst_entry *dst) + + static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst) + { +- /* In the future, use rcu_dereference(dst->dev) */ +- WARN_ON_ONCE(!rcu_read_lock_held()); +- return READ_ONCE(dst->dev); ++ return rcu_dereference(dst->dev_rcu); ++} ++ ++static inline struct net *dst_dev_net_rcu(const struct dst_entry *dst) ++{ ++ return dev_net_rcu(dst_dev_rcu(dst)); + } + + static inline struct net_device *skb_dst_dev(const struct sk_buff *skb) +@@ -592,7 +598,7 @@ static inline struct net *skb_dst_dev_net(const struct sk_buff *skb) + + static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb) + { +- return dev_net_rcu(skb_dst_dev(skb)); ++ return dev_net_rcu(skb_dst_dev_rcu(skb)); + } + + struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); +diff --git a/net/core/dst.c b/net/core/dst.c +index e2de8b68c41d3..e9d35f49c9e78 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -150,7 +150,7 @@ void dst_dev_put(struct dst_entry *dst) + dst->ops->ifdown(dst, dev); + WRITE_ONCE(dst->input, dst_discard); + WRITE_ONCE(dst->output, dst_discard_out); +- WRITE_ONCE(dst->dev, blackhole_netdev); ++ rcu_assign_pointer(dst->dev_rcu, blackhole_netdev); + netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker, + GFP_ATOMIC); + } +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index baa43e5966b19..97b96275a775d 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1026,7 +1026,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + return; + + rcu_read_lock(); +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + if (mtu < net->ipv4.ip_rt_min_pmtu) { + lock = true; + mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu); +@@ -1326,7 +1326,7 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst) + struct net *net; + + rcu_read_lock(); +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size, + net->ipv4.ip_rt_min_advmss); + rcu_read_unlock(); +-- +2.51.0 + diff --git a/queue-6.17/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.17/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..ed3fa23a62 --- /dev/null +++ b/queue-6.17/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 7f8834df58f24299bb9e62c4e90d09568439317e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index a81d3a7a3bb9a..fe3479b84a1f3 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -865,7 +865,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-6.17/net-enetc-fix-probing-error-message-typo-for-the-ene.patch b/queue-6.17/net-enetc-fix-probing-error-message-typo-for-the-ene.patch new file mode 100644 index 0000000000..98f21c8020 --- /dev/null +++ b/queue-6.17/net-enetc-fix-probing-error-message-typo-for-the-ene.patch @@ -0,0 +1,38 @@ +From 6a68ae06c9869e28eabd9f35858061b7004cc218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 16:27:55 +0800 +Subject: net: enetc: Fix probing error message typo for the ENETCv4 PF driver + +From: Claudiu Manoil + +[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ] + +Blamed commit wrongly indicates VF error in case of PF probing error. + +Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") +Signed-off-by: Claudiu Manoil +Signed-off-by: Wei Fang +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c +index b3dc1afeefd1d..a5c1f1cef3b0c 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c +@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev, + err = enetc_get_driver_data(si); + if (err) + return dev_err_probe(dev, err, +- "Could not get VF driver data\n"); ++ "Could not get PF driver data\n"); + + err = enetc4_pf_struct_init(si); + if (err) +-- +2.51.0 + diff --git a/queue-6.17/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch b/queue-6.17/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch new file mode 100644 index 0000000000..a789223320 --- /dev/null +++ b/queue-6.17/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch @@ -0,0 +1,76 @@ +From 9c83b1cbaf3d2e3fe265f8859b616b6b2763b8c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:39:53 +0800 +Subject: net: enetc: initialize SW PIR and CIR based HW PIR and CIR values + +From: Wei Fang + +[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ] + +Software can only initialize the PIR and CIR of the command BD ring after +a FLR, and these two registers can only be set to 0. But the reset values +of these two registers are 0, so software does not need to update them. +If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or +other values by software will cause the command BD ring to work +abnormally. This is because of an internal context in the ring prefetch +logic that will retain the state from the first incarnation of the ring +and continue prefetching from the stale location when the ring is +reinitialized. The internal context can only be reset by the FLR. + +In addition, there is a logic error in the implementation, next_to_clean +indicates the software CIR and next_to_use indicates the software PIR. +But the current driver uses next_to_clean to set PIR and use next_to_use +to set CIR. This does not cause a problem in actual use, because the +current command BD ring is only initialized after FLR, and the initial +values of next_to_use and next_to_clean are both 0. + +Therefore, this patch removes the initialization of PIR and CIR. Instead, +next_to_use and next_to_clean are initialized by reading the values of +PIR and CIR. + +Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") +Signed-off-by: Wei Fang +Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c +index ba32c1bbd9e18..0c1d343253bfb 100644 +--- a/drivers/net/ethernet/freescale/enetc/ntmp.c ++++ b/drivers/net/ethernet/freescale/enetc/ntmp.c +@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, + cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base, + NTMP_BASE_ADDR_ALIGN); + +- cbdr->next_to_clean = 0; +- cbdr->next_to_use = 0; + spin_lock_init(&cbdr->ring_lock); + ++ cbdr->next_to_use = netc_read(cbdr->regs.pir); ++ cbdr->next_to_clean = netc_read(cbdr->regs.cir); ++ + /* Step 1: Configure the base address of the Control BD Ring */ + netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align)); + netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align)); + +- /* Step 2: Configure the producer index register */ +- netc_write(cbdr->regs.pir, cbdr->next_to_clean); +- +- /* Step 3: Configure the consumer index register */ +- netc_write(cbdr->regs.cir, cbdr->next_to_use); +- +- /* Step4: Configure the number of BDs of the Control BD Ring */ ++ /* Step 2: Configure the number of BDs of the Control BD Ring */ + netc_write(cbdr->regs.lenr, cbdr->bd_num); + +- /* Step 5: Enable the Control BD Ring */ ++ /* Step 3: Enable the Control BD Ring */ + netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN); + + return 0; +-- +2.51.0 + diff --git a/queue-6.17/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch b/queue-6.17/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch new file mode 100644 index 0000000000..4ee5608887 --- /dev/null +++ b/queue-6.17/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch @@ -0,0 +1,49 @@ +From 3955c8a38753c7d000dde49b5b7052eb3d6a0c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:19:24 -0700 +Subject: net: ethtool: tsconfig: set command must provide a reply + +From: Vadim Fedorenko + +[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ] + +Timestamping configuration through ethtool has inconsistent behavior of +skipping the reply for set command if configuration was not changed. Fix +it be providing reply in any case. + +Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") +Signed-off-by: Vadim Fedorenko +Reviewed-by: Kory Maincent +Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/tsconfig.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c +index 2be356bdfe873..169b413b31fc5 100644 +--- a/net/ethtool/tsconfig.c ++++ b/net/ethtool/tsconfig.c +@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base, + return ret; + } + +- if (hwprov_mod || config_mod) { +- ret = tsconfig_send_reply(dev, info); +- if (ret && ret != -EOPNOTSUPP) { +- NL_SET_ERR_MSG(info->extack, +- "error while reading the new configuration set"); +- return ret; +- } ++ ret = tsconfig_send_reply(dev, info); ++ if (ret && ret != -EOPNOTSUPP) { ++ NL_SET_ERR_MSG(info->extack, ++ "error while reading the new configuration set"); ++ return ret; + } + + /* tsconfig has no notification */ +-- +2.51.0 + diff --git a/queue-6.17/net-macb-move-ring-size-computation-to-functions.patch b/queue-6.17/net-macb-move-ring-size-computation-to-functions.patch new file mode 100644 index 0000000000..b319cd4d7e --- /dev/null +++ b/queue-6.17/net-macb-move-ring-size-computation-to-functions.patch @@ -0,0 +1,112 @@ +From 61c9b7da6d3448e38fe9301d8129d3cca5b85f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 18:00:25 +0200 +Subject: net: macb: move ring size computation to functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit 92d4256fafd8d0a14d3aaa10452ac771bf9b597c ] + +The tx/rx ring size calculation is somewhat complex and partially hidden +behind a macro. Move that out of the {RX,TX}_RING_BYTES() macros and +macb_{alloc,free}_consistent() functions into neat separate functions. + +In macb_free_consistent(), we drop the size variable and directly call +the size helpers in the arguments list. In macb_alloc_consistent(), we +keep the size variable that is used by netdev_dbg() calls. + +Acked-by: Nicolas Ferre +Signed-off-by: Théo Lebrun +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250923-macb-fixes-v6-3-772d655cdeb6@bootlin.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 78d901897b3c ("net: macb: single dma_alloc_coherent() for DMA descriptors") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 27 ++++++++++++++---------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 3e634049dadf1..73840808ea801 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -51,14 +51,10 @@ struct sifive_fu540_macb_mgmt { + #define DEFAULT_RX_RING_SIZE 512 /* must be power of 2 */ + #define MIN_RX_RING_SIZE 64 + #define MAX_RX_RING_SIZE 8192 +-#define RX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \ +- * (bp)->rx_ring_size) + + #define DEFAULT_TX_RING_SIZE 512 /* must be power of 2 */ + #define MIN_TX_RING_SIZE 64 + #define MAX_TX_RING_SIZE 4096 +-#define TX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \ +- * (bp)->tx_ring_size) + + /* level of occupied TX descriptors under which we wake up TX process */ + #define MACB_TX_WAKEUP_THRESH(bp) (3 * (bp)->tx_ring_size / 4) +@@ -2470,11 +2466,20 @@ static void macb_free_rx_buffers(struct macb *bp) + } + } + ++static unsigned int macb_tx_ring_size_per_queue(struct macb *bp) ++{ ++ return macb_dma_desc_get_size(bp) * bp->tx_ring_size + bp->tx_bd_rd_prefetch; ++} ++ ++static unsigned int macb_rx_ring_size_per_queue(struct macb *bp) ++{ ++ return macb_dma_desc_get_size(bp) * bp->rx_ring_size + bp->rx_bd_rd_prefetch; ++} ++ + static void macb_free_consistent(struct macb *bp) + { + struct macb_queue *queue; + unsigned int q; +- int size; + + if (bp->rx_ring_tieoff) { + dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp), +@@ -2488,14 +2493,14 @@ static void macb_free_consistent(struct macb *bp) + kfree(queue->tx_skb); + queue->tx_skb = NULL; + if (queue->tx_ring) { +- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch; +- dma_free_coherent(&bp->pdev->dev, size, ++ dma_free_coherent(&bp->pdev->dev, ++ macb_tx_ring_size_per_queue(bp), + queue->tx_ring, queue->tx_ring_dma); + queue->tx_ring = NULL; + } + if (queue->rx_ring) { +- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch; +- dma_free_coherent(&bp->pdev->dev, size, ++ dma_free_coherent(&bp->pdev->dev, ++ macb_rx_ring_size_per_queue(bp), + queue->rx_ring, queue->rx_ring_dma); + queue->rx_ring = NULL; + } +@@ -2546,7 +2551,7 @@ static int macb_alloc_consistent(struct macb *bp) + int size; + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch; ++ size = macb_tx_ring_size_per_queue(bp); + queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size, + &queue->tx_ring_dma, + GFP_KERNEL); +@@ -2564,7 +2569,7 @@ static int macb_alloc_consistent(struct macb *bp) + if (!queue->tx_skb) + goto out_err; + +- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch; ++ size = macb_rx_ring_size_per_queue(bp); + queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size, + &queue->rx_ring_dma, + GFP_KERNEL); +-- +2.51.0 + diff --git a/queue-6.17/net-macb-remove-illusion-about-tbqph-rbqph-being-per.patch b/queue-6.17/net-macb-remove-illusion-about-tbqph-rbqph-being-per.patch new file mode 100644 index 0000000000..dd7604c5e8 --- /dev/null +++ b/queue-6.17/net-macb-remove-illusion-about-tbqph-rbqph-being-per.patch @@ -0,0 +1,206 @@ +From 3a4a8598e47711026268db66bfcba6426f340ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 18:00:24 +0200 +Subject: net: macb: remove illusion about TBQPH/RBQPH being per-queue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit fca3dc859b200ca4dcdd2124beaf3bb2ab80b0f7 ] + +The MACB driver acts as if TBQPH/RBQPH are configurable on a per queue +basis; this is a lie. A single register configures the upper 32 bits of +each DMA descriptor buffers for all queues. + +Concrete actions: + + - Drop GEM_TBQPH/GEM_RBQPH macros which have a queue index argument. + Only use MACB_TBQPH/MACB_RBQPH constants. + + - Drop struct macb_queue->TBQPH/RBQPH fields. + + - In macb_init_buffers(): do a single write to TBQPH and RBQPH for all + queues instead of a write per queue. + + - In macb_tx_error_task(): drop the write to TBQPH. + + - In macb_alloc_consistent(): if allocations give different upper + 32-bits, fail. Previously, it would have lead to silent memory + corruption as queues would have used the upper 32 bits of the alloc + from queue 0 and their own low 32 bits. + + - In macb_suspend(): if we use the tie off descriptor for suspend, do + the write once for all queues instead of once per queue. + +Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM") +Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues") +Reviewed-by: Sean Anderson +Acked-by: Nicolas Ferre +Signed-off-by: Théo Lebrun +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250923-macb-fixes-v6-2-772d655cdeb6@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb.h | 4 -- + drivers/net/ethernet/cadence/macb_main.c | 57 ++++++++++-------------- + 2 files changed, 24 insertions(+), 37 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h +index c9a5c8beb2fa8..a7e845fee4b3a 100644 +--- a/drivers/net/ethernet/cadence/macb.h ++++ b/drivers/net/ethernet/cadence/macb.h +@@ -213,10 +213,8 @@ + + #define GEM_ISR(hw_q) (0x0400 + ((hw_q) << 2)) + #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2)) +-#define GEM_TBQPH(hw_q) (0x04C8) + #define GEM_RBQP(hw_q) (0x0480 + ((hw_q) << 2)) + #define GEM_RBQS(hw_q) (0x04A0 + ((hw_q) << 2)) +-#define GEM_RBQPH(hw_q) (0x04D4) + #define GEM_IER(hw_q) (0x0600 + ((hw_q) << 2)) + #define GEM_IDR(hw_q) (0x0620 + ((hw_q) << 2)) + #define GEM_IMR(hw_q) (0x0640 + ((hw_q) << 2)) +@@ -1214,10 +1212,8 @@ struct macb_queue { + unsigned int IDR; + unsigned int IMR; + unsigned int TBQP; +- unsigned int TBQPH; + unsigned int RBQS; + unsigned int RBQP; +- unsigned int RBQPH; + + /* Lock to protect tx_head and tx_tail */ + spinlock_t tx_ptr_lock; +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index c769b7dbd3baf..3e634049dadf1 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -495,19 +495,19 @@ static void macb_init_buffers(struct macb *bp) + struct macb_queue *queue; + unsigned int q; + +- for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +- queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma)); + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- if (bp->hw_dma_cap & HW_DMA_CAP_64B) +- queue_writel(queue, RBQPH, +- upper_32_bits(queue->rx_ring_dma)); ++ /* Single register for all queues' high 32 bits. */ ++ if (bp->hw_dma_cap & HW_DMA_CAP_64B) { ++ macb_writel(bp, RBQPH, ++ upper_32_bits(bp->queues[0].rx_ring_dma)); ++ macb_writel(bp, TBQPH, ++ upper_32_bits(bp->queues[0].tx_ring_dma)); ++ } + #endif ++ ++ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { ++ queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma)); + queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma)); +-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- if (bp->hw_dma_cap & HW_DMA_CAP_64B) +- queue_writel(queue, TBQPH, +- upper_32_bits(queue->tx_ring_dma)); +-#endif + } + } + +@@ -1166,10 +1166,6 @@ static void macb_tx_error_task(struct work_struct *work) + + /* Reinitialize the TX desc queue */ + queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma)); +-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- if (bp->hw_dma_cap & HW_DMA_CAP_64B) +- queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma)); +-#endif + /* Make TX ring reflect state of hardware */ + queue->tx_head = 0; + queue->tx_tail = 0; +@@ -2546,6 +2542,7 @@ static int macb_alloc_consistent(struct macb *bp) + { + struct macb_queue *queue; + unsigned int q; ++ u32 upper; + int size; + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +@@ -2553,7 +2550,9 @@ static int macb_alloc_consistent(struct macb *bp) + queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size, + &queue->tx_ring_dma, + GFP_KERNEL); +- if (!queue->tx_ring) ++ upper = upper_32_bits(queue->tx_ring_dma); ++ if (!queue->tx_ring || ++ upper != upper_32_bits(bp->queues[0].tx_ring_dma)) + goto out_err; + netdev_dbg(bp->dev, + "Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n", +@@ -2567,8 +2566,11 @@ static int macb_alloc_consistent(struct macb *bp) + + size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch; + queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size, +- &queue->rx_ring_dma, GFP_KERNEL); +- if (!queue->rx_ring) ++ &queue->rx_ring_dma, ++ GFP_KERNEL); ++ upper = upper_32_bits(queue->rx_ring_dma); ++ if (!queue->rx_ring || ++ upper != upper_32_bits(bp->queues[0].rx_ring_dma)) + goto out_err; + netdev_dbg(bp->dev, + "Allocated RX ring of %d bytes at %08lx (mapped %p)\n", +@@ -4309,12 +4311,6 @@ static int macb_init(struct platform_device *pdev) + queue->TBQP = GEM_TBQP(hw_q - 1); + queue->RBQP = GEM_RBQP(hw_q - 1); + queue->RBQS = GEM_RBQS(hw_q - 1); +-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- if (bp->hw_dma_cap & HW_DMA_CAP_64B) { +- queue->TBQPH = GEM_TBQPH(hw_q - 1); +- queue->RBQPH = GEM_RBQPH(hw_q - 1); +- } +-#endif + } else { + /* queue0 uses legacy registers */ + queue->ISR = MACB_ISR; +@@ -4323,12 +4319,6 @@ static int macb_init(struct platform_device *pdev) + queue->IMR = MACB_IMR; + queue->TBQP = MACB_TBQP; + queue->RBQP = MACB_RBQP; +-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- if (bp->hw_dma_cap & HW_DMA_CAP_64B) { +- queue->TBQPH = MACB_TBQPH; +- queue->RBQPH = MACB_RBQPH; +- } +-#endif + } + + /* get irq: here we use the linux queue index, not the hardware +@@ -5452,6 +5442,11 @@ static int __maybe_unused macb_suspend(struct device *dev) + */ + tmp = macb_readl(bp, NCR); + macb_writel(bp, NCR, tmp & ~(MACB_BIT(TE) | MACB_BIT(RE))); ++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT ++ if (!(bp->caps & MACB_CAPS_QUEUE_DISABLE)) ++ macb_writel(bp, RBQPH, ++ upper_32_bits(bp->rx_ring_tieoff_dma)); ++#endif + for (q = 0, queue = bp->queues; q < bp->num_queues; + ++q, ++queue) { + /* Disable RX queues */ +@@ -5461,10 +5456,6 @@ static int __maybe_unused macb_suspend(struct device *dev) + /* Tie off RX queues */ + queue_writel(queue, RBQP, + lower_32_bits(bp->rx_ring_tieoff_dma)); +-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT +- queue_writel(queue, RBQPH, +- upper_32_bits(bp->rx_ring_tieoff_dma)); +-#endif + } + /* Disable all interrupts */ + queue_writel(queue, IDR, -1); +-- +2.51.0 + diff --git a/queue-6.17/net-macb-single-dma_alloc_coherent-for-dma-descripto.patch b/queue-6.17/net-macb-single-dma_alloc_coherent-for-dma-descripto.patch new file mode 100644 index 0000000000..c56d2ce0f6 --- /dev/null +++ b/queue-6.17/net-macb-single-dma_alloc_coherent-for-dma-descripto.patch @@ -0,0 +1,184 @@ +From b916dc5557d57c9bb9ea81f0a89104c160beb6d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 18:00:26 +0200 +Subject: net: macb: single dma_alloc_coherent() for DMA descriptors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit 78d901897b3cae06b38f54e48a2378cf9da21175 ] + +Move from 2*NUM_QUEUES dma_alloc_coherent() for DMA descriptor rings to +2 calls overall. + +Issue is with how all queues share the same register for configuring the +upper 32-bits of Tx/Rx descriptor rings. Taking Tx, notice how TBQPH +does *not* depend on the queue index: + + #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2)) + #define GEM_TBQPH(hw_q) (0x04C8) + + queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma)); + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT + if (bp->hw_dma_cap & HW_DMA_CAP_64B) + queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma)); + #endif + +To maximise our chances of getting valid DMA addresses, we do a single +dma_alloc_coherent() across queues. This improves the odds because +alloc_pages() guarantees natural alignment. Other codepaths (IOMMU or +dev/arch dma_map_ops) don't give high enough guarantees +(even page-aligned isn't enough). + +Two consideration: + + - dma_alloc_coherent() gives us page alignment. Here we remove this + constraint meaning each queue's ring won't be page-aligned anymore. + + - This can save some tiny amounts of memory. Fewer allocations means + (1) less overhead (constant cost per alloc) and (2) less wasted bytes + due to alignment constraints. + + Example for (2): 4 queues, default ring size (512), 64-bit DMA + descriptors, 16K pages: + - Before: 8 allocs of 8K, each rounded to 16K => 64K wasted. + - After: 2 allocs of 32K => 0K wasted. + +Fixes: 02c958dd3446 ("net/macb: add TX multiqueue support for gem") +Reviewed-by: Sean Anderson +Acked-by: Nicolas Ferre +Tested-by: Nicolas Ferre # on sam9x75 +Signed-off-by: Théo Lebrun +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250923-macb-fixes-v6-4-772d655cdeb6@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 80 ++++++++++++------------ + 1 file changed, 41 insertions(+), 39 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 73840808ea801..fc082a7a5a313 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2478,32 +2478,30 @@ static unsigned int macb_rx_ring_size_per_queue(struct macb *bp) + + static void macb_free_consistent(struct macb *bp) + { ++ struct device *dev = &bp->pdev->dev; + struct macb_queue *queue; + unsigned int q; ++ size_t size; + + if (bp->rx_ring_tieoff) { +- dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp), ++ dma_free_coherent(dev, macb_dma_desc_get_size(bp), + bp->rx_ring_tieoff, bp->rx_ring_tieoff_dma); + bp->rx_ring_tieoff = NULL; + } + + bp->macbgem_ops.mog_free_rx_buffers(bp); + ++ size = bp->num_queues * macb_tx_ring_size_per_queue(bp); ++ dma_free_coherent(dev, size, bp->queues[0].tx_ring, bp->queues[0].tx_ring_dma); ++ ++ size = bp->num_queues * macb_rx_ring_size_per_queue(bp); ++ dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma); ++ + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { + kfree(queue->tx_skb); + queue->tx_skb = NULL; +- if (queue->tx_ring) { +- dma_free_coherent(&bp->pdev->dev, +- macb_tx_ring_size_per_queue(bp), +- queue->tx_ring, queue->tx_ring_dma); +- queue->tx_ring = NULL; +- } +- if (queue->rx_ring) { +- dma_free_coherent(&bp->pdev->dev, +- macb_rx_ring_size_per_queue(bp), +- queue->rx_ring, queue->rx_ring_dma); +- queue->rx_ring = NULL; +- } ++ queue->tx_ring = NULL; ++ queue->rx_ring = NULL; + } + } + +@@ -2545,41 +2543,45 @@ static int macb_alloc_rx_buffers(struct macb *bp) + + static int macb_alloc_consistent(struct macb *bp) + { ++ struct device *dev = &bp->pdev->dev; ++ dma_addr_t tx_dma, rx_dma; + struct macb_queue *queue; + unsigned int q; +- u32 upper; +- int size; ++ void *tx, *rx; ++ size_t size; ++ ++ /* ++ * Upper 32-bits of Tx/Rx DMA descriptor for each queues much match! ++ * We cannot enforce this guarantee, the best we can do is do a single ++ * allocation and hope it will land into alloc_pages() that guarantees ++ * natural alignment of physical addresses. ++ */ ++ ++ size = bp->num_queues * macb_tx_ring_size_per_queue(bp); ++ tx = dma_alloc_coherent(dev, size, &tx_dma, GFP_KERNEL); ++ if (!tx || upper_32_bits(tx_dma) != upper_32_bits(tx_dma + size - 1)) ++ goto out_err; ++ netdev_dbg(bp->dev, "Allocated %zu bytes for %u TX rings at %08lx (mapped %p)\n", ++ size, bp->num_queues, (unsigned long)tx_dma, tx); ++ ++ size = bp->num_queues * macb_rx_ring_size_per_queue(bp); ++ rx = dma_alloc_coherent(dev, size, &rx_dma, GFP_KERNEL); ++ if (!rx || upper_32_bits(rx_dma) != upper_32_bits(rx_dma + size - 1)) ++ goto out_err; ++ netdev_dbg(bp->dev, "Allocated %zu bytes for %u RX rings at %08lx (mapped %p)\n", ++ size, bp->num_queues, (unsigned long)rx_dma, rx); + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +- size = macb_tx_ring_size_per_queue(bp); +- queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size, +- &queue->tx_ring_dma, +- GFP_KERNEL); +- upper = upper_32_bits(queue->tx_ring_dma); +- if (!queue->tx_ring || +- upper != upper_32_bits(bp->queues[0].tx_ring_dma)) +- goto out_err; +- netdev_dbg(bp->dev, +- "Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n", +- q, size, (unsigned long)queue->tx_ring_dma, +- queue->tx_ring); ++ queue->tx_ring = tx + macb_tx_ring_size_per_queue(bp) * q; ++ queue->tx_ring_dma = tx_dma + macb_tx_ring_size_per_queue(bp) * q; ++ ++ queue->rx_ring = rx + macb_rx_ring_size_per_queue(bp) * q; ++ queue->rx_ring_dma = rx_dma + macb_rx_ring_size_per_queue(bp) * q; + + size = bp->tx_ring_size * sizeof(struct macb_tx_skb); + queue->tx_skb = kmalloc(size, GFP_KERNEL); + if (!queue->tx_skb) + goto out_err; +- +- size = macb_rx_ring_size_per_queue(bp); +- queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size, +- &queue->rx_ring_dma, +- GFP_KERNEL); +- upper = upper_32_bits(queue->rx_ring_dma); +- if (!queue->rx_ring || +- upper != upper_32_bits(bp->queues[0].rx_ring_dma)) +- goto out_err; +- netdev_dbg(bp->dev, +- "Allocated RX ring of %d bytes at %08lx (mapped %p)\n", +- size, (unsigned long)queue->rx_ring_dma, queue->rx_ring); + } + if (bp->macbgem_ops.mog_alloc_rx_buffers(bp)) + goto out_err; +-- +2.51.0 + diff --git a/queue-6.17/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.17/net-mlx5-fw-reset-add-reset-timeout-work.patch new file mode 100644 index 0000000000..aa93de9ef4 --- /dev/null +++ b/queue-6.17/net-mlx5-fw-reset-add-reset-timeout-work.patch @@ -0,0 +1,97 @@ +From 9bd0fcadc4546ec5cd232f28f6069ce6def494f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:09 +0300 +Subject: net/mlx5: fw reset, add reset timeout work + +From: Moshe Shemesh + +[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ] + +Add sync reset timeout to stop poll_sync_reset in case there was no +reset done or abort event within timeout. Otherwise poll sync reset will +just continue and in case of fw fatal error no health reporting will be +done. + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 22995131824a0..89e399606877b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -27,6 +27,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + u8 reset_method; + struct timer_list timer; +@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + static const struct devlink_param mlx5_fw_reset_devlink_params[] = { +@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +-- +2.51.0 + diff --git a/queue-6.17/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.17/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch new file mode 100644 index 0000000000..a12f43e346 --- /dev/null +++ b/queue-6.17/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch @@ -0,0 +1,57 @@ +From 89eb26b97f6900e73d8c796889b4050f785c8778 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:08 +0300 +Subject: net/mlx5: pagealloc: Fix reclaim race during command interface + teardown + +From: Shay Drory + +[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ] + +The reclaim_pages_cmd() function sends a command to the firmware to +reclaim pages if the command interface is active. + +A race condition can occur if the command interface goes down (e.g., due +to a PCI error) while the mlx5_cmd_do() call is in flight. In this +case, mlx5_cmd_do() will return an error. The original code would +propagate this error immediately, bypassing the software-based page +reclamation logic that is supposed to run when the command interface is +down. + +Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark +that command interface is down. If this is the case, fall through to +the software reclamation path. If the command failed for any another +reason, or finished successfully, return as before. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 9bc9bd83c2324..cd68c4b2c0bf9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +-- +2.51.0 + diff --git a/queue-6.17/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.17/net-mlx5-stop-polling-for-command-response-if-interf.patch new file mode 100644 index 0000000000..a1aa8bca18 --- /dev/null +++ b/queue-6.17/net-mlx5-stop-polling-for-command-response-if-interf.patch @@ -0,0 +1,53 @@ +From 46126896fea290f2eebaac5586fd8e603e15ad04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:07 +0300 +Subject: net/mlx5: Stop polling for command response if interface goes down + +From: Moshe Shemesh + +[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ] + +Stop polling on firmware response to command in polling mode if the +command interface got down. This situation can occur, for example, if a +firmware fatal error is detected during polling. + +This change halts the polling process when the command interface goes +down, preventing unnecessary waits. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index e395ef5f356eb..722282cebce9a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +-- +2.51.0 + diff --git a/queue-6.17/net-phy-as21xxx-better-handle-phy-hw-reset-on-soft-r.patch b/queue-6.17/net-phy-as21xxx-better-handle-phy-hw-reset-on-soft-r.patch new file mode 100644 index 0000000000..686c0daa93 --- /dev/null +++ b/queue-6.17/net-phy-as21xxx-better-handle-phy-hw-reset-on-soft-r.patch @@ -0,0 +1,55 @@ +From 178c7f5e8e6880dcb15cd70f710bbf350a09c7bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 15:44:29 +0200 +Subject: net: phy: as21xxx: better handle PHY HW reset on soft-reboot + +From: Christian Marangi + +[ Upstream commit b4d5cd20507b252c746fa6971d82ac96f3b3e5b7 ] + +On soft-reboot, with a reset GPIO defined for an Aeonsemi PHY, the +special match_phy_device fails to correctly identify that the PHY +needs to load the firmware again. + +This is caused by the fact that PHY ID is read BEFORE the PHY reset +GPIO (if present) is asserted, so we can be in the scenario where the +phydev have the previous PHY ID (with the PHY firmware loaded) but +after reset the generic AS21xxx PHY is present in the PHY ID registers. + +To better handle this, skip reading the PHY ID register only for the PHY +that are not AS21xxx (by matching for the Aeonsemi Vendor) and always +read the PHY ID for the other case to handle both firmware already +loaded or an HW reset. + +Fixes: 830877d89edc ("net: phy: Add support for Aeonsemi AS21xxx PHYs") +Signed-off-by: Christian Marangi +Link: https://patch.msgid.link/20250823134431.4854-2-ansuelsmth@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/as21xxx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/phy/as21xxx.c b/drivers/net/phy/as21xxx.c +index 92697f43087dc..0052773606562 100644 +--- a/drivers/net/phy/as21xxx.c ++++ b/drivers/net/phy/as21xxx.c +@@ -884,11 +884,12 @@ static int as21xxx_match_phy_device(struct phy_device *phydev, + u32 phy_id; + int ret; + +- /* Skip PHY that are not AS21xxx or already have firmware loaded */ +- if (phydev->c45_ids.device_ids[MDIO_MMD_PCS] != PHY_ID_AS21XXX) ++ /* Skip PHY that are not AS21xxx */ ++ if (!phy_id_compare_vendor(phydev->c45_ids.device_ids[MDIO_MMD_PCS], ++ PHY_VENDOR_AEONSEMI)) + return genphy_match_phy_device(phydev, phydrv); + +- /* Read PHY ID to handle firmware just loaded */ ++ /* Read PHY ID to handle firmware loaded or HW reset */ + ret = phy_read_mmd(phydev, MDIO_MMD_PCS, MII_PHYSID1); + if (ret < 0) + return ret; +-- +2.51.0 + diff --git a/queue-6.17/net-phy-introduce-phy_id_compare_vendor-phy-id-helpe.patch b/queue-6.17/net-phy-introduce-phy_id_compare_vendor-phy-id-helpe.patch new file mode 100644 index 0000000000..f373b9aea9 --- /dev/null +++ b/queue-6.17/net-phy-introduce-phy_id_compare_vendor-phy-id-helpe.patch @@ -0,0 +1,69 @@ +From 84685097936fcff585767d280a37ea3a06ac19ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 15:44:28 +0200 +Subject: net: phy: introduce phy_id_compare_vendor() PHY ID helper + +From: Christian Marangi + +[ Upstream commit 1abe21ef1adf0c5b6dbb5878c2fa4573df8d29fc ] + +Introduce phy_id_compare_vendor() PHY ID helper to compare a PHY ID with +the PHY ID Vendor using the generic PHY ID Vendor mask. + +While at it also rework the PHY_ID_MATCH macro and move the mask to +dedicated define so that PHY driver can make use of the mask if needed. + +Signed-off-by: Christian Marangi +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250823134431.4854-1-ansuelsmth@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: b4d5cd20507b ("net: phy: as21xxx: better handle PHY HW reset on soft-reboot") +Signed-off-by: Sasha Levin +--- + include/linux/phy.h | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/include/linux/phy.h b/include/linux/phy.h +index bb45787d86848..04553419adc3f 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -1273,9 +1273,13 @@ struct phy_driver { + #define to_phy_driver(d) container_of_const(to_mdio_common_driver(d), \ + struct phy_driver, mdiodrv) + +-#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 0) +-#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 4) +-#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 10) ++#define PHY_ID_MATCH_EXTACT_MASK GENMASK(31, 0) ++#define PHY_ID_MATCH_MODEL_MASK GENMASK(31, 4) ++#define PHY_ID_MATCH_VENDOR_MASK GENMASK(31, 10) ++ ++#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_EXTACT_MASK ++#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_MODEL_MASK ++#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_VENDOR_MASK + + /** + * phy_id_compare - compare @id1 with @id2 taking account of @mask +@@ -1291,6 +1295,19 @@ static inline bool phy_id_compare(u32 id1, u32 id2, u32 mask) + return !((id1 ^ id2) & mask); + } + ++/** ++ * phy_id_compare_vendor - compare @id with @vendor mask ++ * @id: PHY ID ++ * @vendor_mask: PHY Vendor mask ++ * ++ * Return: true if the bits from @id match @vendor using the ++ * generic PHY Vendor mask. ++ */ ++static inline bool phy_id_compare_vendor(u32 id, u32 vendor_mask) ++{ ++ return phy_id_compare(id, vendor_mask, PHY_ID_MATCH_VENDOR_MASK); ++} ++ + /** + * phydev_id_compare - compare @id with the PHY's Clause 22 ID + * @phydev: the PHY device +-- +2.51.0 + diff --git a/queue-6.17/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.17/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..1b93105256 --- /dev/null +++ b/queue-6.17/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From a5f8f69796c0add9cff9a9bae42ed74be7bdf365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98e..92add3daadbb1 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.17/net-use-dst_dev_rcu-in-sk_setup_caps.patch b/queue-6.17/net-use-dst_dev_rcu-in-sk_setup_caps.patch new file mode 100644 index 0000000000..4022197af7 --- /dev/null +++ b/queue-6.17/net-use-dst_dev_rcu-in-sk_setup_caps.patch @@ -0,0 +1,143 @@ +From de37fcccaea2abc58e36f82e0f321b15495785d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:20 +0000 +Subject: net: use dst_dev_rcu() in sk_setup_caps() + +From: Eric Dumazet + +[ Upstream commit 99a2ace61b211b0be861b07fbaa062fca4b58879 ] + +Use RCU to protect accesses to dst->dev from sk_setup_caps() +and sk_dst_gso_max_size(). + +Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), +and ip_dst_mtu_maybe_forward(). + +ip4_dst_hoplimit() can use dst_dev_net_rcu(). + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 6 ++++-- + include/net/ip6_route.h | 2 +- + include/net/route.h | 2 +- + net/core/sock.c | 16 ++++++++++------ + 4 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index befcba575129a..6dbd2bf8fa9c9 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -467,12 +467,14 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + bool forwarding) + { + const struct rtable *rt = dst_rtable(dst); ++ const struct net_device *dev; + unsigned int mtu, res; + struct net *net; + + rcu_read_lock(); + +- net = dev_net_rcu(dst_dev(dst)); ++ dev = dst_dev_rcu(dst); ++ net = dev_net_rcu(dev); + if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) || + ip_mtu_locked(dst) || + !forwarding) { +@@ -486,7 +488,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + if (mtu) + goto out; + +- mtu = READ_ONCE(dst_dev(dst)->mtu); ++ mtu = READ_ONCE(dev->mtu); + + if (unlikely(ip_mtu_locked(dst))) { + if (rt->rt_uses_gateway && mtu > 576) +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index 9255f21818ee7..59f48ca3abdf5 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -337,7 +337,7 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst + + mtu = IPV6_MIN_MTU; + rcu_read_lock(); +- idev = __in6_dev_get(dst_dev(dst)); ++ idev = __in6_dev_get(dst_dev_rcu(dst)); + if (idev) + mtu = READ_ONCE(idev->cnf.mtu6); + rcu_read_unlock(); +diff --git a/include/net/route.h b/include/net/route.h +index 7ea840daa775b..c916bbe25a774 100644 +--- a/include/net/route.h ++++ b/include/net/route.h +@@ -390,7 +390,7 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst) + const struct net *net; + + rcu_read_lock(); +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl); + rcu_read_unlock(); + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 158bddd23134c..e21348ead7e76 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2584,7 +2584,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + } + EXPORT_SYMBOL_GPL(sk_clone_lock); + +-static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst) ++static u32 sk_dst_gso_max_size(struct sock *sk, const struct net_device *dev) + { + bool is_ipv6 = false; + u32 max_size; +@@ -2594,8 +2594,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst) + !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)); + #endif + /* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */ +- max_size = is_ipv6 ? READ_ONCE(dst_dev(dst)->gso_max_size) : +- READ_ONCE(dst_dev(dst)->gso_ipv4_max_size); ++ max_size = is_ipv6 ? READ_ONCE(dev->gso_max_size) : ++ READ_ONCE(dev->gso_ipv4_max_size); + if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk)) + max_size = GSO_LEGACY_MAX_SIZE; + +@@ -2604,9 +2604,12 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst) + + void sk_setup_caps(struct sock *sk, struct dst_entry *dst) + { ++ const struct net_device *dev; + u32 max_segs = 1; + +- sk->sk_route_caps = dst_dev(dst)->features; ++ rcu_read_lock(); ++ dev = dst_dev_rcu(dst); ++ sk->sk_route_caps = dev->features; + if (sk_is_tcp(sk)) { + struct inet_connection_sock *icsk = inet_csk(sk); + +@@ -2622,13 +2625,14 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) + sk->sk_route_caps &= ~NETIF_F_GSO_MASK; + } else { + sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM; +- sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dst); ++ sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dev); + /* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */ +- max_segs = max_t(u32, READ_ONCE(dst_dev(dst)->gso_max_segs), 1); ++ max_segs = max_t(u32, READ_ONCE(dev->gso_max_segs), 1); + } + } + sk->sk_gso_max_segs = max_segs; + sk_dst_set(sk, dst); ++ rcu_read_unlock(); + } + EXPORT_SYMBOL_GPL(sk_setup_caps); + +-- +2.51.0 + diff --git a/queue-6.17/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.17/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..d76fd7eb6b --- /dev/null +++ b/queue-6.17/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 9180da0a9c2683b194506bdd7f8dbbfed424f5d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 5251524b96afa..5e4453e9ef8e7 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -63,7 +63,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-6.17/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch b/queue-6.17/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch new file mode 100644 index 0000000000..7e68a3c85f --- /dev/null +++ b/queue-6.17/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch @@ -0,0 +1,49 @@ +From a121376ca6ffe07c802e2defd9209c900f75f5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 07:27:09 +0000 +Subject: netfilter: nf_conntrack: do not skip entries in + /proc/net/nf_conntrack + +From: Eric Dumazet + +[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ] + +ct_seq_show() has an opportunistic garbage collector : + +if (nf_ct_should_gc(ct)) { + nf_ct_kill(ct); + goto release; +} + +So if one nf_conn is killed there, next time ct_get_next() runs, +we skip the following item in the bucket, even if it should have +been displayed if gc did not take place. + +We can decrement st->skip_elems to tell ct_get_next() one of the items +was removed from the chain. + +Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack") +Signed-off-by: Eric Dumazet +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_standalone.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 1f14ef0436c65..708b79380f047 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -317,6 +317,9 @@ static int ct_seq_show(struct seq_file *s, void *v) + smp_acquire__after_ctrl_dep(); + + if (nf_ct_should_gc(ct)) { ++ struct ct_iter_state *st = s->private; ++ ++ st->skip_elems--; + nf_ct_kill(ct); + goto release; + } +-- +2.51.0 + diff --git a/queue-6.17/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch b/queue-6.17/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch new file mode 100644 index 0000000000..0f5feed87d --- /dev/null +++ b/queue-6.17/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch @@ -0,0 +1,51 @@ +From 392fb615821862db3710c094117a9b23f5e9c7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 14:40:43 +0200 +Subject: netfilter: nfnetlink: reset nlh pointer during batch replay + +From: Fernando Fernandez Mancera + +[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ] + +During a batch replay, the nlh pointer is not reset until the parsing of +the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle +ACK flags for batch messages") that is problematic as the condition to +add an ACK for batch begin will evaluate to true even if NLM_F_ACK +wasn't used for batch begin message. + +If there is an error during the command processing, netlink is sending +an ACK despite that. This misleads userspace tools which think that the +return code was 0. Reset the nlh pointer to the original one when a +replay is triggered. + +Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") +Signed-off-by: Fernando Fernandez Mancera +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index e598a2a252b0a..811d02b4c4f7c 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + const struct nfnetlink_subsystem *ss; + const struct nfnl_callback *nc; + struct netlink_ext_ack extack; ++ struct nlmsghdr *onlh = nlh; + LIST_HEAD(err_list); + u32 status; + int err; +@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + status = 0; + replay_abort: + skb = netlink_skb_clone(oskb, GFP_KERNEL); ++ nlh = onlh; + if (!skb) + return netlink_ack(oskb, nlh, -ENOMEM, NULL); + +-- +2.51.0 + diff --git a/queue-6.17/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.17/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..814f26a612 --- /dev/null +++ b/queue-6.17/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From 3a8f5d92e83c393ebf65eddb276e2077e46286b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index a36215195923c..16c828dd5c1a3 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1788,7 +1788,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-6.17/nfs-localio-avoid-issuing-misaligned-io-using-o_dire.patch b/queue-6.17/nfs-localio-avoid-issuing-misaligned-io-using-o_dire.patch new file mode 100644 index 0000000000..fec3b91dfb --- /dev/null +++ b/queue-6.17/nfs-localio-avoid-issuing-misaligned-io-using-o_dire.patch @@ -0,0 +1,194 @@ +From 7f818935051c3eefc1f3fb7cf4f2fb21d0700365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 10:36:26 -0400 +Subject: nfs/localio: avoid issuing misaligned IO using O_DIRECT + +From: Mike Snitzer + +[ Upstream commit 25ba2b84c38f624151a3ba36e56d41c39b9223ad ] + +Add nfsd_file_dio_alignment and use it to avoid issuing misaligned IO +using O_DIRECT. Any misaligned DIO falls back to using buffered IO. + +Because misaligned DIO is now handled safely, remove the nfs modparam +'localio_O_DIRECT_semantics' that was added to require users opt-in to +the requirement that all O_DIRECT be properly DIO-aligned. + +Also, introduce nfs_iov_iter_aligned_bvec() which is a variant of +iov_iter_aligned_bvec() that also verifies the offset associated with +an iov_iter is DIO-aligned. NOTE: in a parallel effort, +iov_iter_aligned_bvec() is being removed along with +iov_iter_is_aligned(). + +Lastly, add pr_info_ratelimited if underlying filesystem returns +-EINVAL because it was made to try O_DIRECT for IO that is not +DIO-aligned (shouldn't happen, so its best to be louder if it does). + +Fixes: 3feec68563d ("nfs/localio: add direct IO enablement with sync and async IO support") +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/localio.c | 65 ++++++++++++++++++++++++++++++++------ + fs/nfsd/localio.c | 11 +++++++ + include/linux/nfslocalio.h | 2 ++ + 3 files changed, 68 insertions(+), 10 deletions(-) + +diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c +index 97abf62f109d2..31ce210f032ac 100644 +--- a/fs/nfs/localio.c ++++ b/fs/nfs/localio.c +@@ -49,11 +49,6 @@ struct nfs_local_fsync_ctx { + static bool localio_enabled __read_mostly = true; + module_param(localio_enabled, bool, 0644); + +-static bool localio_O_DIRECT_semantics __read_mostly = false; +-module_param(localio_O_DIRECT_semantics, bool, 0644); +-MODULE_PARM_DESC(localio_O_DIRECT_semantics, +- "LOCALIO will use O_DIRECT semantics to filesystem."); +- + static inline bool nfs_client_is_local(const struct nfs_client *clp) + { + return !!rcu_access_pointer(clp->cl_uuid.net); +@@ -321,12 +316,9 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr, + return NULL; + } + +- if (localio_O_DIRECT_semantics && +- test_bit(NFS_IOHDR_ODIRECT, &hdr->flags)) { +- iocb->kiocb.ki_filp = file; ++ init_sync_kiocb(&iocb->kiocb, file); ++ if (test_bit(NFS_IOHDR_ODIRECT, &hdr->flags)) + iocb->kiocb.ki_flags = IOCB_DIRECT; +- } else +- init_sync_kiocb(&iocb->kiocb, file); + + iocb->kiocb.ki_pos = hdr->args.offset; + iocb->hdr = hdr; +@@ -336,6 +328,30 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr, + return iocb; + } + ++static bool nfs_iov_iter_aligned_bvec(const struct iov_iter *i, ++ loff_t offset, unsigned int addr_mask, unsigned int len_mask) ++{ ++ const struct bio_vec *bvec = i->bvec; ++ size_t skip = i->iov_offset; ++ size_t size = i->count; ++ ++ if ((offset | size) & len_mask) ++ return false; ++ do { ++ size_t len = bvec->bv_len; ++ ++ if (len > size) ++ len = size; ++ if ((unsigned long)(bvec->bv_offset + skip) & addr_mask) ++ return false; ++ bvec++; ++ size -= len; ++ skip = 0; ++ } while (size); ++ ++ return true; ++} ++ + static void + nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir) + { +@@ -345,6 +361,25 @@ nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir) + hdr->args.count + hdr->args.pgbase); + if (hdr->args.pgbase != 0) + iov_iter_advance(i, hdr->args.pgbase); ++ ++ if (iocb->kiocb.ki_flags & IOCB_DIRECT) { ++ u32 nf_dio_mem_align, nf_dio_offset_align, nf_dio_read_offset_align; ++ /* Verify the IO is DIO-aligned as required */ ++ nfs_to->nfsd_file_dio_alignment(iocb->localio, &nf_dio_mem_align, ++ &nf_dio_offset_align, ++ &nf_dio_read_offset_align); ++ if (dir == READ) ++ nf_dio_offset_align = nf_dio_read_offset_align; ++ ++ if (nf_dio_mem_align && nf_dio_offset_align && ++ nfs_iov_iter_aligned_bvec(i, hdr->args.offset, ++ nf_dio_mem_align - 1, ++ nf_dio_offset_align - 1)) ++ return; /* is DIO-aligned */ ++ ++ /* Fallback to using buffered for this misaligned IO */ ++ iocb->kiocb.ki_flags &= ~IOCB_DIRECT; ++ } + } + + static void +@@ -405,6 +440,11 @@ nfs_local_read_done(struct nfs_local_kiocb *iocb, long status) + struct nfs_pgio_header *hdr = iocb->hdr; + struct file *filp = iocb->kiocb.ki_filp; + ++ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) { ++ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */ ++ pr_info_ratelimited("nfs: Unexpected direct I/O read alignment failure\n"); ++ } ++ + nfs_local_pgio_done(hdr, status); + + /* +@@ -597,6 +637,11 @@ nfs_local_write_done(struct nfs_local_kiocb *iocb, long status) + + dprintk("%s: wrote %ld bytes.\n", __func__, status > 0 ? status : 0); + ++ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) { ++ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */ ++ pr_info_ratelimited("nfs: Unexpected direct I/O write alignment failure\n"); ++ } ++ + /* Handle short writes as if they are ENOSPC */ + if (status > 0 && status < hdr->args.count) { + hdr->mds_offset += status; +diff --git a/fs/nfsd/localio.c b/fs/nfsd/localio.c +index cb237f1b902a7..9e0a37cd29d8a 100644 +--- a/fs/nfsd/localio.c ++++ b/fs/nfsd/localio.c +@@ -117,6 +117,16 @@ nfsd_open_local_fh(struct net *net, struct auth_domain *dom, + return localio; + } + ++static void nfsd_file_dio_alignment(struct nfsd_file *nf, ++ u32 *nf_dio_mem_align, ++ u32 *nf_dio_offset_align, ++ u32 *nf_dio_read_offset_align) ++{ ++ *nf_dio_mem_align = nf->nf_dio_mem_align; ++ *nf_dio_offset_align = nf->nf_dio_offset_align; ++ *nf_dio_read_offset_align = nf->nf_dio_read_offset_align; ++} ++ + static const struct nfsd_localio_operations nfsd_localio_ops = { + .nfsd_net_try_get = nfsd_net_try_get, + .nfsd_net_put = nfsd_net_put, +@@ -124,6 +134,7 @@ static const struct nfsd_localio_operations nfsd_localio_ops = { + .nfsd_file_put_local = nfsd_file_put_local, + .nfsd_file_get_local = nfsd_file_get_local, + .nfsd_file_file = nfsd_file_file, ++ .nfsd_file_dio_alignment = nfsd_file_dio_alignment, + }; + + void nfsd_localio_ops_init(void) +diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h +index 5c7c92659e736..7ca2715edccca 100644 +--- a/include/linux/nfslocalio.h ++++ b/include/linux/nfslocalio.h +@@ -65,6 +65,8 @@ struct nfsd_localio_operations { + struct net *(*nfsd_file_put_local)(struct nfsd_file __rcu **); + struct nfsd_file *(*nfsd_file_get_local)(struct nfsd_file *); + struct file *(*nfsd_file_file)(struct nfsd_file *); ++ void (*nfsd_file_dio_alignment)(struct nfsd_file *, ++ u32 *, u32 *, u32 *); + } ____cacheline_aligned; + + extern void nfsd_localio_ops_init(void); +-- +2.51.0 + diff --git a/queue-6.17/nfsd-filecache-add-statx_dioalign-and-statx_dio_read.patch b/queue-6.17/nfsd-filecache-add-statx_dioalign-and-statx_dio_read.patch new file mode 100644 index 0000000000..4b6b730c8d --- /dev/null +++ b/queue-6.17/nfsd-filecache-add-statx_dioalign-and-statx_dio_read.patch @@ -0,0 +1,190 @@ +From 97660d35c741de050eea6a3c17814fcca1de62ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:56:41 -0400 +Subject: NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support + +From: Mike Snitzer + +[ Upstream commit d11f6cd1bb4a416b4515702d020a7480ac667f0f ] + +Use STATX_DIOALIGN and STATX_DIO_READ_ALIGN to get DIO alignment +attributes from the underlying filesystem and store them in the +associated nfsd_file. This is done when the nfsd_file is first +opened for each regular file. + +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Reviewed-by: NeilBrown +Signed-off-by: Chuck Lever +Acked-by: Chuck Lever +Signed-off-by: Anna Schumaker +Stable-dep-of: 25ba2b84c38f ("nfs/localio: avoid issuing misaligned IO using O_DIRECT") +Signed-off-by: Sasha Levin +--- + fs/nfsd/filecache.c | 34 ++++++++++++++++++++++++++++++++++ + fs/nfsd/filecache.h | 4 ++++ + fs/nfsd/trace.h | 27 +++++++++++++++++++++++++++ + fs/nfsd/vfs.h | 4 ++++ + include/trace/misc/fs.h | 22 ++++++++++++++++++++++ + 5 files changed, 91 insertions(+) + +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index 732abf6b92a56..7ca1dedf4e04a 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -231,6 +231,9 @@ nfsd_file_alloc(struct net *net, struct inode *inode, unsigned char need, + refcount_set(&nf->nf_ref, 1); + nf->nf_may = need; + nf->nf_mark = NULL; ++ nf->nf_dio_mem_align = 0; ++ nf->nf_dio_offset_align = 0; ++ nf->nf_dio_read_offset_align = 0; + return nf; + } + +@@ -1069,6 +1072,35 @@ nfsd_file_is_cached(struct inode *inode) + return ret; + } + ++static __be32 ++nfsd_file_get_dio_attrs(const struct svc_fh *fhp, struct nfsd_file *nf) ++{ ++ struct inode *inode = file_inode(nf->nf_file); ++ struct kstat stat; ++ __be32 status; ++ ++ /* Currently only need to get DIO alignment info for regular files */ ++ if (!S_ISREG(inode->i_mode)) ++ return nfs_ok; ++ ++ status = fh_getattr(fhp, &stat); ++ if (status != nfs_ok) ++ return status; ++ ++ trace_nfsd_file_get_dio_attrs(inode, &stat); ++ ++ if (stat.result_mask & STATX_DIOALIGN) { ++ nf->nf_dio_mem_align = stat.dio_mem_align; ++ nf->nf_dio_offset_align = stat.dio_offset_align; ++ } ++ if (stat.result_mask & STATX_DIO_READ_ALIGN) ++ nf->nf_dio_read_offset_align = stat.dio_read_offset_align; ++ else ++ nf->nf_dio_read_offset_align = nf->nf_dio_offset_align; ++ ++ return nfs_ok; ++} ++ + static __be32 + nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net, + struct svc_cred *cred, +@@ -1187,6 +1219,8 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net, + } + status = nfserrno(ret); + trace_nfsd_file_open(nf, status); ++ if (status == nfs_ok) ++ status = nfsd_file_get_dio_attrs(fhp, nf); + } + } else + status = nfserr_jukebox; +diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h +index 722b26c71e454..237a05c74211b 100644 +--- a/fs/nfsd/filecache.h ++++ b/fs/nfsd/filecache.h +@@ -54,6 +54,10 @@ struct nfsd_file { + struct list_head nf_gc; + struct rcu_head nf_rcu; + ktime_t nf_birthtime; ++ ++ u32 nf_dio_mem_align; ++ u32 nf_dio_offset_align; ++ u32 nf_dio_read_offset_align; + }; + + int nfsd_file_cache_init(void); +diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h +index a664fdf1161e9..6e2c8e2aab10a 100644 +--- a/fs/nfsd/trace.h ++++ b/fs/nfsd/trace.h +@@ -1133,6 +1133,33 @@ TRACE_EVENT(nfsd_file_alloc, + ) + ); + ++TRACE_EVENT(nfsd_file_get_dio_attrs, ++ TP_PROTO( ++ const struct inode *inode, ++ const struct kstat *stat ++ ), ++ TP_ARGS(inode, stat), ++ TP_STRUCT__entry( ++ __field(const void *, inode) ++ __field(unsigned long, mask) ++ __field(u32, mem_align) ++ __field(u32, offset_align) ++ __field(u32, read_offset_align) ++ ), ++ TP_fast_assign( ++ __entry->inode = inode; ++ __entry->mask = stat->result_mask; ++ __entry->mem_align = stat->dio_mem_align; ++ __entry->offset_align = stat->dio_offset_align; ++ __entry->read_offset_align = stat->dio_read_offset_align; ++ ), ++ TP_printk("inode=%p flags=%s mem_align=%u offset_align=%u read_offset_align=%u", ++ __entry->inode, show_statx_mask(__entry->mask), ++ __entry->mem_align, __entry->offset_align, ++ __entry->read_offset_align ++ ) ++); ++ + TRACE_EVENT(nfsd_file_acquire, + TP_PROTO( + const struct svc_rqst *rqstp, +diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h +index eff04959606fe..fde3e0c11dbaf 100644 +--- a/fs/nfsd/vfs.h ++++ b/fs/nfsd/vfs.h +@@ -185,6 +185,10 @@ static inline __be32 fh_getattr(const struct svc_fh *fh, struct kstat *stat) + u32 request_mask = STATX_BASIC_STATS; + struct path p = {.mnt = fh->fh_export->ex_path.mnt, + .dentry = fh->fh_dentry}; ++ struct inode *inode = d_inode(p.dentry); ++ ++ if (S_ISREG(inode->i_mode)) ++ request_mask |= (STATX_DIOALIGN | STATX_DIO_READ_ALIGN); + + if (fh->fh_maxsize == NFS4_FHSIZE) + request_mask |= (STATX_BTIME | STATX_CHANGE_COOKIE); +diff --git a/include/trace/misc/fs.h b/include/trace/misc/fs.h +index 0406ebe2a80a4..7ead1c61f0cb1 100644 +--- a/include/trace/misc/fs.h ++++ b/include/trace/misc/fs.h +@@ -141,3 +141,25 @@ + { ATTR_TIMES_SET, "TIMES_SET" }, \ + { ATTR_TOUCH, "TOUCH"}, \ + { ATTR_DELEG, "DELEG"}) ++ ++#define show_statx_mask(flags) \ ++ __print_flags(flags, "|", \ ++ { STATX_TYPE, "TYPE" }, \ ++ { STATX_MODE, "MODE" }, \ ++ { STATX_NLINK, "NLINK" }, \ ++ { STATX_UID, "UID" }, \ ++ { STATX_GID, "GID" }, \ ++ { STATX_ATIME, "ATIME" }, \ ++ { STATX_MTIME, "MTIME" }, \ ++ { STATX_CTIME, "CTIME" }, \ ++ { STATX_INO, "INO" }, \ ++ { STATX_SIZE, "SIZE" }, \ ++ { STATX_BLOCKS, "BLOCKS" }, \ ++ { STATX_BASIC_STATS, "BASIC_STATS" }, \ ++ { STATX_BTIME, "BTIME" }, \ ++ { STATX_MNT_ID, "MNT_ID" }, \ ++ { STATX_DIOALIGN, "DIOALIGN" }, \ ++ { STATX_MNT_ID_UNIQUE, "MNT_ID_UNIQUE" }, \ ++ { STATX_SUBVOL, "SUBVOL" }, \ ++ { STATX_WRITE_ATOMIC, "WRITE_ATOMIC" }, \ ++ { STATX_DIO_READ_ALIGN, "DIO_READ_ALIGN" }) +-- +2.51.0 + diff --git a/queue-6.17/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.17/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..ee25d6234e --- /dev/null +++ b/queue-6.17/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From 53069e4b08ee2b85c4260758b67796de82197f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ce61253efd45b..611e6283c194f 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9442,7 +9442,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.17/null_blk-fix-the-description-of-the-cache_size-modul.patch new file mode 100644 index 0000000000..9834e87b18 --- /dev/null +++ b/queue-6.17/null_blk-fix-the-description-of-the-cache_size-modul.patch @@ -0,0 +1,56 @@ +From 378d772671b798f789b6cd0711d5c02d695c903b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:07:32 +0800 +Subject: null_blk: Fix the description of the cache_size module argument + +From: Genjian Zhang + +[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ] + +When executing modinfo null_blk, there is an error in the description +of module parameter mbps, and the output information of cache_size is +incomplete.The output of modinfo before and after applying this patch +is as follows: + +Before: +[...] +parm: cache_size:ulong +[...] +parm: mbps:Cache size in MiB for memory-backed device. + Default: 0 (none) (uint) +[...] + +After: +[...] +parm: cache_size:Cache size in MiB for memory-backed device. + Default: 0 (none) (ulong) +[...] +parm: mbps:Limit maximum bandwidth (in MiB/s). + Default: 0 (no limit) (uint) +[...] + +Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") +Signed-off-by: Genjian Zhang +Reviewed-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 91642c9a3b293..f982027e8c858 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static bool g_fua = true; + module_param_named(fua, g_fua, bool, 0444); +-- +2.51.0 + diff --git a/queue-6.17/nvme-auth-update-bi_directional-flag.patch b/queue-6.17/nvme-auth-update-bi_directional-flag.patch new file mode 100644 index 0000000000..83621326a1 --- /dev/null +++ b/queue-6.17/nvme-auth-update-bi_directional-flag.patch @@ -0,0 +1,43 @@ +From 98b23e7ccf3daac1bbeb3d295441723575699f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 17:19:21 +0530 +Subject: nvme-auth: update bi_directional flag + +From: Martin George + +[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ] + +While setting chap->s2 to zero as part of secure channel +concatenation, the host missed out to disable the bi_directional +flag to indicate that controller authentication is not requested. +Fix the same. + +Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") +Signed-off-by: Martin George +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index 201fc8809a628..012fcfc79a73b 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl, + } else { + memset(chap->c2, 0, chap->hash_len); + } +- if (ctrl->opts->concat) ++ if (ctrl->opts->concat) { + chap->s2 = 0; +- else ++ chap->bi_directional = false; ++ } else + chap->s2 = nvme_auth_get_seqnum(); + data->seqnum = cpu_to_le32(chap->s2); + if (chap->host_key_len) { +-- +2.51.0 + diff --git a/queue-6.17/nvme-tcp-send-only-permitted-commands-for-secure-con.patch b/queue-6.17/nvme-tcp-send-only-permitted-commands-for-secure-con.patch new file mode 100644 index 0000000000..ac96877ed3 --- /dev/null +++ b/queue-6.17/nvme-tcp-send-only-permitted-commands-for-secure-con.patch @@ -0,0 +1,42 @@ +From 986eda82d56ff8c5673f1f79b76ba0cebf1a9de1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:05:09 +0530 +Subject: nvme-tcp: send only permitted commands for secure concat + +From: Martin George + +[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ] + +In addition to sending permitted commands such as connect/auth +over the initial unencrypted admin connection as part of secure +channel concatenation, the host also sends commands such as +Property Get and Identify on the same. This is a spec violation +leading to secure concat failures. Fix this by ensuring these +additional commands are avoided on this connection. + +Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") +Signed-off-by: Martin George +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index c0fe8cfb7229e..1413788ca7d52 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new) + if (error) + goto out_cleanup_tagset; + ++ if (ctrl->opts->concat && !ctrl->tls_pskid) ++ return 0; ++ + error = nvme_enable_ctrl(ctrl); + if (error) + goto out_stop_queue; +-- +2.51.0 + diff --git a/queue-6.17/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.17/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..433d5b322c --- /dev/null +++ b/queue-6.17/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From bba7f05c0b60df802bcac2dbbe208407ce3ef222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index a9b18c051f5bd..6725c34dd7c90 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-6.17/nvmet-fcloop-call-done-callback-even-when-remote-por.patch b/queue-6.17/nvmet-fcloop-call-done-callback-even-when-remote-por.patch new file mode 100644 index 0000000000..99706df333 --- /dev/null +++ b/queue-6.17/nvmet-fcloop-call-done-callback-even-when-remote-por.patch @@ -0,0 +1,53 @@ +From d8e4e3cfc4a3f7369d2ee2e08456e8e2a463eafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:02 +0200 +Subject: nvmet-fcloop: call done callback even when remote port is gone + +From: Daniel Wagner + +[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ] + +When the target port is gone, it's not possible to access any of the +request resources. The function should just silently drop the response. +The comment is misleading in this regard. + +Though it's still necessary to call the driver via the ->done callback +so the driver is able to release all resources. + +Reported-by: Yi Zhang +Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/ +Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 257b497d515a8..5dffcc5becae8 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport, + if (!targetport) { + /* + * The target port is gone. The target doesn't expect any +- * response anymore and the ->done call is not valid +- * because the resources have been freed by +- * nvmet_fc_free_pending_reqs. ++ * response anymore and thus lsreq can't be accessed anymore. + * + * We end up here from delete association exchange: + * nvmet_fc_xmt_disconnect_assoc sends an async request. ++ * ++ * Return success because this is what LLDDs do; silently ++ * drop the response. + */ ++ lsrsp->done(lsrsp); + kmem_cache_free(lsreq_cache, tls_req); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.17/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..fab269208c --- /dev/null +++ b/queue-6.17/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 8b244d871dac82621ce7c8402b50a78001c2eef6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 0f045e45fa0c3..439742cec3c26 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1011,6 +1011,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-6.17/octeontx2-pf-fix-bitmap-leak.patch b/queue-6.17/octeontx2-pf-fix-bitmap-leak.patch new file mode 100644 index 0000000000..0d7a7a390e --- /dev/null +++ b/queue-6.17/octeontx2-pf-fix-bitmap-leak.patch @@ -0,0 +1,43 @@ +From b35f0619ef2c385321bb618bece85d342bbe2264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 14:12:36 +0800 +Subject: octeontx2-pf: fix bitmap leak + +From: Bo Sun + +[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ] + +The bitmap allocated with bitmap_zalloc() in otx2_probe() was not +released in otx2_remove(). Unbinding and rebinding the driver therefore +triggers a kmemleak warning: + + unreferenced object (size 8): + backtrace: + bitmap_zalloc + otx2_probe + +Call bitmap_free() in the remove path to fix the leak. + +Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") +Signed-off-by: Bo Sun +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 5027fae0aa77a..e808995703cfd 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -3542,6 +3542,7 @@ static void otx2_remove(struct pci_dev *pdev) + otx2_disable_mbox_intr(pf); + otx2_pfaf_mbox_destroy(pf); + pci_free_irq_vectors(pf->pdev); ++ bitmap_free(pf->af_xdp_zc_qidx); + pci_set_drvdata(pdev, NULL); + free_netdev(netdev); + } +-- +2.51.0 + diff --git a/queue-6.17/octeontx2-vf-fix-bitmap-leak.patch b/queue-6.17/octeontx2-vf-fix-bitmap-leak.patch new file mode 100644 index 0000000000..56873c1f5e --- /dev/null +++ b/queue-6.17/octeontx2-vf-fix-bitmap-leak.patch @@ -0,0 +1,43 @@ +From 22aad95f2116c1b4a927751872ab901fbeaabaa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 14:12:35 +0800 +Subject: octeontx2-vf: fix bitmap leak + +From: Bo Sun + +[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ] + +The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not +released in otx2vf_remove(). Unbinding and rebinding the driver therefore +triggers a kmemleak warning: + + unreferenced object (size 8): + backtrace: + bitmap_zalloc + otx2vf_probe + +Call bitmap_free() in the remove path to fix the leak. + +Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") +Signed-off-by: Bo Sun +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 7ebb6e656884a..25381f079b97d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -854,6 +854,7 @@ static void otx2vf_remove(struct pci_dev *pdev) + qmem_free(vf->dev, vf->dync_lmt); + otx2vf_vfaf_mbox_destroy(vf); + pci_free_irq_vectors(vf->pdev); ++ bitmap_free(vf->af_xdp_zc_qidx); + pci_set_drvdata(pdev, NULL); + free_netdev(netdev); + } +-- +2.51.0 + diff --git a/queue-6.17/once-fix-race-by-moving-do_once-to-separate-section.patch b/queue-6.17/once-fix-race-by-moving-do_once-to-separate-section.patch new file mode 100644 index 0000000000..b399049a68 --- /dev/null +++ b/queue-6.17/once-fix-race-by-moving-do_once-to-separate-section.patch @@ -0,0 +1,91 @@ +From a0a69474497dd62a72162e1018ed038d91736230 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 19:29:10 +0800 +Subject: once: fix race by moving DO_ONCE to separate section + +From: Qi Xi + +[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ] + +The commit c2c60ea37e5b ("once: use __section(".data.once")") moved +DO_ONCE's ___done variable to .data.once section, which conflicts with +DO_ONCE_LITE() that also uses the same section. + +This creates a race condition when clear_warn_once is used: + +Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) +__do_once_start + read ___done (false) + acquire once_lock +execute func +__do_once_done + write ___done (true) __do_once_start + release once_lock // Thread 3 clear_warn_once reset ___done + read ___done (false) + acquire once_lock + execute func +schedule once_work __do_once_done +once_deferred: OK write ___done (true) +static_branch_disable release once_lock + schedule once_work + once_deferred: + BUG_ON(!static_key_enabled) + +DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning +macros. Keep its ___done flag in the .data..once section and allow resetting +by clear_warn_once, as originally intended. + +In contrast, DO_ONCE() is used for functions like get_random_once() and +relies on its ___done flag for internal synchronization. We should not reset +DO_ONCE() by clear_warn_once. + +Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, +shielding it from clear_warn_once. + +Fixes: c2c60ea37e5b ("once: use __section(".data.once")") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 1 + + include/linux/once.h | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index ae2d2359b79e9..8efbe8c4874ee 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG) + __start_once = .; \ + *(.data..once) \ + __end_once = .; \ ++ *(.data..do_once) \ + STRUCT_ALIGN(); \ + *(__tracepoints) \ + /* implement dynamic printk debug */ \ +diff --git a/include/linux/once.h b/include/linux/once.h +index 30346fcdc7995..449a0e34ad5ad 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + unsigned long ___flags; \ +@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE_SLEEPABLE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_sleepable_start(&___done); \ +-- +2.51.0 + diff --git a/queue-6.17/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch b/queue-6.17/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch new file mode 100644 index 0000000000..7c8662131f --- /dev/null +++ b/queue-6.17/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch @@ -0,0 +1,52 @@ +From 51ef3d222597cd718daf6ccd425aabe6b97da60a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 14:46:42 -0700 +Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak + +From: Nirmoy Das + +[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ] + +pci_acpi_preserve_config() leaks memory by returning early without freeing +the ACPI object on success. Fix that by always freeing the obj, which is +not needed by the caller. + +Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()") +Signed-off-by: Nirmoy Das +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index ddb25960ea47d..9369377725fa0 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle) + + bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + { ++ bool ret = false; ++ + if (ACPI_HANDLE(&host_bridge->dev)) { + union acpi_object *obj; + +@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge) + 1, DSM_PCI_PRESERVE_BOOT_CONFIG, + NULL, ACPI_TYPE_INTEGER); + if (obj && obj->integer.value == 0) +- return true; ++ ret = true; + ACPI_FREE(obj); + } + +- return false; ++ return ret; + } + + /* _HPX PCI Setting Record (Type 0); same as _HPP */ +-- +2.51.0 + diff --git a/queue-6.17/pci-endpoint-pci-ep-msi-fix-null-vs-is_err-check-in-.patch b/queue-6.17/pci-endpoint-pci-ep-msi-fix-null-vs-is_err-check-in-.patch new file mode 100644 index 0000000000..192193baf3 --- /dev/null +++ b/queue-6.17/pci-endpoint-pci-ep-msi-fix-null-vs-is_err-check-in-.patch @@ -0,0 +1,39 @@ +From e177c711e70dc09121d93d3d5c1a8a564b82ffb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 16:34:45 +0300 +Subject: PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in + pci_epf_write_msi_msg() + +From: Dan Carpenter + +[ Upstream commit 57a75fa9d56e310e883e4377205690e88c05781b ] + +The pci_epc_get() function returns error pointers. It never returns NULL. +Update the check to match. + +Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller") +Signed-off-by: Dan Carpenter +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Frank Li +Link: https://patch.msgid.link/aIzCdV8jyBeql-Oa@stanley.mountain +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/pci-ep-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c +index 9ca89cbfec15d..1b58357b905fa 100644 +--- a/drivers/pci/endpoint/pci-ep-msi.c ++++ b/drivers/pci/endpoint/pci-ep-msi.c +@@ -24,7 +24,7 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg) + struct pci_epf *epf; + + epc = pci_epc_get(dev_name(msi_desc_to_dev(desc))); +- if (!epc) ++ if (IS_ERR(epc)) + return; + + epf = list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list); +-- +2.51.0 + diff --git a/queue-6.17/pci-endpoint-pci-epf-test-fix-doorbell-test-support.patch b/queue-6.17/pci-endpoint-pci-epf-test-fix-doorbell-test-support.patch new file mode 100644 index 0000000000..9049f2511a --- /dev/null +++ b/queue-6.17/pci-endpoint-pci-epf-test-fix-doorbell-test-support.patch @@ -0,0 +1,64 @@ +From 095407991fb2a9cd9d4435c6ae485a5dd117fa7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 18:19:42 +0200 +Subject: PCI: endpoint: pci-epf-test: Fix doorbell test support + +From: Niklas Cassel + +[ Upstream commit f272210b28d050df56ec7dfaecb9fa3bebca6419 ] + +The doorbell feature temporarily overrides the inbound translation to point +to the address stored in epf_test->db_bar.phys_addr, i.e., it calls +set_bar() twice without ever calling clear_bar(), as calling clear_bar() +would clear the BAR's PCI address assigned by the host. + +Thus, when disabling the doorbell, restore the inbound translation to point +to the memory allocated for the BAR. + +Without this, running the PCI endpoint kselftest doorbell test case more +than once would fail. + +Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support") +Signed-off-by: Niklas Cassel +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250908161942.534799-2-cassel@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index e091193bd8a8a..2a85d3eda92f0 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -772,12 +772,24 @@ static void pci_epf_test_disable_doorbell(struct pci_epf_test *epf_test, + u32 status = le32_to_cpu(reg->status); + struct pci_epf *epf = epf_test->epf; + struct pci_epc *epc = epf->epc; ++ int ret; + + if (bar < BAR_0) + goto set_status_err; + + pci_epf_test_doorbell_cleanup(epf_test); +- pci_epc_clear_bar(epc, epf->func_no, epf->vfunc_no, &epf_test->db_bar); ++ ++ /* ++ * The doorbell feature temporarily overrides the inbound translation ++ * to point to the address stored in epf_test->db_bar.phys_addr, i.e., ++ * it calls set_bar() twice without ever calling clear_bar(), as ++ * calling clear_bar() would clear the BAR's PCI address assigned by ++ * the host. Thus, when disabling the doorbell, restore the inbound ++ * translation to point to the memory allocated for the BAR. ++ */ ++ ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, &epf->bar[bar]); ++ if (ret) ++ goto set_status_err; + + status |= STATUS_DOORBELL_DISABLE_SUCCESS; + reg->status = cpu_to_le32(status); +-- +2.51.0 + diff --git a/queue-6.17/pci-fix-pdev_resources_assignable-disparity.patch b/queue-6.17/pci-fix-pdev_resources_assignable-disparity.patch new file mode 100644 index 0000000000..200085d08d --- /dev/null +++ b/queue-6.17/pci-fix-pdev_resources_assignable-disparity.patch @@ -0,0 +1,77 @@ +From 7b731956a833951f1fec3513556612027041f6c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jun 2025 17:26:40 +0300 +Subject: PCI: Fix pdev_resources_assignable() disparity +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ff77c5219747d6b78e8b0ffc4c43d3dd8173d1b2 ] + +pdev_sort_resources() uses pdev_resources_assignable() helper to decide if +device's resources cannot be assigned, so it ignores class 0 +(PCI_CLASS_NOT_DEFINED) devices. pbus_size_mem(), on the other hand, does +not do the same check. This could lead into a situation where a resource +ends up on realloc_head list but is not on the head list, which in turn +prevents emptying the resource from the realloc_head list in +__assign_resources_sorted(). + +A non-empty realloc_head is unacceptable because it triggers an internal +sanity check as shown in this log with a device that has class 0 +(PCI_CLASS_NOT_DEFINED): + + pci 0001:01:00.0: [144d:a5a5] type 00 class 0x000000 PCIe Endpoint + pci 0001:01:00.0: BAR 0 [mem 0x00000000-0x000fffff 64bit] + pci 0001:01:00.0: ROM [mem 0x00000000-0x0000ffff pref] + pcieport 0001:00:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 01-ff] add_size 100000 add_align 100000 + pcieport 0001:00:00.0: bridge window [mem 0x40000000-0x401fffff]: assigned + ------------[ cut here ]------------ + kernel BUG at drivers/pci/setup-bus.c:2532! + Internal error: Oops - BUG: 00000000f2000800 [#1] SMP + ... + Call trace: + pci_assign_unassigned_bus_resources+0x110/0x114 (P) + pci_rescan_bus+0x28/0x48 + +Use pdev_resources_assignable() also within pbus_size_mem() to skip +processing of non-assignable resources which removes the disparity in +between what resources pdev_sort_resources() and pbus_size_mem() consider. +As non-assignable resources are no longer processed, they are not added to +the realloc_head list, thus the sanity check no longer triggers. + +This disparity problem is very old but only now became apparent after +2499f5348431 ("PCI: Rework optional resource handling") that made the ROM +resources optional when calculating bridge window sizes which required +adding the resource to the realloc_head list. Previously, bridge windows +were just sized larger than necessary. + +Fixes: 2499f5348431 ("PCI: Rework optional resource handling") +Reported-by: Tudor Ambarus +Closes: https://lore.kernel.org/all/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org/ +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v6.15+ +Link: https://patch.msgid.link/20250822123359.16305-3-ilpo.jarvinen@linux.intel.com +Stable-dep-of: 8278c6914306 ("PCI: Preserve bridge window resource type flags") +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 7853ac6999e2c..c992707a8ebd6 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -1190,6 +1190,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, + resource_size_t r_size; + + if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) || ++ !pdev_resources_assignable(dev) || + ((r->flags & mask) != type && + (r->flags & mask) != type2 && + (r->flags & mask) != type3)) +-- +2.51.0 + diff --git a/queue-6.17/pci-j721e-fix-incorrect-error-message-in-probe.patch b/queue-6.17/pci-j721e-fix-incorrect-error-message-in-probe.patch new file mode 100644 index 0000000000..693931667b --- /dev/null +++ b/queue-6.17/pci-j721e-fix-incorrect-error-message-in-probe.patch @@ -0,0 +1,42 @@ +From 43242e2c68e7490295b909230c316d30132581db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 14:14:34 -0700 +Subject: PCI: j721e: Fix incorrect error message in probe() + +From: Alok Tiwari + +[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ] + +The probe() function prints "pm_runtime_get_sync failed" when +j721e_pcie_ctrl_init() returns an error. This is misleading since +the failure is not from pm_runtime, but from the controller init +routine. Update the error message to correctly reflect the source. + +No functional changes. + +Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") +Signed-off-by: Alok Tiwari +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Siddharth Vadapalli +Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 6c93f39d02888..5e445a7bda332 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + ret = j721e_pcie_ctrl_init(pcie); + if (ret < 0) { +- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n"); ++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n"); + goto err_get_sync; + } + +-- +2.51.0 + diff --git a/queue-6.17/pci-msi-add-startup-shutdown-for-per-device-domains.patch b/queue-6.17/pci-msi-add-startup-shutdown-for-per-device-domains.patch new file mode 100644 index 0000000000..1f51dc1383 --- /dev/null +++ b/queue-6.17/pci-msi-add-startup-shutdown-for-per-device-domains.patch @@ -0,0 +1,143 @@ +From 38e29c2de0b1135e82a38c0be8033d158395c374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 07:28:32 +0800 +Subject: PCI/MSI: Add startup/shutdown for per device domains + +From: Inochi Amaoto + +[ Upstream commit 54f45a30c0d0153d2be091ba2d683ab6db6d1d5b ] + +As the RISC-V PLIC cannot apply affinity settings without invoking +irq_enable(), it will make the interrupt unavailble when used as an +underlying interrupt chip for the MSI controller. + +Implement the irq_startup() and irq_shutdown() callbacks for the PCI MSI +and MSI-X templates. + +For chips that specify MSI_FLAG_PCI_MSI_STARTUP_PARENT, the parent startup +and shutdown functions are invoked. That allows the interrupt on the parent +chip to be enabled if the interrupt has not been enabled during +allocation. This is necessary for MSI controllers which use PLIC as +underlying parent interrupt chip. + +Suggested-by: Thomas Gleixner +Signed-off-by: Inochi Amaoto +Signed-off-by: Thomas Gleixner +Tested-by: Chen Wang # Pioneerbox +Reviewed-by: Chen Wang +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/all/20250813232835.43458-3-inochiama@gmail.com +Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting") +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/irqdomain.c | 52 +++++++++++++++++++++++++++++++++++++ + include/linux/msi.h | 2 ++ + 2 files changed, 54 insertions(+) + +diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c +index 0938ef7ebabf2..e0a800f918e81 100644 +--- a/drivers/pci/msi/irqdomain.c ++++ b/drivers/pci/msi/irqdomain.c +@@ -148,6 +148,23 @@ static void pci_device_domain_set_desc(msi_alloc_info_t *arg, struct msi_desc *d + arg->hwirq = desc->msi_index; + } + ++static void cond_shutdown_parent(struct irq_data *data) ++{ ++ struct msi_domain_info *info = data->domain->host_data; ++ ++ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT)) ++ irq_chip_shutdown_parent(data); ++} ++ ++static unsigned int cond_startup_parent(struct irq_data *data) ++{ ++ struct msi_domain_info *info = data->domain->host_data; ++ ++ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT)) ++ return irq_chip_startup_parent(data); ++ return 0; ++} ++ + static __always_inline void cond_mask_parent(struct irq_data *data) + { + struct msi_domain_info *info = data->domain->host_data; +@@ -164,6 +181,23 @@ static __always_inline void cond_unmask_parent(struct irq_data *data) + irq_chip_unmask_parent(data); + } + ++static void pci_irq_shutdown_msi(struct irq_data *data) ++{ ++ struct msi_desc *desc = irq_data_get_msi_desc(data); ++ ++ pci_msi_mask(desc, BIT(data->irq - desc->irq)); ++ cond_shutdown_parent(data); ++} ++ ++static unsigned int pci_irq_startup_msi(struct irq_data *data) ++{ ++ struct msi_desc *desc = irq_data_get_msi_desc(data); ++ unsigned int ret = cond_startup_parent(data); ++ ++ pci_msi_unmask(desc, BIT(data->irq - desc->irq)); ++ return ret; ++} ++ + static void pci_irq_mask_msi(struct irq_data *data) + { + struct msi_desc *desc = irq_data_get_msi_desc(data); +@@ -194,6 +228,8 @@ static void pci_irq_unmask_msi(struct irq_data *data) + static const struct msi_domain_template pci_msi_template = { + .chip = { + .name = "PCI-MSI", ++ .irq_startup = pci_irq_startup_msi, ++ .irq_shutdown = pci_irq_shutdown_msi, + .irq_mask = pci_irq_mask_msi, + .irq_unmask = pci_irq_unmask_msi, + .irq_write_msi_msg = pci_msi_domain_write_msg, +@@ -210,6 +246,20 @@ static const struct msi_domain_template pci_msi_template = { + }, + }; + ++static void pci_irq_shutdown_msix(struct irq_data *data) ++{ ++ pci_msix_mask(irq_data_get_msi_desc(data)); ++ cond_shutdown_parent(data); ++} ++ ++static unsigned int pci_irq_startup_msix(struct irq_data *data) ++{ ++ unsigned int ret = cond_startup_parent(data); ++ ++ pci_msix_unmask(irq_data_get_msi_desc(data)); ++ return ret; ++} ++ + static void pci_irq_mask_msix(struct irq_data *data) + { + pci_msix_mask(irq_data_get_msi_desc(data)); +@@ -234,6 +284,8 @@ EXPORT_SYMBOL_GPL(pci_msix_prepare_desc); + static const struct msi_domain_template pci_msix_template = { + .chip = { + .name = "PCI-MSIX", ++ .irq_startup = pci_irq_startup_msix, ++ .irq_shutdown = pci_irq_shutdown_msix, + .irq_mask = pci_irq_mask_msix, + .irq_unmask = pci_irq_unmask_msix, + .irq_write_msi_msg = pci_msi_domain_write_msg, +diff --git a/include/linux/msi.h b/include/linux/msi.h +index e5e86a8529fb6..3111ba95fbde4 100644 +--- a/include/linux/msi.h ++++ b/include/linux/msi.h +@@ -568,6 +568,8 @@ enum { + MSI_FLAG_PARENT_PM_DEV = (1 << 8), + /* Support for parent mask/unmask */ + MSI_FLAG_PCI_MSI_MASK_PARENT = (1 << 9), ++ /* Support for parent startup/shutdown */ ++ MSI_FLAG_PCI_MSI_STARTUP_PARENT = (1 << 10), + + /* Mask for the generic functionality */ + MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0), +-- +2.51.0 + diff --git a/queue-6.17/pci-msi-check-msi_flag_pci_msi_mask_parent-in-cond_-.patch b/queue-6.17/pci-msi-check-msi_flag_pci_msi_mask_parent-in-cond_-.patch new file mode 100644 index 0000000000..a4f2b0c6f0 --- /dev/null +++ b/queue-6.17/pci-msi-check-msi_flag_pci_msi_mask_parent-in-cond_-.patch @@ -0,0 +1,66 @@ +From e3efaf339ff73175d5e1d5a314993b0c244b02fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 07:09:42 +0800 +Subject: PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in + cond_[startup|shutdown]_parent() + +From: Inochi Amaoto + +[ Upstream commit 727e914bbfbbda9e6efa5cb1abe4e96a949d576f ] + +For MSI controllers which only support MSI_FLAG_PCI_MSI_MASK_PARENT, the +newly added callback irq_startup() and irq_shutdown() for +pci_msi[x]_template will not unmask or mask the interrupt when startup() +resp. shutdown() is invoked. This prevents the interrupt from being +enabled resp. disabled. + +Invoke irq_[un]mask_parent() in cond_[startup|shutdown]_parent(), when the +interrupt has the MSI_FLAG_PCI_MSI_MASK_PARENT flag set. + +Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") +Reported-by: Linux Kernel Functional Testing +Reported-by: Nathan Chancellor +Reported-by: Wei Fang +Signed-off-by: Inochi Amaoto +Signed-off-by: Thomas Gleixner +Tested-by: Nathan Chancellor +Tested-by: Linux Kernel Functional Testing +Tested-by: Jon Hunter +Tested-by: Wei Fang +Tested-by: Chen Wang # Pioneerbox/SG2042 +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/all/20250827230943.17829-1-inochiama@gmail.com +Closes: https://lore.kernel.org/regressions/aK4O7Hl8NCVEMznB@monster/ +Closes: https://lore.kernel.org/regressions/20250826220959.GA4119563@ax162/ +Closes: https://lore.kernel.org/all/20250827093911.1218640-1-wei.fang@nxp.com/ +Signed-off-by: Sasha Levin +--- + drivers/pci/msi/irqdomain.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c +index e0a800f918e81..b11b7f63f0d6f 100644 +--- a/drivers/pci/msi/irqdomain.c ++++ b/drivers/pci/msi/irqdomain.c +@@ -154,6 +154,8 @@ static void cond_shutdown_parent(struct irq_data *data) + + if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT)) + irq_chip_shutdown_parent(data); ++ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT)) ++ irq_chip_mask_parent(data); + } + + static unsigned int cond_startup_parent(struct irq_data *data) +@@ -162,6 +164,9 @@ static unsigned int cond_startup_parent(struct irq_data *data) + + if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT)) + return irq_chip_startup_parent(data); ++ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT)) ++ irq_chip_unmask_parent(data); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/pci-preserve-bridge-window-resource-type-flags.patch b/queue-6.17/pci-preserve-bridge-window-resource-type-flags.patch new file mode 100644 index 0000000000..f63e9a5ba7 --- /dev/null +++ b/queue-6.17/pci-preserve-bridge-window-resource-type-flags.patch @@ -0,0 +1,404 @@ +From b871817e3ba3e462dbc10491a2786cd3fb9dc064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:10:59 +0300 +Subject: PCI: Preserve bridge window resource type flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 8278c6914306f35f32d73bdf2a918950919a0051 ] + +When a bridge window is found unused or fails to assign, the flags of the +associated resource are cleared. Clearing flags is problematic as it also +removes the type information of the resource which is needed later. + +Thus, always preserve the bridge window type flags and use IORESOURCE_UNSET +and IORESOURCE_DISABLED to indicate the status of the bridge window. Also, +when initializing resources, make sure all valid bridge windows do get +their type flags set. + +Change various places that relied on resource flags being cleared to check +for IORESOURCE_UNSET and IORESOURCE_DISABLED to allow bridge window +resource to retain their type flags. Add pdev_resource_assignable() and +pdev_resource_should_fit() helpers to filter out disabled bridge windows +during resource fitting; the latter combines more common checks into the +helper. + +When reading the bridge windows from the registers, instead of leaving the +resource flags cleared for bridge windows that are not enabled, always +set up the flags and set IORESOURCE_UNSET | IORESOURCE_DISABLED as needed. + +When resource fitting or assignment fails for a bridge window resource, or +the bridge window is not needed, mark the resource with IORESOURCE_UNSET or +IORESOURCE_DISABLED, respectively. + +Use dummy zero resource in resource_show() for backwards compatibility as +lspci will otherwise misrepresent disabled bridge windows. + +This change fixes an issue which highlights the importance of keeping the +resource type flags intact: + + At the end of __assign_resources_sorted(), reset_resource() is called, + previously clearing the flags. Later, pci_prepare_next_assign_round() + attempted to release bridge resources using + pci_bus_release_bridge_resources() that calls into + pci_bridge_release_resources() that assumes type flags are still present. + As type flags were cleared, IORESOURCE_MEM_64 was not set leading to + resources under an incorrect bridge window to be released (idx = 1 + instead of idx = 2). While the assignments performed later covered this + problem so that the wrongly released resources got assigned in the end, + it was still causing extra release+assign pairs. + +There are other reasons why the resource flags should be retained in +upcoming changes too. + +Removing the flag reset for non-bridge window resource is left as future +work, in part because it has a much higher regression potential due to +pci_enable_resources() that will start to work also for those resources +then and due to what endpoint drivers might assume about resources. + +Despite the Fixes tag, backporting this (at least any time soon) is highly +discouraged. The issue fixed is borderline cosmetic as the later +assignments normally cover the problem entirely. Also there might be +non-obvious dependencies. + +Fixes: 5b28541552ef ("PCI: Restrict 64-bit prefetchable bridge windows to 64-bit resources") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250829131113.36754-11-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/pci/bus.c | 3 ++ + drivers/pci/pci-sysfs.c | 7 ++++ + drivers/pci/probe.c | 25 +++++++++--- + drivers/pci/setup-bus.c | 89 +++++++++++++++++++++++++++-------------- + drivers/pci/setup-res.c | 3 ++ + 5 files changed, 90 insertions(+), 37 deletions(-) + +diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c +index b77fd30bbfd9d..58b5388423ee3 100644 +--- a/drivers/pci/bus.c ++++ b/drivers/pci/bus.c +@@ -204,6 +204,9 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, + if (!r) + continue; + ++ if (r->flags & (IORESOURCE_UNSET|IORESOURCE_DISABLED)) ++ continue; ++ + /* type_mask must match */ + if ((res->flags ^ r->flags) & type_mask) + continue; +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 5eea14c1f7f5f..162a5241c7f70 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -177,6 +177,13 @@ static ssize_t resource_show(struct device *dev, struct device_attribute *attr, + + for (i = 0; i < max; i++) { + struct resource *res = &pci_dev->resource[i]; ++ struct resource zerores = {}; ++ ++ /* For backwards compatibility */ ++ if (i >= PCI_BRIDGE_RESOURCES && i <= PCI_BRIDGE_RESOURCE_END && ++ res->flags & (IORESOURCE_UNSET | IORESOURCE_DISABLED)) ++ res = &zerores; ++ + pci_resource_to_user(pci_dev, i, res, &start, &end); + len += sysfs_emit_at(buf, len, "0x%016llx 0x%016llx 0x%016llx\n", + (unsigned long long)start, +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index f41128f91ca76..f31d27c7708a6 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -419,13 +419,17 @@ static void pci_read_bridge_io(struct pci_dev *dev, struct resource *res, + limit |= ((unsigned long) io_limit_hi << 16); + } + ++ res->flags = (io_base_lo & PCI_IO_RANGE_TYPE_MASK) | IORESOURCE_IO; ++ + if (base <= limit) { +- res->flags = (io_base_lo & PCI_IO_RANGE_TYPE_MASK) | IORESOURCE_IO; + region.start = base; + region.end = limit + io_granularity - 1; + pcibios_bus_to_resource(dev->bus, res, ®ion); + if (log) + pci_info(dev, " bridge window %pR\n", res); ++ } else { ++ resource_set_range(res, 0, 0); ++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED; + } + } + +@@ -440,13 +444,18 @@ static void pci_read_bridge_mmio(struct pci_dev *dev, struct resource *res, + pci_read_config_word(dev, PCI_MEMORY_LIMIT, &mem_limit_lo); + base = ((unsigned long) mem_base_lo & PCI_MEMORY_RANGE_MASK) << 16; + limit = ((unsigned long) mem_limit_lo & PCI_MEMORY_RANGE_MASK) << 16; ++ ++ res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM; ++ + if (base <= limit) { +- res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM; + region.start = base; + region.end = limit + 0xfffff; + pcibios_bus_to_resource(dev->bus, res, ®ion); + if (log) + pci_info(dev, " bridge window %pR\n", res); ++ } else { ++ resource_set_range(res, 0, 0); ++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED; + } + } + +@@ -489,16 +498,20 @@ static void pci_read_bridge_mmio_pref(struct pci_dev *dev, struct resource *res, + return; + } + ++ res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) | IORESOURCE_MEM | ++ IORESOURCE_PREFETCH; ++ if (res->flags & PCI_PREF_RANGE_TYPE_64) ++ res->flags |= IORESOURCE_MEM_64; ++ + if (base <= limit) { +- res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) | +- IORESOURCE_MEM | IORESOURCE_PREFETCH; +- if (res->flags & PCI_PREF_RANGE_TYPE_64) +- res->flags |= IORESOURCE_MEM_64; + region.start = base; + region.end = limit + 0xfffff; + pcibios_bus_to_resource(dev->bus, res, ®ion); + if (log) + pci_info(dev, " bridge window %pR\n", res); ++ } else { ++ resource_set_range(res, 0, 0); ++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED; + } + } + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 203c8ebef7029..8078ee30e675f 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -154,6 +154,31 @@ static bool pdev_resources_assignable(struct pci_dev *dev) + return true; + } + ++static bool pdev_resource_assignable(struct pci_dev *dev, struct resource *res) ++{ ++ int idx = pci_resource_num(dev, res); ++ ++ if (!res->flags) ++ return false; ++ ++ if (idx >= PCI_BRIDGE_RESOURCES && idx <= PCI_BRIDGE_RESOURCE_END && ++ res->flags & IORESOURCE_DISABLED) ++ return false; ++ ++ return true; ++} ++ ++static bool pdev_resource_should_fit(struct pci_dev *dev, struct resource *res) ++{ ++ if (res->parent) ++ return false; ++ ++ if (res->flags & IORESOURCE_PCI_FIXED) ++ return false; ++ ++ return pdev_resource_assignable(dev, res); ++} ++ + /* Sort resources by alignment */ + static void pdev_sort_resources(struct pci_dev *dev, struct list_head *head) + { +@@ -169,10 +194,7 @@ static void pdev_sort_resources(struct pci_dev *dev, struct list_head *head) + resource_size_t r_align; + struct list_head *n; + +- if (r->flags & IORESOURCE_PCI_FIXED) +- continue; +- +- if (!(r->flags) || r->parent) ++ if (!pdev_resource_should_fit(dev, r)) + continue; + + r_align = pci_resource_alignment(dev, r); +@@ -221,8 +243,15 @@ bool pci_resource_is_optional(const struct pci_dev *dev, int resno) + return false; + } + +-static inline void reset_resource(struct resource *res) ++static inline void reset_resource(struct pci_dev *dev, struct resource *res) + { ++ int idx = pci_resource_num(dev, res); ++ ++ if (idx >= PCI_BRIDGE_RESOURCES && idx <= PCI_BRIDGE_RESOURCE_END) { ++ res->flags |= IORESOURCE_UNSET; ++ return; ++ } ++ + res->start = 0; + res->end = 0; + res->flags = 0; +@@ -568,7 +597,7 @@ static void __assign_resources_sorted(struct list_head *head, + 0 /* don't care */); + } + +- reset_resource(res); ++ reset_resource(dev, res); + } + + free_list(head); +@@ -997,8 +1026,11 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, + + if (r->parent || !(r->flags & IORESOURCE_IO)) + continue; +- r_size = resource_size(r); + ++ if (!pdev_resource_assignable(dev, r)) ++ continue; ++ ++ r_size = resource_size(r); + if (r_size < SZ_1K) + /* Might be re-aligned for ISA */ + size += r_size; +@@ -1017,6 +1049,9 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, + size0 = calculate_iosize(size, min_size, size1, 0, 0, + resource_size(b_res), min_align); + ++ if (size0) ++ b_res->flags &= ~IORESOURCE_DISABLED; ++ + size1 = size0; + if (realloc_head && (add_size > 0 || children_add_size > 0)) { + size1 = calculate_iosize(size, min_size, size1, add_size, +@@ -1028,13 +1063,14 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, + if (bus->self && (b_res->start || b_res->end)) + pci_info(bus->self, "disabling bridge window %pR to %pR (unused)\n", + b_res, &bus->busn_res); +- b_res->flags = 0; ++ b_res->flags |= IORESOURCE_DISABLED; + return; + } + + resource_set_range(b_res, min_align, size0); + b_res->flags |= IORESOURCE_STARTALIGN; + if (bus->self && size1 > size0 && realloc_head) { ++ b_res->flags &= ~IORESOURCE_DISABLED; + add_to_list(realloc_head, bus->self, b_res, size1-size0, + min_align); + pci_info(bus->self, "bridge window %pR to %pR add_size %llx\n", +@@ -1180,11 +1216,13 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, + const char *r_name = pci_resource_name(dev, i); + resource_size_t r_size; + +- if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) || +- !pdev_resources_assignable(dev) || +- ((r->flags & mask) != type && +- (r->flags & mask) != type2 && +- (r->flags & mask) != type3)) ++ if (!pdev_resources_assignable(dev) || ++ !pdev_resource_should_fit(dev, r)) ++ continue; ++ ++ if ((r->flags & mask) != type && ++ (r->flags & mask) != type2 && ++ (r->flags & mask) != type3) + continue; + r_size = resource_size(r); + +@@ -1235,6 +1273,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, + min_align = max(min_align, win_align); + size0 = calculate_memsize(size, min_size, 0, 0, resource_size(b_res), min_align); + ++ if (size0) ++ b_res->flags &= ~IORESOURCE_DISABLED; ++ + if (bus->self && size0 && + !pbus_upstream_space_available(bus, mask | IORESOURCE_PREFETCH, type, + size0, min_align)) { +@@ -1267,13 +1308,14 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, + if (bus->self && (b_res->start || b_res->end)) + pci_info(bus->self, "disabling bridge window %pR to %pR (unused)\n", + b_res, &bus->busn_res); +- b_res->flags = 0; ++ b_res->flags |= IORESOURCE_DISABLED; + return 0; + } + + resource_set_range(b_res, min_align, size0); + b_res->flags |= IORESOURCE_STARTALIGN; + if (bus->self && size1 > size0 && realloc_head) { ++ b_res->flags &= ~IORESOURCE_DISABLED; + add_to_list(realloc_head, bus->self, b_res, size1-size0, add_align); + pci_info(bus->self, "bridge window %pR to %pR add_size %llx add_align %llx\n", + b_res, &bus->busn_res, +@@ -1705,7 +1747,6 @@ static void pci_bridge_release_resources(struct pci_bus *bus, + { + struct pci_dev *dev = bus->self; + struct resource *r; +- unsigned int old_flags; + struct resource *b_res; + int idx, ret; + +@@ -1742,17 +1783,15 @@ static void pci_bridge_release_resources(struct pci_bus *bus, + /* If there are children, release them all */ + release_child_resources(r); + +- type = old_flags = r->flags & PCI_RES_TYPE_MASK; + ret = pci_release_resource(dev, PCI_BRIDGE_RESOURCES + idx); + if (ret) + return; + ++ type = r->flags & PCI_RES_TYPE_MASK; + /* Avoiding touch the one without PREF */ + if (type & IORESOURCE_PREFETCH) + type = IORESOURCE_PREFETCH; + __pci_setup_bridge(bus, type); +- /* For next child res under same bridge */ +- r->flags = old_flags; + } + + enum release_type { +@@ -2230,21 +2269,9 @@ static void pci_prepare_next_assign_round(struct list_head *fail_head, + } + + /* Restore size and flags */ +- list_for_each_entry(fail_res, fail_head, list) { +- struct resource *res = fail_res->res; +- struct pci_dev *dev = fail_res->dev; +- int idx = pci_resource_num(dev, res); +- ++ list_for_each_entry(fail_res, fail_head, list) + restore_dev_resource(fail_res); + +- if (!pci_is_bridge(dev)) +- continue; +- +- if (idx >= PCI_BRIDGE_RESOURCES && +- idx <= PCI_BRIDGE_RESOURCE_END) +- res->flags = 0; +- } +- + free_list(fail_head); + } + +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index 0468c058b5987..c5ef8ef54d3ce 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -359,6 +359,9 @@ int pci_assign_resource(struct pci_dev *dev, int resno) + + res->flags &= ~IORESOURCE_UNSET; + res->flags &= ~IORESOURCE_STARTALIGN; ++ if (resno >= PCI_BRIDGE_RESOURCES && resno <= PCI_BRIDGE_RESOURCE_END) ++ res->flags &= ~IORESOURCE_DISABLED; ++ + pci_info(dev, "%s %pR: assigned\n", res_name, res); + if (resno < PCI_BRIDGE_RESOURCES) + pci_update_resource(dev, resno); +-- +2.51.0 + diff --git a/queue-6.17/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch b/queue-6.17/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch new file mode 100644 index 0000000000..be525755b8 --- /dev/null +++ b/queue-6.17/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch @@ -0,0 +1,66 @@ +From 3de6f4762747d006cbbb89125636bac42e05a84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 17:56:25 +0200 +Subject: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure + +From: Geert Uytterhoeven + +[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ] + +When devm_add_action_or_reset() fails, it calls the passed cleanup +function. Hence the caller must not repeat that cleanup. + +Replace the "goto err_regulator_free" by the actual freeing, as there +will never be a need again for a second user of this label. + +Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Tested-by: Marek Vasut # V4H Sparrow Hawk +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Marek Vasut +Acked-by: Bartosz Golaszewski +Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pci/pwrctrl/slot.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c +index 6e138310b45b9..3320494b62d89 100644 +--- a/drivers/pci/pwrctrl/slot.c ++++ b/drivers/pci/pwrctrl/slot.c +@@ -49,13 +49,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev) + ret = regulator_bulk_enable(slot->num_supplies, slot->supplies); + if (ret < 0) { + dev_err_probe(dev, ret, "Failed to enable slot regulators\n"); +- goto err_regulator_free; ++ regulator_bulk_free(slot->num_supplies, slot->supplies); ++ return ret; + } + + ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off, + slot); + if (ret) +- goto err_regulator_disable; ++ return ret; + + clk = devm_clk_get_optional_enabled(dev, NULL); + if (IS_ERR(clk)) { +@@ -70,13 +71,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev) + return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n"); + + return 0; +- +-err_regulator_disable: +- regulator_bulk_disable(slot->num_supplies, slot->supplies); +-err_regulator_free: +- regulator_bulk_free(slot->num_supplies, slot->supplies); +- +- return ret; + } + + static const struct of_device_id pci_pwrctrl_slot_of_match[] = { +-- +2.51.0 + diff --git a/queue-6.17/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch b/queue-6.17/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch new file mode 100644 index 0000000000..d09612fc9f --- /dev/null +++ b/queue-6.17/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch @@ -0,0 +1,183 @@ +From 536d608b339eda9affa78e78d5d244bc19d9a82a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 14:52:23 +0800 +Subject: PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s + +From: Ziyue Zhang + +[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ] + +Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link +stability and avoid AER Correctable Errors reported on some platforms +(eg. SA8775P). + +8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting. +This setting is programmed into a group of shadow registers, which can be +switched to configure equalization for different speeds by writing 00b, +01b and 10b to `RATE_SHADOW_SEL`. + +Hence, program equalization registers in a loop using link speed as index, +so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s +and 32.0 GT/s. + +Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes") +Co-developed-by: Qiang Yu +Signed-off-by: Qiang Yu +Signed-off-by: Ziyue Zhang +[mani: wrapped the warning to fit 100 columns, used post-increment for loop] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware.h | 1 - + drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++-------- + drivers/pci/controller/dwc/pcie-qcom-common.h | 2 +- + drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +- + drivers/pci/controller/dwc/pcie-qcom.c | 6 +- + 5 files changed, 41 insertions(+), 32 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h +index 00f52d472dcdd..cc71a2d90cd48 100644 +--- a/drivers/pci/controller/dwc/pcie-designware.h ++++ b/drivers/pci/controller/dwc/pcie-designware.h +@@ -123,7 +123,6 @@ + #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE BIT(16) + #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT 24 + #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK GENMASK(25, 24) +-#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT 0x1 + + #define GEN3_EQ_CONTROL_OFF 0x8A8 + #define GEN3_EQ_CONTROL_OFF_FB_MODE GENMASK(3, 0) +diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c +index 3aad19b56da8f..0c6f4514f922f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-common.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-common.c +@@ -8,9 +8,11 @@ + #include "pcie-designware.h" + #include "pcie-qcom-common.h" + +-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci) ++void qcom_pcie_common_set_equalization(struct dw_pcie *pci) + { ++ struct device *dev = pci->dev; + u32 reg; ++ u16 speed; + + /* + * GEN3_RELATED_OFF register is repurposed to apply equalization +@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci) + * determines the data rate for which these equalization settings are + * applied. + */ +- reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF); +- reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL; +- reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK; +- reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK, +- GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT); +- dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg); + +- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF); +- reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 | +- GEN3_EQ_FMDC_N_EVALS | +- GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA | +- GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA); +- reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) | +- FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) | +- FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) | +- FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5); +- dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg); ++ for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) { ++ if (speed > PCIE_SPEED_32_0GT) { ++ dev_warn(dev, "Skipped equalization settings for unsupported data rate\n"); ++ break; ++ } + +- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF); +- reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE | +- GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE | +- GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL | +- GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC); +- dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg); ++ reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF); ++ reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL; ++ reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK; ++ reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK, ++ speed - PCIE_SPEED_8_0GT); ++ dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg); ++ ++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF); ++ reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 | ++ GEN3_EQ_FMDC_N_EVALS | ++ GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA | ++ GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA); ++ reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) | ++ FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) | ++ FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) | ++ FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5); ++ dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg); ++ ++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF); ++ reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE | ++ GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE | ++ GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL | ++ GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC); ++ dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg); ++ } + } +-EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization); ++EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization); + + void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci) + { +diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h +index 7d88d29e47661..7f5ca2fd9a72f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-common.h ++++ b/drivers/pci/controller/dwc/pcie-qcom-common.h +@@ -8,7 +8,7 @@ + + struct dw_pcie; + +-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci); ++void qcom_pcie_common_set_equalization(struct dw_pcie *pci); + void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci); + + #endif +diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c +index bf7c6ac0f3e39..aaf060bf39d40 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c +@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci) + goto err_disable_resources; + } + +- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) { +- qcom_pcie_common_set_16gt_equalization(pci); ++ qcom_pcie_common_set_equalization(pci); ++ ++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) + qcom_pcie_common_set_16gt_lane_margining(pci); +- } + + /* + * The physical address of the MMIO region which is exposed as the BAR +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index fbed7130d7475..a93740ae602f2 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -322,10 +322,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci) + { + struct qcom_pcie *pcie = to_qcom_pcie(pci); + +- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) { +- qcom_pcie_common_set_16gt_equalization(pci); ++ qcom_pcie_common_set_equalization(pci); ++ ++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) + qcom_pcie_common_set_16gt_lane_margining(pci); +- } + + /* Enable Link Training state machine */ + if (pcie->cfg->ops->ltssm_enable) +-- +2.51.0 + diff --git a/queue-6.17/pci-qcom-restrict-port-parsing-only-to-pcie-bridge-c.patch b/queue-6.17/pci-qcom-restrict-port-parsing-only-to-pcie-bridge-c.patch new file mode 100644 index 0000000000..4f13b9e45b --- /dev/null +++ b/queue-6.17/pci-qcom-restrict-port-parsing-only-to-pcie-bridge-c.patch @@ -0,0 +1,47 @@ +From 3fc2ab9af40ee834182fae6144a4fd1ce2d50637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:32:55 +0530 +Subject: PCI: qcom: Restrict port parsing only to PCIe bridge child nodes + +From: Krishna Chaitanya Chundru + +[ Upstream commit 45df22935bdc6bbddf87f38a57ae7257244cf3cf ] + +The qcom_pcie_parse_ports() function currently iterates over all available +child nodes of the PCIe controller's device tree node. This includes +unrelated nodes such as OPP (Operating Performance Points) nodes, which do +not contain the expected 'reset' and 'phy' properties. As a result, parsing +fails and the driver falls back to the legacy method of parsing the +controller node directly. However, this fallback also fails when properties +are shifted to the Root Port node, leading to probe failure. + +Fix this by restricting the parsing logic to only consider child nodes with +device_type = "pci", which is the expected and required property for PCIe +bridge nodes as per the pci-bus-common.yaml dtschema. + +Fixes: a2fbecdbbb9d ("PCI: qcom: Add support for parsing the new Root Port binding") +Signed-off-by: Krishna Chaitanya Chundru +[mani: reworded subject and description] +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20250826-pakala-v3-3-721627bd5bb0@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 294babe1816e4..fbed7130d7475 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -1740,6 +1740,8 @@ static int qcom_pcie_parse_ports(struct qcom_pcie *pcie) + int ret = -ENOENT; + + for_each_available_child_of_node_scoped(dev->of_node, of_port) { ++ if (!of_node_is_type(of_port, "pci")) ++ continue; + ret = qcom_pcie_parse_port(pcie, of_port); + if (ret) + goto err_port_del; +-- +2.51.0 + diff --git a/queue-6.17/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch b/queue-6.17/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch new file mode 100644 index 0000000000..54673b0a9b --- /dev/null +++ b/queue-6.17/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch @@ -0,0 +1,65 @@ +From 4832cd2264b1bab60f0d074b036900d39bae1b65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 15:45:58 +0200 +Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585 +Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC +domain, after reset has been asserted by writing a matching reset bit into +register SRCR, it is mandatory to wait 1ms. + +Because it is the controller driver which can determine whether or not the +controller is in HSC domain based on its compatible string, add the missing +delay in the controller driver. + +This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear +whether S4 is affected as well. This patch does apply the extra delay on +R-Car S4 as well. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Suggested-by: Geert Uytterhoeven +Signed-off-by: Marek Vasut +[mani: added the missing r-b tag from Krzysztof] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Krzysztof Wilczyński +Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 18055807a4f5f..d9a42fa51520a 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + return ret; + } + +- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) ++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) { + reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ /* ++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. ++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B) ++ * indicates that for peripherals in HSC domain, after ++ * reset has been asserted by writing a matching reset bit ++ * into register SRCR, it is mandatory to wait 1ms. ++ */ ++ fsleep(1000); ++ } + + val = readl(rcar->base + PCIEMSR0); + if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) { +-- +2.51.0 + diff --git a/queue-6.17/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch b/queue-6.17/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch new file mode 100644 index 0000000000..f98b80801f --- /dev/null +++ b/queue-6.17/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch @@ -0,0 +1,56 @@ +From 6627fc2c55b47e1049b4ba3ca4e639f52c55c62f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 02:55:45 +0200 +Subject: PCI: rcar-gen4: Assure reset occurs before DBI access + +From: Marek Vasut + +[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ] + +Assure the reset is latched and the core is ready for DBI access. On R-Car +V4H, the PCIe reset is asynchronous and does not take effect immediately, +but needs a short time to complete. In case DBI access happens in that +short time, that access generates an SError. Make sure that condition can +never happen, read back the state of the reset, which should turn the +asynchronous reset into a synchronous one, and wait a little over 1ms to +add additional safety margin. + +Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index d9a42fa51520a..9ac3f0f11adad 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar) + if (ret) + goto err_unprepare; + ++ /* ++ * Assure the reset is latched and the core is ready for DBI access. ++ * On R-Car V4H, the PCIe reset is asynchronous and does not take ++ * effect immediately, but needs a short time to complete. In case ++ * DBI access happens in that short time, that access generates an ++ * SError. To make sure that condition can never happen, read back the ++ * state of the reset, which should turn the asynchronous reset into ++ * synchronous one, and wait a little over 1ms to add additional ++ * safety margin. ++ */ ++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc); ++ fsleep(1000); ++ + if (rcar->drvdata->additional_common_init) + rcar->drvdata->additional_common_init(rcar); + +-- +2.51.0 + diff --git a/queue-6.17/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch b/queue-6.17/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch new file mode 100644 index 0000000000..edd753a126 --- /dev/null +++ b/queue-6.17/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch @@ -0,0 +1,54 @@ +From 5fbde2a082a2300db38e170175cad2147f41ccc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 01:58:40 +0200 +Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization + +From: Marek Vasut + +[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ] + +R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 +Figure 104.3b Initial Setting of PCIEC(example), third quarter of the +figure indicates that register 0xf8 should be polled until bit 18 becomes +set to 1. + +Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is +set to 1 in less than 1 ms afterward. The current readl_poll_timeout() +break condition is inverted and returns when register 0xf8, bit 18 is set +to 0, which in most cases means immediately. In case +CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first +readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and +afterward never read register 0xf8, bit 18 as 0, which leads to timeout +and failure to start the PCIe controller. + +Fix this by inverting the poll condition to match the reference manual +initialization sequence. + +Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") +Signed-off-by: Marek Vasut +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +index 9ac3f0f11adad..c16c4c2be4993 100644 +--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c ++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c +@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable + val &= ~APP_HOLD_PHY_RST; + writel(val, rcar->base + PCIERSTCTRL1); + +- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000); ++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000); + if (ret < 0) + return ret; + +-- +2.51.0 + diff --git a/queue-6.17/pci-rcar-host-pass-proper-irq-domain-to-generic_hand.patch b/queue-6.17/pci-rcar-host-pass-proper-irq-domain-to-generic_hand.patch new file mode 100644 index 0000000000..6fc6344910 --- /dev/null +++ b/queue-6.17/pci-rcar-host-pass-proper-irq-domain-to-generic_hand.patch @@ -0,0 +1,56 @@ +From 8c4323ad821256c6f8d4b2878265168ab2568e79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Aug 2025 17:44:47 +0300 +Subject: PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() + +From: Claudiu Beznea + +[ Upstream commit d3fee10e40a938331e2aae34348691136db31304 ] + +Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to +msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because +the object of type struct irq_domain_info passed to: + +msi_create_parent_irq_domain() -> + irq_domain_instantiate()() -> + __irq_domain_instantiate() + +has no reference to the parent IRQ domain. Using msi->domain->parent as an +argument for generic_handle_domain_irq() leads to below error: + + "Unable to handle kernel NULL pointer dereference at virtual address" + +This error was identified while switching the upcoming RZ/G3S PCIe host +controller driver to msi_create_parent_irq_domain() (which was using a +similar pattern to handle MSIs (see link section)), but it was not tested +on hardware using the pcie-rcar-host controller driver due to lack of +hardware. + +Fixes: dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()") +Signed-off-by: Claudiu Beznea +[mani: reworded subject and description] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Nam Cao +Link: https://lore.kernel.org/all/20250704161410.3931884-6-claudiu.beznea.uj@bp.renesas.com +Link: https://patch.msgid.link/20250809144447.3939284-1-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-host.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c +index fe288fd770c49..4780e0109e583 100644 +--- a/drivers/pci/controller/pcie-rcar-host.c ++++ b/drivers/pci/controller/pcie-rcar-host.c +@@ -584,7 +584,7 @@ static irqreturn_t rcar_pcie_msi_irq(int irq, void *data) + unsigned int index = find_first_bit(®, 32); + int ret; + +- ret = generic_handle_domain_irq(msi->domain->parent, index); ++ ret = generic_handle_domain_irq(msi->domain, index); + if (ret) { + /* Unknown MSI, just clear it */ + dev_dbg(dev, "unexpected MSI\n"); +-- +2.51.0 + diff --git a/queue-6.17/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.17/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..599dbaaa03 --- /dev/null +++ b/queue-6.17/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 1a9024d125e0bb4e0802ffdf658abcd5c8dd22e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 467ddc701adce..bb88767a37979 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.17/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.17/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch new file mode 100644 index 0000000000..1ae2e28bc5 --- /dev/null +++ b/queue-6.17/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch @@ -0,0 +1,53 @@ +From 687d6315a9ba570d7bb598f4e339b356fad574a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 11:30:22 +0200 +Subject: PCI: tegra194: Fix duplicate PLL disable in + pex_ep_event_pex_rst_assert() + +From: Nagarjuna Kristam + +[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ] + +During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently +called twice. + +pex_ep_event_pex_rst_assert() should do the opposite of +pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate +tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate +tegra_pcie_bpmp_set_pll_state() call should instead be a call to +tegra_pcie_bpmp_set_ctrl_state(). + +With this, the uninitialization sequence also matches that of +tegra_pcie_unconfig_controller(). + +Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") +Signed-off-by: Nagarjuna Kristam +[cassel: improve commit log] +Signed-off-by: Niklas Cassel +Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 4f26086f25daf..0c0734aa14b68 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +-- +2.51.0 + diff --git a/queue-6.17/pci-use-pci_release_resource-instead-of-release_reso.patch b/queue-6.17/pci-use-pci_release_resource-instead-of-release_reso.patch new file mode 100644 index 0000000000..8330c327c2 --- /dev/null +++ b/queue-6.17/pci-use-pci_release_resource-instead-of-release_reso.patch @@ -0,0 +1,178 @@ +From a5c01cacc40950fb11cd299334cfbaf0542be443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:10:57 +0300 +Subject: PCI: Use pci_release_resource() instead of release_resource() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 3baeae36039afc233d4a42d6ff4aa7019892619f ] + +A few places in setup-bus.c call release_resource() directly and end up +duplicating functionality from pci_release_resource() such as parent check, +logging, and clearing the resource. Worse yet, the way the resource is +cleared is inconsistent between different sites. + +Convert release_resource() calls into pci_release_resource() to remove code +duplication. This will also make the resource start, end, and flags +behavior consistent, i.e., start address is cleared, and only +IORESOURCE_UNSET is asserted for the resource. + +While at it, eliminate the unnecessary initialization of idx variable in +pci_bridge_release_resources(). + +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250829131113.36754-9-ilpo.jarvinen@linux.intel.com +Stable-dep-of: 8278c6914306 ("PCI: Preserve bridge window resource type flags") +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 46 +++++++++++++---------------------------- + drivers/pci/setup-res.c | 11 +++++++--- + include/linux/pci.h | 2 +- + 3 files changed, 23 insertions(+), 36 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index c992707a8ebd6..203c8ebef7029 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -431,8 +431,6 @@ static void __assign_resources_sorted(struct list_head *head, + struct pci_dev_resource *dev_res, *tmp_res, *dev_res2; + struct resource *res; + struct pci_dev *dev; +- const char *res_name; +- int idx; + unsigned long fail_type; + resource_size_t add_align, align; + +@@ -540,14 +538,7 @@ static void __assign_resources_sorted(struct list_head *head, + res = dev_res->res; + dev = dev_res->dev; + +- if (!res->parent) +- continue; +- +- idx = pci_resource_num(dev, res); +- res_name = pci_resource_name(dev, idx); +- pci_dbg(dev, "%s %pR: releasing\n", res_name, res); +- +- release_resource(res); ++ pci_release_resource(dev, pci_resource_num(dev, res)); + restore_dev_resource(dev_res); + } + /* Restore start/end/flags from saved list */ +@@ -1716,7 +1707,7 @@ static void pci_bridge_release_resources(struct pci_bus *bus, + struct resource *r; + unsigned int old_flags; + struct resource *b_res; +- int idx = 1; ++ int idx, ret; + + b_res = &dev->resource[PCI_BRIDGE_RESOURCES]; + +@@ -1750,21 +1741,18 @@ static void pci_bridge_release_resources(struct pci_bus *bus, + + /* If there are children, release them all */ + release_child_resources(r); +- if (!release_resource(r)) { +- type = old_flags = r->flags & PCI_RES_TYPE_MASK; +- pci_info(dev, "resource %d %pR released\n", +- PCI_BRIDGE_RESOURCES + idx, r); +- /* Keep the old size */ +- resource_set_range(r, 0, resource_size(r)); +- r->flags = 0; + +- /* Avoiding touch the one without PREF */ +- if (type & IORESOURCE_PREFETCH) +- type = IORESOURCE_PREFETCH; +- __pci_setup_bridge(bus, type); +- /* For next child res under same bridge */ +- r->flags = old_flags; +- } ++ type = old_flags = r->flags & PCI_RES_TYPE_MASK; ++ ret = pci_release_resource(dev, PCI_BRIDGE_RESOURCES + idx); ++ if (ret) ++ return; ++ ++ /* Avoiding touch the one without PREF */ ++ if (type & IORESOURCE_PREFETCH) ++ type = IORESOURCE_PREFETCH; ++ __pci_setup_bridge(bus, type); ++ /* For next child res under same bridge */ ++ r->flags = old_flags; + } + + enum release_type { +@@ -2409,7 +2397,6 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type) + for (i = PCI_BRIDGE_RESOURCES; i < PCI_BRIDGE_RESOURCE_END; + i++) { + struct resource *res = &bridge->resource[i]; +- const char *res_name = pci_resource_name(bridge, i); + + if ((res->flags ^ type) & PCI_RES_TYPE_MASK) + continue; +@@ -2422,12 +2409,7 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type) + if (ret) + goto cleanup; + +- pci_info(bridge, "%s %pR: releasing\n", res_name, res); +- +- if (res->parent) +- release_resource(res); +- res->start = 0; +- res->end = 0; ++ pci_release_resource(bridge, i); + break; + } + if (i == PCI_BRIDGE_RESOURCE_END) +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index d2b3ed51e8804..0468c058b5987 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -406,20 +406,25 @@ int pci_reassign_resource(struct pci_dev *dev, int resno, + return 0; + } + +-void pci_release_resource(struct pci_dev *dev, int resno) ++int pci_release_resource(struct pci_dev *dev, int resno) + { + struct resource *res = pci_resource_n(dev, resno); + const char *res_name = pci_resource_name(dev, resno); ++ int ret; + + if (!res->parent) +- return; ++ return 0; + + pci_info(dev, "%s %pR: releasing\n", res_name, res); + +- release_resource(res); ++ ret = release_resource(res); ++ if (ret) ++ return ret; + res->end = resource_size(res) - 1; + res->start = 0; + res->flags |= IORESOURCE_UNSET; ++ ++ return 0; + } + EXPORT_SYMBOL(pci_release_resource); + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 59876de13860d..275df40587672 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1417,7 +1417,7 @@ void pci_reset_secondary_bus(struct pci_dev *dev); + void pcibios_reset_secondary_bus(struct pci_dev *dev); + void pci_update_resource(struct pci_dev *dev, int resno); + int __must_check pci_assign_resource(struct pci_dev *dev, int i); +-void pci_release_resource(struct pci_dev *dev, int resno); ++int pci_release_resource(struct pci_dev *dev, int resno); + static inline int pci_rebar_bytes_to_size(u64 bytes) + { + bytes = roundup_pow_of_two(bytes); +-- +2.51.0 + diff --git a/queue-6.17/pci-xgene-msi-return-negative-einval-in-xgene_msi_ha.patch b/queue-6.17/pci-xgene-msi-return-negative-einval-in-xgene_msi_ha.patch new file mode 100644 index 0000000000..4d38dbab16 --- /dev/null +++ b/queue-6.17/pci-xgene-msi-return-negative-einval-in-xgene_msi_ha.patch @@ -0,0 +1,38 @@ +From 4e98d67dbc93847a078108be8e3b95b3035d37f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 16:34:37 +0300 +Subject: PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() + +From: Dan Carpenter + +[ Upstream commit b26fc701a25195134ff0327709a0421767c4c7b2 ] + +There is a typo so we accidentally return positive EINVAL instead of +negative -EINVAL. Add the missing '-' character. + +Fixes: 6aceb36f17ab ("PCI: xgene-msi: Restructure handler setup/teardown") +Signed-off-by: Dan Carpenter +Signed-off-by: Manivannan Sadhasivam +Acked-by: Marc Zyngier +Link: https://patch.msgid.link/aIzCbVd93ivPinne@stanley.mountain +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-xgene-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c +index 0a37a3f1809c5..654639bccd10e 100644 +--- a/drivers/pci/controller/pci-xgene-msi.c ++++ b/drivers/pci/controller/pci-xgene-msi.c +@@ -311,7 +311,7 @@ static int xgene_msi_handler_setup(struct platform_device *pdev) + msi_val = xgene_msi_int_read(xgene_msi, i); + if (msi_val) { + dev_err(&pdev->dev, "Failed to clear spurious IRQ\n"); +- return EINVAL; ++ return -EINVAL; + } + + irq = platform_get_irq(pdev, i); +-- +2.51.0 + diff --git a/queue-6.17/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.17/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..3e094785d5 --- /dev/null +++ b/queue-6.17/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From c5543721c706f2aa3cf48aae9b7bfada15391fb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 369e77ad5f13f..8f14cb324e018 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -97,7 +97,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-6.17/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch b/queue-6.17/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch new file mode 100644 index 0000000000..0cb08dd0ff --- /dev/null +++ b/queue-6.17/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch @@ -0,0 +1,92 @@ +From 5886e33129c90b25b5f6d1cced563a7154c6fdb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:30:27 +0800 +Subject: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error + +From: Dapeng Mi + +[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ] + +When running perf_fuzzer on PTL, sometimes the below "unchecked MSR + access error" is seen when accessing IA32_PMC_x_CFG_B MSRs. + +[ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30) +[ 55.611280] Call Trace: +[ 55.611282] +[ 55.611284] ? intel_pmu_config_acr+0x87/0x160 +[ 55.611289] intel_pmu_enable_acr+0x6d/0x80 +[ 55.611291] intel_pmu_enable_event+0xce/0x460 +[ 55.611293] x86_pmu_start+0x78/0xb0 +[ 55.611297] x86_pmu_enable+0x218/0x3a0 +[ 55.611300] ? x86_pmu_enable+0x121/0x3a0 +[ 55.611302] perf_pmu_enable+0x40/0x50 +[ 55.611307] ctx_resched+0x19d/0x220 +[ 55.611309] __perf_install_in_context+0x284/0x2f0 +[ 55.611311] ? __pfx_remote_function+0x10/0x10 +[ 55.611314] remote_function+0x52/0x70 +[ 55.611317] ? __pfx_remote_function+0x10/0x10 +[ 55.611319] generic_exec_single+0x84/0x150 +[ 55.611323] smp_call_function_single+0xc5/0x1a0 +[ 55.611326] ? __pfx_remote_function+0x10/0x10 +[ 55.611329] perf_install_in_context+0xd1/0x1e0 +[ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10 +[ 55.611333] __do_sys_perf_event_open+0xa76/0x1040 +[ 55.611336] __x64_sys_perf_event_open+0x26/0x30 +[ 55.611337] x64_sys_call+0x1d8e/0x20c0 +[ 55.611339] do_syscall_64+0x4f/0x120 +[ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +On PTL, GP counter 0 and 1 doesn't support auto counter reload feature, +thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR +which requires to enable auto counter reload on GP counter 0. + +The root cause of causing this issue is the check for auto counter +reload (ACR) counter mask from user space is incorrect in +intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter +mask from user space could be set into hw.config1 and then written into +CFG_B MSRs and trigger the MSR access warning. + +e.g., User may create a perf event with ACR counter mask (config2=0xcb), +and there is only 1 event created, so "cpuc->n_events" is 1. + +The correct check condition should be "i + idx >= cpuc->n_events" +instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise, +the counter mask would traverse twice and an invalid "cpuc->assign[1]" +bit (bit 0) is set into hw.config1 and cause MSR accessing error. + +Besides, also check if the ACR counter mask corresponding events are +ACR events. If not, filter out these counter mask. If a event is not a +ACR event, it could be scheduled to an HW counter which doesn't support +ACR. It's invalid to add their counter index in ACR counter mask. + +Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as +user could set any invalid ACR counter mask and the warning message +could mislead users. + +Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") +Signed-off-by: Dapeng Mi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index c2fb729c270ec..15da60cf69f20 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc) + if (event->group_leader != leader->group_leader) + break; + for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) { +- if (WARN_ON_ONCE(i + idx > cpuc->n_events)) ++ if (i + idx >= cpuc->n_events || ++ !is_acr_event_group(cpuc->event_list[i + idx])) + return; + __set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1); + } +-- +2.51.0 + diff --git a/queue-6.17/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch b/queue-6.17/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch new file mode 100644 index 0000000000..dc79706322 --- /dev/null +++ b/queue-6.17/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch @@ -0,0 +1,48 @@ +From 533f06902f4227beb1800e9095a4ab6584c6089c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:30:26 +0800 +Subject: perf/x86/intel: Use early_initcall() to hook bts_init() + +From: Dapeng Mi + +[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ] + +After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS + initialization from PEBS initialization")' is introduced, x86_pmu.bts +would initialized in bts_init() which is hooked by arch_initcall(). + +Whereas init_hw_perf_events() is hooked by early_initcall(). Once the +core PMU is initialized, nmi watchdog initialization is called +immediately before bts_init() is called. It leads to the BTS buffer is +not really initialized since bts_init() is not called and x86_pmu.bts is +still false at that time. Worse, BTS buffer would never be initialized +then unless all core PMU events are freed and reserve_ds_buffers() +is called again. + +Thus aligning with init_hw_perf_events(), use early_initcall() to hook +bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog +initialization. + +Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization") +Signed-off-by: Dapeng Mi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/bts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c +index 61da6b8a3d519..cbac54cb3a9ec 100644 +--- a/arch/x86/events/intel/bts.c ++++ b/arch/x86/events/intel/bts.c +@@ -643,4 +643,4 @@ static __init int bts_init(void) + + return perf_pmu_register(&bts_pmu, "intel_bts", -1); + } +-arch_initcall(bts_init); ++early_initcall(bts_init); +-- +2.51.0 + diff --git a/queue-6.17/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch b/queue-6.17/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch new file mode 100644 index 0000000000..cfc2bd92ca --- /dev/null +++ b/queue-6.17/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch @@ -0,0 +1,69 @@ +From 9afe56ecd3d25458188ef21c43939f8394d47fa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 07:23:22 +0000 +Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 + +From: Jonas Karlman + +[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ] + +The boot firmware may disable the U3 port early during boot and leave it +up to the controller or PHY driver to re-enable U3 when needed. + +The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, +something the Rockchip Naneng Combo PHY driver never does for RK3568. +This may result in USB 3.0 ports being limited to only using USB 2.0 or +in special cases not working at all on RK3568. + +Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled +when a PHY with PHY_TYPE_USB3 mode is used. + +Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index ce91fb1d51671..17c6310f4b54b 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg { + struct combphy_reg pipe_xpcs_phy_ready; + struct combphy_reg pipe_pcie1l0_sel; + struct combphy_reg pipe_pcie1l1_sel; ++ struct combphy_reg u3otg0_port_en; ++ struct combphy_reg u3otg1_port_en; + }; + + struct rockchip_combphy_cfg { +@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); ++ switch (priv->id) { ++ case 0: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); ++ break; ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); ++ break; ++ } + break; + + case PHY_TYPE_SATA: +@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + /* pipe-grf */ + .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, + .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, ++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, ++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { +-- +2.51.0 + diff --git a/queue-6.17/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch b/queue-6.17/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch new file mode 100644 index 0000000000..c5f755faac --- /dev/null +++ b/queue-6.17/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch @@ -0,0 +1,53 @@ +From 45d99aac90afc2a6c7ae2667bb761aea8bf10d7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 21:26:05 +0200 +Subject: pid: use ns_capable_noaudit() when determining net sysctl permissions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Göttsche + +[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ] + +The capability check should not be audited since it is only being used +to determine the inode permissions. A failed check does not indicate a +violation of security policy but, when an LSM is enabled, a denial audit +message was being generated. + +The denial audit message can either lead to the capability being +unnecessarily allowed in a security policy, or being silenced potentially +masking a legitimate capability check at a later point in time. + +Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when +determining net sysctl permissions") + +Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace") +CC: Christian Brauner +CC: linux-security-module@vger.kernel.org +CC: selinux@vger.kernel.org +Signed-off-by: Christian Göttsche +Acked-by: Serge Hallyn +Reviewed-by: Paul Moore +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + kernel/pid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/pid.c b/kernel/pid.c +index c45a28c16cd25..d94ce02505012 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head, + container_of(head->set, struct pid_namespace, set); + int mode = table->mode; + +- if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) || ++ if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) || + uid_eq(current_euid(), make_kuid(pidns->user_ns, 0))) + mode = (mode & S_IRWXU) >> 6; + else if (in_egroup_p(make_kgid(pidns->user_ns, 0))) +-- +2.51.0 + diff --git a/queue-6.17/pinctrl-eswin-fix-regulator-error-check-and-kconfig-.patch b/queue-6.17/pinctrl-eswin-fix-regulator-error-check-and-kconfig-.patch new file mode 100644 index 0000000000..c25177c953 --- /dev/null +++ b/queue-6.17/pinctrl-eswin-fix-regulator-error-check-and-kconfig-.patch @@ -0,0 +1,69 @@ +From 55e54a6546b697d6c4b89df6f72a703b66db06f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 17:19:15 +0800 +Subject: pinctrl: eswin: Fix regulator error check and Kconfig dependency + +From: Yulin Lu + +[ Upstream commit a6a2f50ab1721343ee2d5d2be888709aa886e3aa ] + +Smatch reported the following warning in eic7700_pinctrl_probe(): + + drivers/pinctrl/pinctrl-eic7700.c:638 eic7700_pinctrl_probe() + warn: passing zero to 'PTR_ERR' + +The root cause is that devm_regulator_get() may return NULL when +CONFIG_REGULATOR is disabled. In such case, IS_ERR_OR_NULL() triggers +PTR_ERR(NULL) which evaluates to 0, leading to passing a success code +as an error. + +However, this driver cannot work without a regulator. To fix this: + + - Change the check from IS_ERR_OR_NULL() to IS_ERR() + - Update Kconfig to explicitly select REGULATOR and + REGULATOR_FIXED_VOLTAGE, ensuring that the regulator framework is + always available. + +This resolves the Smatch warning and enforces the correct dependency. + +Suggested-by: Dan Carpenter +Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-gpio/aKRGiZ-fai0bv0tG@stanley.mountain/ +Signed-off-by: Yulin Lu +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/Kconfig | 2 ++ + drivers/pinctrl/pinctrl-eic7700.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig +index be1ca8e85754b..0402626c4b98b 100644 +--- a/drivers/pinctrl/Kconfig ++++ b/drivers/pinctrl/Kconfig +@@ -211,6 +211,8 @@ config PINCTRL_EIC7700 + depends on ARCH_ESWIN || COMPILE_TEST + select PINMUX + select GENERIC_PINCONF ++ select REGULATOR ++ select REGULATOR_FIXED_VOLTAGE + help + This driver support for the pin controller in ESWIN's EIC7700 SoC, + which supports pin multiplexing, pin configuration,and rgmii voltage +diff --git a/drivers/pinctrl/pinctrl-eic7700.c b/drivers/pinctrl/pinctrl-eic7700.c +index 4874b55323439..ffcd0ec5c2dc6 100644 +--- a/drivers/pinctrl/pinctrl-eic7700.c ++++ b/drivers/pinctrl/pinctrl-eic7700.c +@@ -634,7 +634,7 @@ static int eic7700_pinctrl_probe(struct platform_device *pdev) + return PTR_ERR(pc->base); + + regulator = devm_regulator_get(dev, "vrgmii"); +- if (IS_ERR_OR_NULL(regulator)) { ++ if (IS_ERR(regulator)) { + return dev_err_probe(dev, PTR_ERR(regulator), + "failed to get vrgmii regulator\n"); + } +-- +2.51.0 + diff --git a/queue-6.17/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.17/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..e465e66ec2 --- /dev/null +++ b/queue-6.17/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From 407d1fa7dbfb0c4f2d8ab82fd6df0da27725db16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 9171de657f978..a75762e4d2641 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-6.17/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch b/queue-6.17/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch new file mode 100644 index 0000000000..9e57576627 --- /dev/null +++ b/queue-6.17/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch @@ -0,0 +1,49 @@ +From 5c21eb67a8ee1f348f4ca32929855bbc6ab1da02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 17:08:13 +0100 +Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in + rzg3s_oen_read() + +From: Lad Prabhakar + +[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ] + +rzg3s_oen_read() returns a u32 value, but previously propagated a negative +error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large +positive value due to unsigned conversion. This caused incorrect +output-enable reporting for certain pins. + +Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported +as "output enabled" in the pinconf-pins debugfs file. With this fix, only +P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the +hardware manual. + +Fix this by returning 0 when the OEN bit lookup fails, treating the pin +as output-disabled by default. + +Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index c52263c2a7b09..22bc5b8f65fde 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -1124,7 +1124,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin) + + bit = rzg3s_pin_to_oen_bit(pctrl, _pin); + if (bit < 0) +- return bit; ++ return 0; + + return !(readb(pctrl->base + ETH_MODE) & BIT(bit)); + } +-- +2.51.0 + diff --git a/queue-6.17/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.17/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..f5bbeda00f --- /dev/null +++ b/queue-6.17/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From e6dcd02ab8b1826ac52ff7ca0718533e0e3e8a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 29d16c9c1bd19..3a742f74ecd1d 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-6.17/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.17/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch new file mode 100644 index 0000000000..73b9adae07 --- /dev/null +++ b/queue-6.17/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch @@ -0,0 +1,40 @@ +From 03d92778f3502f21704349fc1749ba91aaf6fb3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:58:23 +0300 +Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in + probe() + +From: Dan Carpenter + +[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ] + +The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which +would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check +that the pointer is valid. + +Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") +Signed-off-by: Dan Carpenter +Signed-off-by: Chanwoo Choi +Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/mtk-cci-devfreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index 22fe9e631f8aa..5730076846e1b 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +-- +2.51.0 + diff --git a/queue-6.17/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch b/queue-6.17/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch new file mode 100644 index 0000000000..71b4fe5362 --- /dev/null +++ b/queue-6.17/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch @@ -0,0 +1,88 @@ +From 452edfd767a5acd169f0f17e5d0513a9ed62a2d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 May 2025 15:38:08 +0200 +Subject: PM / devfreq: rockchip-dfi: double count on RK3588 + +From: Nicolas Frattaroli + +[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ] + +On RK3588 with LPDDR4X memory, the cycle count as returned by + + perf stat -a -e rockchip_ddr/cycles/ sleep 1 + +consistently reads half as much as what the actual DDR frequency is at. +For a LPDDR4X module running at 2112MHz, I get more like 1056059916 +cycles per second, which is almost bang-on half what it should be. No, +I'm not mixing up megatransfers and megahertz. + +Consulting the downstream driver, this appears to be because the RK3588 +hardware specifically (and RK3528 as well, for future reference) needs a +multiplier of 2 to get to the correct frequency with everything but +LPDDR5. + +The RK3588's actual memory bandwidth measurements in MB/s are correct +however, as confirmed with stress-ng --stream. This makes me think the +access counters are not affected in the same way. This tracks with the +vendor kernel not multiplying the access counts either. + +Solve this by adding a new member to the dfi struct, which each SoC can +set to whatever they want, but defaults to 1 if left unset by the SoC +init functions. The event_get_count op can then use this multiplier if +the cycle count is requested. + +The cycle multiplier is not used in rockchip_dfi_get_event because the +vendor driver doesn't use it there either, and we don't do other actual +bandwidth unit conversion stuff in there anyway. + +Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588") +Signed-off-by: Nicolas Frattaroli +Signed-off-by: Chanwoo Choi +Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/event/rockchip-dfi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c +index 0470d7c175f4f..54effb6351965 100644 +--- a/drivers/devfreq/event/rockchip-dfi.c ++++ b/drivers/devfreq/event/rockchip-dfi.c +@@ -116,6 +116,7 @@ struct rockchip_dfi { + int buswidth[DMC_MAX_CHANNELS]; + int ddrmon_stride; + bool ddrmon_ctrl_single; ++ unsigned int count_multiplier; /* number of data clocks per count */ + }; + + static int rockchip_dfi_enable(struct rockchip_dfi *dfi) +@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event) + + switch (event->attr.config) { + case PERF_EVENT_CYCLES: +- count = total.c[0].clock_cycles; ++ count = total.c[0].clock_cycles * dfi->count_multiplier; + break; + case PERF_EVENT_READ_BYTES: + for (i = 0; i < dfi->max_channels; i++) +@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi) + break; + } + ++ if (!dfi->count_multiplier) ++ dfi->count_multiplier = 1; ++ + ret = perf_pmu_register(pmu, "rockchip_ddr", -1); + if (ret) + return ret; +@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi) + dfi->max_channels = 4; + + dfi->ddrmon_stride = 0x4000; ++ dfi->count_multiplier = 2; + + return 0; + }; +-- +2.51.0 + diff --git a/queue-6.17/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.17/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..b83a8943a0 --- /dev/null +++ b/queue-6.17/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From 46625e12d2f17daf6271892e5c583f340bcd207c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 2ea6e05e6ec90..c883b01ffbddc 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -724,8 +724,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-6.17/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.17/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch new file mode 100644 index 0000000000..07a920ed8c --- /dev/null +++ b/queue-6.17/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch @@ -0,0 +1,37 @@ +From 18786673429d0b9080b084a993ca7a7bc19bc315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 20:32:59 +0800 +Subject: power: supply: cw2015: Fix a alignment coding style issue + +From: Andy Yan + +[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ] + +Fix the checkpatch warning: +CHECK: Alignment should match open parenthesis + +Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") +Signed-off-by: Andy Yan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index f63c3c4104515..382dff8805c62 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +-- +2.51.0 + diff --git a/queue-6.17/power-supply-max77705_charger-refactoring-rename-cha.patch b/queue-6.17/power-supply-max77705_charger-refactoring-rename-cha.patch new file mode 100644 index 0000000000..0afbb8cc6a --- /dev/null +++ b/queue-6.17/power-supply-max77705_charger-refactoring-rename-cha.patch @@ -0,0 +1,260 @@ +From 6e2379bd37e97dc4a382955e67af7236b521f78d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 20:06:47 +0300 +Subject: power: supply: max77705_charger: refactoring: rename charger to chg + +From: Dzmitry Sankouski + +[ Upstream commit d84510db8c1414b67167cdc452103c1f429588cc ] + +Rename struct max77705_charger_data variable to chg for consistency. + +Signed-off-by: Dzmitry Sankouski +Signed-off-by: Sebastian Reichel +Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts") +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max77705_charger.c | 80 ++++++++++++------------- + 1 file changed, 40 insertions(+), 40 deletions(-) + +diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c +index 3b75c82b9b9ea..7855f890e0a9f 100644 +--- a/drivers/power/supply/max77705_charger.c ++++ b/drivers/power/supply/max77705_charger.c +@@ -42,9 +42,9 @@ static enum power_supply_property max77705_charger_props[] = { + + static int max77705_chgin_irq(void *irq_drv_data) + { +- struct max77705_charger_data *charger = irq_drv_data; ++ struct max77705_charger_data *chg = irq_drv_data; + +- queue_work(charger->wqueue, &charger->chgin_work); ++ queue_work(chg->wqueue, &chg->chgin_work); + + return 0; + } +@@ -109,19 +109,19 @@ static int max77705_get_online(struct regmap *regmap, int *val) + return 0; + } + +-static int max77705_check_battery(struct max77705_charger_data *charger, int *val) ++static int max77705_check_battery(struct max77705_charger_data *chg, int *val) + { + unsigned int reg_data; + unsigned int reg_data2; +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + + regmap_read(regmap, MAX77705_CHG_REG_INT_OK, ®_data); + +- dev_dbg(charger->dev, "CHG_INT_OK(0x%x)\n", reg_data); ++ dev_dbg(chg->dev, "CHG_INT_OK(0x%x)\n", reg_data); + + regmap_read(regmap, MAX77705_CHG_REG_DETAILS_00, ®_data2); + +- dev_dbg(charger->dev, "CHG_DETAILS00(0x%x)\n", reg_data2); ++ dev_dbg(chg->dev, "CHG_DETAILS00(0x%x)\n", reg_data2); + + if ((reg_data & MAX77705_BATP_OK) || !(reg_data2 & MAX77705_BATP_DTLS)) + *val = true; +@@ -131,9 +131,9 @@ static int max77705_check_battery(struct max77705_charger_data *charger, int *va + return 0; + } + +-static int max77705_get_charge_type(struct max77705_charger_data *charger, int *val) ++static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val) + { +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + unsigned int reg_data; + + regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); +@@ -159,9 +159,9 @@ static int max77705_get_charge_type(struct max77705_charger_data *charger, int * + return 0; + } + +-static int max77705_get_status(struct max77705_charger_data *charger, int *val) ++static int max77705_get_status(struct max77705_charger_data *chg, int *val) + { +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + unsigned int reg_data; + + regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); +@@ -234,10 +234,10 @@ static int max77705_get_vbus_state(struct regmap *regmap, int *value) + return 0; + } + +-static int max77705_get_battery_health(struct max77705_charger_data *charger, ++static int max77705_get_battery_health(struct max77705_charger_data *chg, + int *value) + { +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + unsigned int bat_dtls; + + regmap_read(regmap, MAX77705_CHG_REG_DETAILS_01, &bat_dtls); +@@ -245,16 +245,16 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger, + + switch (bat_dtls) { + case MAX77705_BATTERY_NOBAT: +- dev_dbg(charger->dev, "%s: No battery and the charger is suspended\n", ++ dev_dbg(chg->dev, "%s: No battery and the chg is suspended\n", + __func__); + *value = POWER_SUPPLY_HEALTH_NO_BATTERY; + break; + case MAX77705_BATTERY_PREQUALIFICATION: +- dev_dbg(charger->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n", ++ dev_dbg(chg->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n", + __func__); + break; + case MAX77705_BATTERY_DEAD: +- dev_dbg(charger->dev, "%s: battery dead\n", __func__); ++ dev_dbg(chg->dev, "%s: battery dead\n", __func__); + *value = POWER_SUPPLY_HEALTH_DEAD; + break; + case MAX77705_BATTERY_GOOD: +@@ -262,11 +262,11 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger, + *value = POWER_SUPPLY_HEALTH_GOOD; + break; + case MAX77705_BATTERY_OVERVOLTAGE: +- dev_dbg(charger->dev, "%s: battery ovp\n", __func__); ++ dev_dbg(chg->dev, "%s: battery ovp\n", __func__); + *value = POWER_SUPPLY_HEALTH_OVERVOLTAGE; + break; + default: +- dev_dbg(charger->dev, "%s: battery unknown\n", __func__); ++ dev_dbg(chg->dev, "%s: battery unknown\n", __func__); + *value = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE; + break; + } +@@ -274,9 +274,9 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger, + return 0; + } + +-static int max77705_get_health(struct max77705_charger_data *charger, int *val) ++static int max77705_get_health(struct max77705_charger_data *chg, int *val) + { +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + int ret, is_online = 0; + + ret = max77705_get_online(regmap, &is_online); +@@ -287,15 +287,15 @@ static int max77705_get_health(struct max77705_charger_data *charger, int *val) + if (ret || (*val != POWER_SUPPLY_HEALTH_GOOD)) + return ret; + } +- return max77705_get_battery_health(charger, val); ++ return max77705_get_battery_health(chg, val); + } + +-static int max77705_get_input_current(struct max77705_charger_data *charger, ++static int max77705_get_input_current(struct max77705_charger_data *chg, + int *val) + { + unsigned int reg_data; + int get_current = 0; +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + + regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); + +@@ -313,11 +313,11 @@ static int max77705_get_input_current(struct max77705_charger_data *charger, + return 0; + } + +-static int max77705_get_charge_current(struct max77705_charger_data *charger, ++static int max77705_get_charge_current(struct max77705_charger_data *chg, + int *val) + { + unsigned int reg_data; +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + + regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data); + reg_data &= MAX77705_CHG_CC; +@@ -327,12 +327,12 @@ static int max77705_get_charge_current(struct max77705_charger_data *charger, + return 0; + } + +-static int max77705_set_float_voltage(struct max77705_charger_data *charger, ++static int max77705_set_float_voltage(struct max77705_charger_data *chg, + int float_voltage) + { + int float_voltage_mv; + unsigned int reg_data = 0; +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + + float_voltage_mv = float_voltage / 1000; + reg_data = float_voltage_mv <= 4000 ? 0x0 : +@@ -345,12 +345,12 @@ static int max77705_set_float_voltage(struct max77705_charger_data *charger, + (reg_data << MAX77705_CHG_CV_PRM_SHIFT)); + } + +-static int max77705_get_float_voltage(struct max77705_charger_data *charger, ++static int max77705_get_float_voltage(struct max77705_charger_data *chg, + int *val) + { + unsigned int reg_data = 0; + int voltage_mv; +- struct regmap *regmap = charger->regmap; ++ struct regmap *regmap = chg->regmap; + + regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data); + reg_data &= MAX77705_CHG_PRM_MASK; +@@ -365,28 +365,28 @@ static int max77705_chg_get_property(struct power_supply *psy, + enum power_supply_property psp, + union power_supply_propval *val) + { +- struct max77705_charger_data *charger = power_supply_get_drvdata(psy); +- struct regmap *regmap = charger->regmap; ++ struct max77705_charger_data *chg = power_supply_get_drvdata(psy); ++ struct regmap *regmap = chg->regmap; + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: + return max77705_get_online(regmap, &val->intval); + case POWER_SUPPLY_PROP_PRESENT: +- return max77705_check_battery(charger, &val->intval); ++ return max77705_check_battery(chg, &val->intval); + case POWER_SUPPLY_PROP_STATUS: +- return max77705_get_status(charger, &val->intval); ++ return max77705_get_status(chg, &val->intval); + case POWER_SUPPLY_PROP_CHARGE_TYPE: +- return max77705_get_charge_type(charger, &val->intval); ++ return max77705_get_charge_type(chg, &val->intval); + case POWER_SUPPLY_PROP_HEALTH: +- return max77705_get_health(charger, &val->intval); ++ return max77705_get_health(chg, &val->intval); + case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT: +- return max77705_get_input_current(charger, &val->intval); ++ return max77705_get_input_current(chg, &val->intval); + case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: +- return max77705_get_charge_current(charger, &val->intval); ++ return max77705_get_charge_current(chg, &val->intval); + case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE: +- return max77705_get_float_voltage(charger, &val->intval); ++ return max77705_get_float_voltage(chg, &val->intval); + case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN: +- val->intval = charger->bat_info->voltage_max_design_uv; ++ val->intval = chg->bat_info->voltage_max_design_uv; + break; + case POWER_SUPPLY_PROP_MODEL_NAME: + val->strval = max77705_charger_model; +@@ -410,10 +410,10 @@ static const struct power_supply_desc max77705_charger_psy_desc = { + + static void max77705_chgin_isr_work(struct work_struct *work) + { +- struct max77705_charger_data *charger = ++ struct max77705_charger_data *chg = + container_of(work, struct max77705_charger_data, chgin_work); + +- power_supply_changed(charger->psy_chg); ++ power_supply_changed(chg->psy_chg); + } + + static void max77705_charger_initialize(struct max77705_charger_data *chg) +-- +2.51.0 + diff --git a/queue-6.17/power-supply-max77705_charger-rework-interrupts.patch b/queue-6.17/power-supply-max77705_charger-rework-interrupts.patch new file mode 100644 index 0000000000..62e4fb6217 --- /dev/null +++ b/queue-6.17/power-supply-max77705_charger-rework-interrupts.patch @@ -0,0 +1,91 @@ +From 00ccf0c4e51b313d48a669d957307c394f90a361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 20:06:51 +0300 +Subject: power: supply: max77705_charger: rework interrupts + +From: Dzmitry Sankouski + +[ Upstream commit 12a1185a06e3377af777e792ba7436862f8e528a ] + +Current implementation uses handle_post_irq to actually handle chgin +irq. This is not how things are meant to work in regmap-irq. + +Remove handle_post_irq, and request a threaded interrupt for chgin. + +Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") +Signed-off-by: Dzmitry Sankouski +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max77705_charger.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c +index 2d2201a6ba687..a8762bdd2c7c6 100644 +--- a/drivers/power/supply/max77705_charger.c ++++ b/drivers/power/supply/max77705_charger.c +@@ -40,13 +40,13 @@ static enum power_supply_property max77705_charger_props[] = { + POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, + }; + +-static int max77705_chgin_irq(void *irq_drv_data) ++static irqreturn_t max77705_chgin_irq(int irq, void *irq_drv_data) + { + struct max77705_charger_data *chg = irq_drv_data; + + queue_work(chg->wqueue, &chg->chgin_work); + +- return 0; ++ return IRQ_HANDLED; + } + + static const struct regmap_irq max77705_charger_irqs[] = { +@@ -64,7 +64,6 @@ static struct regmap_irq_chip max77705_charger_irq_chip = { + .name = "max77705-charger", + .status_base = MAX77705_CHG_REG_INT, + .mask_base = MAX77705_CHG_REG_INT_MASK, +- .handle_post_irq = max77705_chgin_irq, + .num_regs = 1, + .irqs = max77705_charger_irqs, + .num_irqs = ARRAY_SIZE(max77705_charger_irqs), +@@ -493,12 +492,6 @@ static int max77705_charger_probe(struct i2c_client *i2c) + "cannot allocate regmap field\n"); + } + +- ret = regmap_update_bits(chg->regmap, +- MAX77705_CHG_REG_INT_MASK, +- MAX77705_CHGIN_IM, 0); +- if (ret) +- return ret; +- + pscfg.fwnode = dev_fwnode(dev); + pscfg.drv_data = chg; + +@@ -508,7 +501,7 @@ static int max77705_charger_probe(struct i2c_client *i2c) + + max77705_charger_irq_chip.irq_drv_data = chg; + ret = devm_regmap_add_irq_chip(chg->dev, chg->regmap, i2c->irq, +- IRQF_ONESHOT | IRQF_SHARED, 0, ++ IRQF_ONESHOT, 0, + &max77705_charger_irq_chip, + &irq_data); + if (ret) +@@ -526,6 +519,15 @@ static int max77705_charger_probe(struct i2c_client *i2c) + + max77705_charger_initialize(chg); + ++ ret = devm_request_threaded_irq(dev, regmap_irq_get_virq(irq_data, MAX77705_CHGIN_I), ++ NULL, max77705_chgin_irq, ++ IRQF_TRIGGER_NONE, ++ "chgin-irq", chg); ++ if (ret) { ++ dev_err_probe(dev, ret, "Failed to Request chgin IRQ\n"); ++ goto destroy_wq; ++ } ++ + ret = max77705_charger_enable(chg); + if (ret) { + dev_err_probe(dev, ret, "failed to enable charge\n"); +-- +2.51.0 + diff --git a/queue-6.17/power-supply-max77705_charger-use-regfields-for-conf.patch b/queue-6.17/power-supply-max77705_charger-use-regfields-for-conf.patch new file mode 100644 index 0000000000..999d224e83 --- /dev/null +++ b/queue-6.17/power-supply-max77705_charger-use-regfields-for-conf.patch @@ -0,0 +1,434 @@ +From 2907a1c82744cb891eb51e79aedb449172f8b7d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 20:06:48 +0300 +Subject: power: supply: max77705_charger: use regfields for config registers + +From: Dzmitry Sankouski + +[ Upstream commit ef1e734dbe257ce8bc42383b9977b5558f061288 ] + +Using regfields allows to cleanup masks and register offset definition, +allowing to access register info by it's functional name. + +Signed-off-by: Dzmitry Sankouski +Signed-off-by: Sebastian Reichel +Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts") +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max77705_charger.c | 105 +++++++++--------------- + include/linux/power/max77705_charger.h | 102 ++++++++++++----------- + 2 files changed, 93 insertions(+), 114 deletions(-) + +diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c +index 7855f890e0a9f..2d2201a6ba687 100644 +--- a/drivers/power/supply/max77705_charger.c ++++ b/drivers/power/supply/max77705_charger.c +@@ -74,8 +74,7 @@ static int max77705_charger_enable(struct max77705_charger_data *chg) + { + int rv; + +- rv = regmap_update_bits(chg->regmap, MAX77705_CHG_REG_CNFG_09, +- MAX77705_CHG_EN_MASK, MAX77705_CHG_EN_MASK); ++ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], 1); + if (rv) + dev_err(chg->dev, "unable to enable the charger: %d\n", rv); + +@@ -87,10 +86,7 @@ static void max77705_charger_disable(void *data) + struct max77705_charger_data *chg = data; + int rv; + +- rv = regmap_update_bits(chg->regmap, +- MAX77705_CHG_REG_CNFG_09, +- MAX77705_CHG_EN_MASK, +- MAX77705_CHG_DISABLE); ++ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], MAX77705_CHG_DISABLE); + if (rv) + dev_err(chg->dev, "unable to disable the charger: %d\n", rv); + } +@@ -134,10 +130,10 @@ static int max77705_check_battery(struct max77705_charger_data *chg, int *val) + static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val) + { + struct regmap *regmap = chg->regmap; +- unsigned int reg_data; ++ unsigned int reg_data, chg_en; + +- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); +- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) { ++ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en); ++ if (!chg_en) { + *val = POWER_SUPPLY_CHARGE_TYPE_NONE; + return 0; + } +@@ -162,10 +158,10 @@ static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val) + static int max77705_get_status(struct max77705_charger_data *chg, int *val) + { + struct regmap *regmap = chg->regmap; +- unsigned int reg_data; ++ unsigned int reg_data, chg_en; + +- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); +- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) { ++ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en); ++ if (!chg_en) { + *val = POWER_SUPPLY_CHARGE_TYPE_NONE; + return 0; + } +@@ -295,16 +291,11 @@ static int max77705_get_input_current(struct max77705_charger_data *chg, + { + unsigned int reg_data; + int get_current = 0; +- struct regmap *regmap = chg->regmap; + +- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data); +- +- reg_data &= MAX77705_CHG_CHGIN_LIM_MASK; ++ regmap_field_read(chg->rfield[MAX77705_CHG_CHGIN_LIM], ®_data); + + if (reg_data <= 3) + get_current = MAX77705_CURRENT_CHGIN_MIN; +- else if (reg_data >= MAX77705_CHG_CHGIN_LIM_MASK) +- get_current = MAX77705_CURRENT_CHGIN_MAX; + else + get_current = (reg_data + 1) * MAX77705_CURRENT_CHGIN_STEP; + +@@ -317,10 +308,8 @@ static int max77705_get_charge_current(struct max77705_charger_data *chg, + int *val) + { + unsigned int reg_data; +- struct regmap *regmap = chg->regmap; + +- regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data); +- reg_data &= MAX77705_CHG_CC; ++ regmap_field_read(chg->rfield[MAX77705_CHG_CC_LIM], ®_data); + + *val = reg_data <= 0x2 ? MAX77705_CURRENT_CHGIN_MIN : reg_data * MAX77705_CURRENT_CHG_STEP; + +@@ -332,7 +321,6 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg, + { + int float_voltage_mv; + unsigned int reg_data = 0; +- struct regmap *regmap = chg->regmap; + + float_voltage_mv = float_voltage / 1000; + reg_data = float_voltage_mv <= 4000 ? 0x0 : +@@ -340,9 +328,7 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg, + (float_voltage_mv <= 4200) ? (float_voltage_mv - 4000) / 50 : + (((float_voltage_mv - 4200) / 10) + 0x04); + +- return regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_04, +- MAX77705_CHG_CV_PRM_MASK, +- (reg_data << MAX77705_CHG_CV_PRM_SHIFT)); ++ return regmap_field_write(chg->rfield[MAX77705_CHG_CV_PRM], reg_data); + } + + static int max77705_get_float_voltage(struct max77705_charger_data *chg, +@@ -350,10 +336,8 @@ static int max77705_get_float_voltage(struct max77705_charger_data *chg, + { + unsigned int reg_data = 0; + int voltage_mv; +- struct regmap *regmap = chg->regmap; + +- regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data); +- reg_data &= MAX77705_CHG_PRM_MASK; ++ regmap_field_read(chg->rfield[MAX77705_CHG_CV_PRM], ®_data); + voltage_mv = reg_data <= 0x04 ? reg_data * 50 + 4000 : + (reg_data - 4) * 10 + 4200; + *val = voltage_mv * 1000; +@@ -418,7 +402,6 @@ static void max77705_chgin_isr_work(struct work_struct *work) + + static void max77705_charger_initialize(struct max77705_charger_data *chg) + { +- u8 reg_data; + struct power_supply_battery_info *info; + struct regmap *regmap = chg->regmap; + +@@ -429,45 +412,31 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg) + + /* unlock charger setting protect */ + /* slowest LX slope */ +- reg_data = MAX77705_CHGPROT_MASK | MAX77705_SLOWEST_LX_SLOPE; +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_06, reg_data, +- reg_data); ++ regmap_field_write(chg->rfield[MAX77705_CHGPROT], MAX77705_CHGPROT_UNLOCKED); ++ regmap_field_write(chg->rfield[MAX77705_LX_SLOPE], MAX77705_SLOWEST_LX_SLOPE); + + /* fast charge timer disable */ + /* restart threshold disable */ + /* pre-qual charge disable */ +- reg_data = (MAX77705_FCHGTIME_DISABLE << MAX77705_FCHGTIME_SHIFT) | +- (MAX77705_CHG_RSTRT_DISABLE << MAX77705_CHG_RSTRT_SHIFT) | +- (MAX77705_CHG_PQEN_DISABLE << MAX77705_PQEN_SHIFT); +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_01, +- (MAX77705_FCHGTIME_MASK | +- MAX77705_CHG_RSTRT_MASK | +- MAX77705_PQEN_MASK), +- reg_data); +- +- /* OTG off(UNO on), boost off */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00, +- MAX77705_OTG_CTRL, 0); ++ regmap_field_write(chg->rfield[MAX77705_FCHGTIME], MAX77705_FCHGTIME_DISABLE); ++ regmap_field_write(chg->rfield[MAX77705_CHG_RSTRT], MAX77705_CHG_RSTRT_DISABLE); ++ regmap_field_write(chg->rfield[MAX77705_CHG_PQEN], MAX77705_CHG_PQEN_DISABLE); ++ ++ regmap_field_write(chg->rfield[MAX77705_MODE], ++ MAX77705_CHG_MASK | MAX77705_BUCK_MASK); + + /* charge current 450mA(default) */ + /* otg current limit 900mA */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_02, +- MAX77705_OTG_ILIM_MASK, +- MAX77705_OTG_ILIM_900 << MAX77705_OTG_ILIM_SHIFT); ++ regmap_field_write(chg->rfield[MAX77705_OTG_ILIM], MAX77705_OTG_ILIM_900); + + /* BAT to SYS OCP 4.80A */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_05, +- MAX77705_REG_B2SOVRC_MASK, +- MAX77705_B2SOVRC_4_8A << MAX77705_REG_B2SOVRC_SHIFT); ++ regmap_field_write(chg->rfield[MAX77705_REG_B2SOVRC], MAX77705_B2SOVRC_4_8A); ++ + /* top off current 150mA */ + /* top off timer 30min */ +- reg_data = (MAX77705_TO_ITH_150MA << MAX77705_TO_ITH_SHIFT) | +- (MAX77705_TO_TIME_30M << MAX77705_TO_TIME_SHIFT) | +- (MAX77705_SYS_TRACK_DISABLE << MAX77705_SYS_TRACK_DIS_SHIFT); +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_03, +- (MAX77705_TO_ITH_MASK | +- MAX77705_TO_TIME_MASK | +- MAX77705_SYS_TRACK_DIS_MASK), reg_data); ++ regmap_field_write(chg->rfield[MAX77705_TO], MAX77705_TO_ITH_150MA); ++ regmap_field_write(chg->rfield[MAX77705_TO_TIME], MAX77705_TO_TIME_30M); ++ regmap_field_write(chg->rfield[MAX77705_SYS_TRACK], MAX77705_SYS_TRACK_DISABLE); + + /* cv voltage 4.2V or 4.35V */ + /* MINVSYS 3.6V(default) */ +@@ -478,25 +447,21 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg) + max77705_set_float_voltage(chg, info->voltage_max_design_uv); + } + +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12, +- MAX77705_VCHGIN_REG_MASK, MAX77705_VCHGIN_4_5); +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12, +- MAX77705_WCIN_REG_MASK, MAX77705_WCIN_4_5); ++ regmap_field_write(chg->rfield[MAX77705_VCHGIN], MAX77705_VCHGIN_4_5); ++ regmap_field_write(chg->rfield[MAX77705_WCIN], MAX77705_WCIN_4_5); + + /* Watchdog timer */ + regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00, + MAX77705_WDTEN_MASK, 0); + + /* VBYPSET=5.0V */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0); ++ regmap_field_write(chg->rfield[MAX77705_VBYPSET], 0); + + /* Switching Frequency : 1.5MHz */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_08, MAX77705_REG_FSW_MASK, +- (MAX77705_CHG_FSW_1_5MHz << MAX77705_REG_FSW_SHIFT)); ++ regmap_field_write(chg->rfield[MAX77705_REG_FSW], MAX77705_CHG_FSW_1_5MHz); + + /* Auto skip mode */ +- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12, MAX77705_REG_DISKIP_MASK, +- (MAX77705_AUTO_SKIP << MAX77705_REG_DISKIP_SHIFT)); ++ regmap_field_write(chg->rfield[MAX77705_REG_DISKIP], MAX77705_AUTO_SKIP); + } + + static int max77705_charger_probe(struct i2c_client *i2c) +@@ -520,6 +485,14 @@ static int max77705_charger_probe(struct i2c_client *i2c) + if (IS_ERR(chg->regmap)) + return PTR_ERR(chg->regmap); + ++ for (int i = 0; i < MAX77705_N_REGMAP_FIELDS; i++) { ++ chg->rfield[i] = devm_regmap_field_alloc(dev, chg->regmap, ++ max77705_reg_field[i]); ++ if (IS_ERR(chg->rfield[i])) ++ return dev_err_probe(dev, PTR_ERR(chg->rfield[i]), ++ "cannot allocate regmap field\n"); ++ } ++ + ret = regmap_update_bits(chg->regmap, + MAX77705_CHG_REG_INT_MASK, + MAX77705_CHGIN_IM, 0); +diff --git a/include/linux/power/max77705_charger.h b/include/linux/power/max77705_charger.h +index fdec9af9c5418..a612795577b62 100644 +--- a/include/linux/power/max77705_charger.h ++++ b/include/linux/power/max77705_charger.h +@@ -9,6 +9,8 @@ + #ifndef __MAX77705_CHARGER_H + #define __MAX77705_CHARGER_H __FILE__ + ++#include ++ + /* MAX77705_CHG_REG_CHG_INT */ + #define MAX77705_BYP_I BIT(0) + #define MAX77705_INP_LIMIT_I BIT(1) +@@ -63,7 +65,6 @@ + #define MAX77705_BUCK_SHIFT 2 + #define MAX77705_BOOST_SHIFT 3 + #define MAX77705_WDTEN_SHIFT 4 +-#define MAX77705_MODE_MASK GENMASK(3, 0) + #define MAX77705_CHG_MASK BIT(MAX77705_CHG_SHIFT) + #define MAX77705_UNO_MASK BIT(MAX77705_UNO_SHIFT) + #define MAX77705_OTG_MASK BIT(MAX77705_OTG_SHIFT) +@@ -74,34 +75,19 @@ + #define MAX77705_OTG_CTRL (MAX77705_OTG_MASK | MAX77705_BOOST_MASK) + + /* MAX77705_CHG_REG_CNFG_01 */ +-#define MAX77705_FCHGTIME_SHIFT 0 +-#define MAX77705_FCHGTIME_MASK GENMASK(2, 0) +-#define MAX77705_CHG_RSTRT_SHIFT 4 +-#define MAX77705_CHG_RSTRT_MASK GENMASK(5, 4) + #define MAX77705_FCHGTIME_DISABLE 0 + #define MAX77705_CHG_RSTRT_DISABLE 0x3 + +-#define MAX77705_PQEN_SHIFT 7 +-#define MAX77705_PQEN_MASK BIT(7) + #define MAX77705_CHG_PQEN_DISABLE 0 + #define MAX77705_CHG_PQEN_ENABLE 1 + + /* MAX77705_CHG_REG_CNFG_02 */ +-#define MAX77705_OTG_ILIM_SHIFT 6 +-#define MAX77705_OTG_ILIM_MASK GENMASK(7, 6) + #define MAX77705_OTG_ILIM_500 0 + #define MAX77705_OTG_ILIM_900 1 + #define MAX77705_OTG_ILIM_1200 2 + #define MAX77705_OTG_ILIM_1500 3 +-#define MAX77705_CHG_CC GENMASK(5, 0) + + /* MAX77705_CHG_REG_CNFG_03 */ +-#define MAX77705_TO_ITH_SHIFT 0 +-#define MAX77705_TO_ITH_MASK GENMASK(2, 0) +-#define MAX77705_TO_TIME_SHIFT 3 +-#define MAX77705_TO_TIME_MASK GENMASK(5, 3) +-#define MAX77705_SYS_TRACK_DIS_SHIFT 7 +-#define MAX77705_SYS_TRACK_DIS_MASK BIT(7) + #define MAX77705_TO_ITH_150MA 0 + #define MAX77705_TO_TIME_30M 3 + #define MAX77705_SYS_TRACK_ENABLE 0 +@@ -110,15 +96,8 @@ + /* MAX77705_CHG_REG_CNFG_04 */ + #define MAX77705_CHG_MINVSYS_SHIFT 6 + #define MAX77705_CHG_MINVSYS_MASK GENMASK(7, 6) +-#define MAX77705_CHG_PRM_SHIFT 0 +-#define MAX77705_CHG_PRM_MASK GENMASK(5, 0) +- +-#define MAX77705_CHG_CV_PRM_SHIFT 0 +-#define MAX77705_CHG_CV_PRM_MASK GENMASK(5, 0) + + /* MAX77705_CHG_REG_CNFG_05 */ +-#define MAX77705_REG_B2SOVRC_SHIFT 0 +-#define MAX77705_REG_B2SOVRC_MASK GENMASK(3, 0) + #define MAX77705_B2SOVRC_DISABLE 0 + #define MAX77705_B2SOVRC_4_5A 6 + #define MAX77705_B2SOVRC_4_8A 8 +@@ -128,9 +107,8 @@ + #define MAX77705_WDTCLR_SHIFT 0 + #define MAX77705_WDTCLR_MASK GENMASK(1, 0) + #define MAX77705_WDTCLR 1 +-#define MAX77705_CHGPROT_MASK GENMASK(3, 2) +-#define MAX77705_CHGPROT_UNLOCKED GENMASK(3, 2) +-#define MAX77705_SLOWEST_LX_SLOPE GENMASK(6, 5) ++#define MAX77705_CHGPROT_UNLOCKED 3 ++#define MAX77705_SLOWEST_LX_SLOPE 3 + + /* MAX77705_CHG_REG_CNFG_07 */ + #define MAX77705_CHG_FMBST 4 +@@ -140,36 +118,14 @@ + #define MAX77705_REG_FGSRC_MASK BIT(MAX77705_REG_FGSRC_SHIFT) + + /* MAX77705_CHG_REG_CNFG_08 */ +-#define MAX77705_REG_FSW_SHIFT 0 +-#define MAX77705_REG_FSW_MASK GENMASK(1, 0) + #define MAX77705_CHG_FSW_3MHz 0 + #define MAX77705_CHG_FSW_2MHz 1 + #define MAX77705_CHG_FSW_1_5MHz 2 + + /* MAX77705_CHG_REG_CNFG_09 */ +-#define MAX77705_CHG_CHGIN_LIM_MASK GENMASK(6, 0) +-#define MAX77705_CHG_EN_MASK BIT(7) + #define MAX77705_CHG_DISABLE 0 +-#define MAX77705_CHARGER_CHG_CHARGING(_reg) \ +- (((_reg) & MAX77705_CHG_EN_MASK) > 1) +- +- +-/* MAX77705_CHG_REG_CNFG_10 */ +-#define MAX77705_CHG_WCIN_LIM GENMASK(5, 0) +- +-/* MAX77705_CHG_REG_CNFG_11 */ +-#define MAX77705_VBYPSET_SHIFT 0 +-#define MAX77705_VBYPSET_MASK GENMASK(6, 0) + + /* MAX77705_CHG_REG_CNFG_12 */ +-#define MAX77705_CHGINSEL_SHIFT 5 +-#define MAX77705_CHGINSEL_MASK BIT(MAX77705_CHGINSEL_SHIFT) +-#define MAX77705_WCINSEL_SHIFT 6 +-#define MAX77705_WCINSEL_MASK BIT(MAX77705_WCINSEL_SHIFT) +-#define MAX77705_VCHGIN_REG_MASK GENMASK(4, 3) +-#define MAX77705_WCIN_REG_MASK GENMASK(2, 1) +-#define MAX77705_REG_DISKIP_SHIFT 0 +-#define MAX77705_REG_DISKIP_MASK BIT(MAX77705_REG_DISKIP_SHIFT) + /* REG=4.5V, UVLO=4.7V */ + #define MAX77705_VCHGIN_4_5 0 + /* REG=4.5V, UVLO=4.7V */ +@@ -183,9 +139,59 @@ + #define MAX77705_CURRENT_CHGIN_MIN 100000 + #define MAX77705_CURRENT_CHGIN_MAX 3200000 + ++enum max77705_field_idx { ++ MAX77705_CHGPROT, ++ MAX77705_CHG_EN, ++ MAX77705_CHG_CC_LIM, ++ MAX77705_CHG_CHGIN_LIM, ++ MAX77705_CHG_CV_PRM, ++ MAX77705_CHG_PQEN, ++ MAX77705_CHG_RSTRT, ++ MAX77705_CHG_WCIN, ++ MAX77705_FCHGTIME, ++ MAX77705_LX_SLOPE, ++ MAX77705_MODE, ++ MAX77705_OTG_ILIM, ++ MAX77705_REG_B2SOVRC, ++ MAX77705_REG_DISKIP, ++ MAX77705_REG_FSW, ++ MAX77705_SYS_TRACK, ++ MAX77705_TO, ++ MAX77705_TO_TIME, ++ MAX77705_VBYPSET, ++ MAX77705_VCHGIN, ++ MAX77705_WCIN, ++ MAX77705_N_REGMAP_FIELDS, ++}; ++ ++static const struct reg_field max77705_reg_field[MAX77705_N_REGMAP_FIELDS] = { ++ [MAX77705_MODE] = REG_FIELD(MAX77705_CHG_REG_CNFG_00, 0, 3), ++ [MAX77705_FCHGTIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 0, 2), ++ [MAX77705_CHG_RSTRT] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 4, 5), ++ [MAX77705_CHG_PQEN] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 7, 7), ++ [MAX77705_CHG_CC_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 0, 5), ++ [MAX77705_OTG_ILIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 6, 7), ++ [MAX77705_TO] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 0, 2), ++ [MAX77705_TO_TIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 3, 5), ++ [MAX77705_SYS_TRACK] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 7, 7), ++ [MAX77705_CHG_CV_PRM] = REG_FIELD(MAX77705_CHG_REG_CNFG_04, 0, 5), ++ [MAX77705_REG_B2SOVRC] = REG_FIELD(MAX77705_CHG_REG_CNFG_05, 0, 3), ++ [MAX77705_CHGPROT] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 2, 3), ++ [MAX77705_LX_SLOPE] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 5, 6), ++ [MAX77705_REG_FSW] = REG_FIELD(MAX77705_CHG_REG_CNFG_08, 0, 1), ++ [MAX77705_CHG_CHGIN_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 0, 6), ++ [MAX77705_CHG_EN] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 7, 7), ++ [MAX77705_CHG_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_10, 0, 5), ++ [MAX77705_VBYPSET] = REG_FIELD(MAX77705_CHG_REG_CNFG_11, 0, 6), ++ [MAX77705_REG_DISKIP] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 0, 0), ++ [MAX77705_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 1, 2), ++ [MAX77705_VCHGIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 3, 4), ++}; ++ + struct max77705_charger_data { + struct device *dev; + struct regmap *regmap; ++ struct regmap_field *rfield[MAX77705_N_REGMAP_FIELDS]; + struct power_supply_battery_info *bat_info; + struct workqueue_struct *wqueue; + struct work_struct chgin_work; +-- +2.51.0 + diff --git a/queue-6.17/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch b/queue-6.17/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch new file mode 100644 index 0000000000..edaf8841d6 --- /dev/null +++ b/queue-6.17/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch @@ -0,0 +1,64 @@ +From 738f2169e016009875c940581adb0c99219b84e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 08:30:18 +0200 +Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs + +From: Christophe Leroy + +[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ] + +Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all +PGDIRs and preallocate execmem page tables") was supposed to extend +to powerpc 603 the copy of kernel PGD entries into all PGDIRs +implemented in a previous patch on the 8xx. But 603 is book3s/32 and +uses a duplicate of pgd_alloc() defined in another header. + +So really do the copy at the correct place for the 603. + +Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++-- + arch/powerpc/include/asm/nohash/pgalloc.h | 2 +- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h +index dd4eb30631758..f4390704d5ba2 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h +@@ -7,8 +7,14 @@ + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { +- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ ++#ifdef CONFIG_PPC_BOOK3S_603 ++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, ++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); ++#endif ++ return pgd; + } + + static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) +diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h +index bb5f3e8ea912d..4ef780b291bc3 100644 +--- a/arch/powerpc/include/asm/nohash/pgalloc.h ++++ b/arch/powerpc/include/asm/nohash/pgalloc.h +@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm) + pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), + pgtable_gfp_flags(mm, GFP_KERNEL)); + +-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603) ++#ifdef CONFIG_PPC_8xx + memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD, + (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); + #endif +-- +2.51.0 + diff --git a/queue-6.17/powerpc-8xx-remove-left-over-instruction-and-comment.patch b/queue-6.17/powerpc-8xx-remove-left-over-instruction-and-comment.patch new file mode 100644 index 0000000000..4aaa2ca1f5 --- /dev/null +++ b/queue-6.17/powerpc-8xx-remove-left-over-instruction-and-comment.patch @@ -0,0 +1,71 @@ +From af5fb7bd21bf977f3ebaafd2399357c6f84d4c0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Aug 2025 18:33:26 +0200 +Subject: powerpc/8xx: Remove left-over instruction and comments in + DataStoreTLBMiss handler + +From: Christophe Leroy + +[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ] + +Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in +DTLB misses") removed the test that needed the valeur in SPRN_EPN but +failed to remove the read. + +Remove it. + +And remove related comments, including the very same comment +in InstructionTLBMiss that should have been removed by +commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in +ITLB misses"). + +Also update the comment about absence of a second level table which +has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx: +remove tests on PGDIR entry validity"). + +Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 56c5ebe21b99a..613606400ee99 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -162,7 +162,7 @@ instruction_counter: + * For the MPC8xx, this is a software tablewalk to load the instruction + * TLB. The task switch loads the M_TWB register with the pointer to the first + * level table. +- * If we discover there is no second level table (value is zero) or if there ++ * If there is no second level table (value is zero) or if there + * is an invalid pte, we load that into the TLB, which causes another fault + * into the TLB Error interrupt where we can handle such problems. + * We have to use the MD_xxx registers for the tablewalk because the +@@ -183,9 +183,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ + mfspr r10, SPRN_SRR0 /* Get effective address of fault */ + INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11) + mtspr SPRN_MD_EPN, r10 +@@ -228,10 +225,6 @@ instruction_counter: + mtspr SPRN_SPRG_SCRATCH2, r10 + mtspr SPRN_M_TW, r11 + +- /* If we are faulting a kernel address, we have to use the +- * kernel page tables. +- */ +- mfspr r10, SPRN_MD_EPN + mfspr r10, SPRN_M_TWB /* Get level 1 table */ + lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */ + +-- +2.51.0 + diff --git a/queue-6.17/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch b/queue-6.17/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch new file mode 100644 index 0000000000..cb80b8422f --- /dev/null +++ b/queue-6.17/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch @@ -0,0 +1,60 @@ +From 25422bef427fc908d3abdc18a65f6b0ecf1ba4ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 10:27:38 -0400 +Subject: powerpc/ftrace: ensure ftrace record ops are always set for NOPs + +From: Joe Lawrence + +[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ] + +When an ftrace call site is converted to a NOP, its corresponding +dyn_ftrace record should have its ftrace_ops pointer set to +ftrace_nop_ops. + +Correct the powerpc implementation to ensure the +ftrace_rec_set_nop_ops() helper is called on all successful NOP +initialization paths. This ensures all ftrace records are consistent +before being handled by the ftrace core. + +Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") +Suggested-by: Naveen N Rao +Signed-off-by: Joe Lawrence +Acked-by: Naveen N Rao (AMD) +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c +index 6dca92d5a6e82..841d077e28251 100644 +--- a/arch/powerpc/kernel/trace/ftrace.c ++++ b/arch/powerpc/kernel/trace/ftrace.c +@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) + return ret; + + /* Set up out-of-line stub */ +- if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) +- return ftrace_init_ool_stub(mod, rec); ++ if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) { ++ ret = ftrace_init_ool_stub(mod, rec); ++ goto out; ++ } + + /* Nop-out the ftrace location */ + new = ppc_inst(PPC_RAW_NOP()); +@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) + return -EINVAL; + } + ++out: ++ if (!ret) ++ ret = ftrace_rec_set_nop_ops(rec); ++ + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch b/queue-6.17/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch new file mode 100644 index 0000000000..f9649b1548 --- /dev/null +++ b/queue-6.17/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch @@ -0,0 +1,43 @@ +From a1bbe423375827ec36cf9662b5b627f8d88b43f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 10:27:39 -0400 +Subject: powerpc64/modules: correctly iterate over stubs in + setup_ftrace_ool_stubs + +From: Joe Lawrence + +[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ] + +CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to +extend the ppc64le module .stubs section with an array of +ftrace_ool_stub structures for each patchable function. + +Fix its ppc64_stub_entry stub reservation loop to properly write across +all of the num_stubs used and not just the first entry. + +Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line") +Signed-off-by: Joe Lawrence +Acked-by: Naveen N Rao (AMD) +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/module_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 126bf3b06ab7e..0e45cac4de76b 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr, + + /* reserve stubs */ + for (i = 0; i < num_stubs; i++) +- if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP())) ++ if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP())) + return -1; + #endif + +-- +2.51.0 + diff --git a/queue-6.17/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.17/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..bb98dbc86f --- /dev/null +++ b/queue-6.17/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From f91a324a2fab5d1e7706db24f12fa924b8262451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index 9463232af8d2e..c6b8b64782761 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-6.17/ptp-add-a-upper-bound-on-max_vclocks.patch b/queue-6.17/ptp-add-a-upper-bound-on-max_vclocks.patch new file mode 100644 index 0000000000..1e45e7ddb8 --- /dev/null +++ b/queue-6.17/ptp-add-a-upper-bound-on-max_vclocks.patch @@ -0,0 +1,58 @@ +From f5750bcfb0fb3cb846adf6d4768df269723ab79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 21:29:08 +0530 +Subject: ptp: Add a upper bound on max_vclocks + +From: I Viswanath + +[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ] + +syzbot reported WARNING in max_vclocks_store. + +This occurs when the argument max is too large for kcalloc to handle. + +Extend the guard to guard against values that are too large for +kcalloc + +Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df +Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com +Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") +Signed-off-by: I Viswanath +Acked-by: Richard Cochran +Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_private.h | 1 + + drivers/ptp/ptp_sysfs.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index b352df4cd3f97..f329263f33aa1 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -22,6 +22,7 @@ + #define PTP_MAX_TIMESTAMPS 128 + #define PTP_BUF_TIMESTAMPS 30 + #define PTP_DEFAULT_MAX_VCLOCKS 20 ++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int))) + #define PTP_MAX_CHANNELS 2048 + + enum { +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index 6b1b8f57cd951..200eaf5006968 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev, + size_t size; + u32 max; + +- if (kstrtou32(buf, 0, &max) || max == 0) ++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT) + return -EINVAL; + + if (max == ptp->max_vclocks) +-- +2.51.0 + diff --git a/queue-6.17/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch b/queue-6.17/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch new file mode 100644 index 0000000000..f4d13566eb --- /dev/null +++ b/queue-6.17/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch @@ -0,0 +1,49 @@ +From 509ca4cb0a2af7d08f285836f094449745fa42ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:00:59 +0200 +Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ] + +The pwm driver calls pm_runtime_get_sync() when the hardware becomes +enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's +state is kept when a consumer goes away, so the call to +pm_runtime_put_sync() in the .free() callback is unbalanced resulting in +a non-functional device and a reference underlow for the second consumer. + +The easiest fix for that issue is to just not drop the runtime PM +reference in .free(), so do that. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 0125e73b98dfb..5e674a7bbf3be 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- if (pwm_is_enabled(pwm)) { +- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n"); +- pm_runtime_put_sync(pwmchip_parent(chip)); +- } +- + /* set period value to zero on free */ + pc->period_cycles[pwm->hwpwm] = 0; + } +-- +2.51.0 + diff --git a/queue-6.17/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.17/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..afbc5f0a21 --- /dev/null +++ b/queue-6.17/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From 0ef0b064add70dd300da9c86845c3edf863b39c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a23e48b8523db..7a86cb090f76f 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(pwmchip_parent(chip), "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.17/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch b/queue-6.17/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch new file mode 100644 index 0000000000..faf15ab0b6 --- /dev/null +++ b/queue-6.17/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch @@ -0,0 +1,279 @@ +From 7b39ce3c8a2c68fa9c0be7bac2d837c85759b347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:01 +0200 +Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle + calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ] + +In Up-Count Mode the timer is reset to zero one tick after it reaches +TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both +the documentation and measurements. So the value written to the TBPRD has +to be one less than the calculated period_cycles value. + +A complication here is that for a 100% relative duty-cycle the value +written to the CMPx register has to be TBPRD + 1 which might overflow if +TBPRD is 0xffff. To handle that the calculation of the AQCTLx register +has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to +be skipped. + +Additionally the AQCTL_PRD register field has to be 0 because that defines +the hardware's action when the maximal counter value is reached, which is +(as above) one clock tick before the period's end. The period start edge +has to happen when the counter is reset and so is defined in the AQCTL_ZRO +field. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++---------------------- + 1 file changed, 58 insertions(+), 85 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index a94b1e387b924..a23e48b8523db 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -36,7 +36,7 @@ + + #define CLKDIV_MAX 7 + #define HSPCLKDIV_MAX 7 +-#define PERIOD_MAX 0xFFFF ++#define PERIOD_MAX 0x10000 + + /* compare module registers */ + #define CMPA 0x12 +@@ -65,14 +65,10 @@ + #define AQCTL_ZRO_FRCHIGH BIT(1) + #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0)) + +-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) +-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \ +- AQCTL_ZRO_FRCHIGH) +-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \ +- AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW) ++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH) ++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW) + + #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6)) + #define AQSFRC_RLDCSF_ZRO 0 +@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip { + unsigned long clk_rate; + void __iomem *mmio_base; + unsigned long period_cycles[NUM_PWM_CHANNEL]; +- enum pwm_polarity polarity[NUM_PWM_CHANNEL]; + struct clk *tbclk; + struct ehrpwm_context ctx; + }; +@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + return 1; + } + +-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan) +-{ +- u16 aqctl_val, aqctl_mask; +- unsigned int aqctl_reg; +- +- /* +- * Configure PWM output to HIGH/LOW level on counter +- * reaches compare register value and LOW/HIGH level +- * on counter value reaches period register value and +- * zero value on counter +- */ +- if (chan == 1) { +- aqctl_reg = AQCTLB; +- aqctl_mask = AQCTL_CBU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANB_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANB_POLNORMAL; +- } else { +- aqctl_reg = AQCTLA; +- aqctl_mask = AQCTL_CAU_MASK; +- +- if (pc->polarity[chan] == PWM_POLARITY_INVERSED) +- aqctl_val = AQCTL_CHANA_POLINVERSED; +- else +- aqctl_val = AQCTL_CHANA_POLNORMAL; +- } +- +- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; +- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); +-} +- + /* + * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE + * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE + */ + static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, +- u64 duty_ns, u64 period_ns) ++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + u32 period_cycles, duty_cycles; + u16 ps_divval, tb_divval; + unsigned int i, cmp_reg; + unsigned long long c; ++ u16 aqctl_val, aqctl_mask; ++ unsigned int aqctl_reg; + + if (period_ns > NSEC_PER_SEC) + return -ERANGE; +@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + do_div(c, NSEC_PER_SEC); + period_cycles = (unsigned long)c; + +- if (period_cycles < 1) { +- period_cycles = 1; +- duty_cycles = 1; +- } else { +- c = pc->clk_rate; +- c = c * duty_ns; +- do_div(c, NSEC_PER_SEC); +- duty_cycles = (unsigned long)c; +- } ++ c = pc->clk_rate; ++ c = c * duty_ns; ++ do_div(c, NSEC_PER_SEC); ++ duty_cycles = (unsigned long)c; + + /* + * Period values should be same for multiple PWM channels as IP uses +@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + return -EINVAL; + } + +- pm_runtime_get_sync(pwmchip_parent(chip)); +- +- /* Update clock prescaler values */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); +- + /* Update period & duty cycle with presacler division */ + period_cycles = period_cycles / ps_divval; + duty_cycles = duty_cycles / ps_divval; + +- /* Configure shadow loading on Period register */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ if (period_cycles < 1) ++ period_cycles = 1; + +- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles); ++ pm_runtime_get_sync(pwmchip_parent(chip)); + +- /* Configure ehrpwm counter for up-count mode */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, +- TBCTL_CTRMODE_UP); ++ /* Update clock prescaler values */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval); + +- if (pwm->hwpwm == 1) ++ if (pwm->hwpwm == 1) { + /* Channel 1 configured with compare B register */ + cmp_reg = CMPB; +- else ++ ++ aqctl_reg = AQCTLB; ++ aqctl_mask = AQCTL_CBU_MASK; ++ ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANB_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANB_POLNORMAL; ++ ++ /* if duty_cycle is big, don't toggle on CBU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CBU_MASK; ++ ++ } else { + /* Channel 0 configured with compare A register */ + cmp_reg = CMPA; + +- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); ++ aqctl_reg = AQCTLA; ++ aqctl_mask = AQCTL_CAU_MASK; + +- pm_runtime_put_sync(pwmchip_parent(chip)); ++ if (polarity == PWM_POLARITY_INVERSED) ++ aqctl_val = AQCTL_CHANA_POLINVERSED; ++ else ++ aqctl_val = AQCTL_CHANA_POLNORMAL; + +- return 0; +-} ++ /* if duty_cycle is big, don't toggle on CAU */ ++ if (duty_cycles > period_cycles) ++ aqctl_val &= ~AQCTL_CAU_MASK; ++ } + +-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip, +- struct pwm_device *pwm, +- enum pwm_polarity polarity) +-{ +- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); ++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK; ++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val); ++ ++ /* Configure shadow loading on Period register */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW); ++ ++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1); ++ ++ /* Configure ehrpwm counter for up-count mode */ ++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK, ++ TBCTL_CTRMODE_UP); ++ ++ if (!(duty_cycles > period_cycles)) ++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles); + +- /* Configuration of polarity in hardware delayed, do at enable */ +- pc->polarity[pwm->hwpwm] = polarity; ++ pm_runtime_put_sync(pwmchip_parent(chip)); + + return 0; + } +@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + + ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); + +- /* Channels polarity can be configured from action qualifier module */ +- configure_polarity(pc, pwm->hwpwm); +- + /* Enable TBCLK */ + ret = clk_enable(pc->tbclk); + if (ret) { +@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + ehrpwm_pwm_disable(chip, pwm); + enabled = false; + } +- +- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity); +- if (err) +- return err; + } + + if (!state->enabled) { +@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + return 0; + } + +- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period); ++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity); + if (err) + return err; + +-- +2.51.0 + diff --git a/queue-6.17/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch b/queue-6.17/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch new file mode 100644 index 0000000000..6b53dc8bb0 --- /dev/null +++ b/queue-6.17/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch @@ -0,0 +1,40 @@ +From a30f84664d8a6ad0ab3549ae8836edf0933c8203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:00 +0200 +Subject: pwm: tiehrpwm: Make code comment in .free() more useful +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ] + +Instead of explaining trivia to everyone who can read C describe the +higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero. + +Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 5e674a7bbf3be..a94b1e387b924 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip); + +- /* set period value to zero on free */ ++ /* Don't let a pwm without consumer block requests to the other channel */ + pc->period_cycles[pwm->hwpwm] = 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/raid6-riscv-clean-up-unused-header-file-inclusion.patch b/queue-6.17/raid6-riscv-clean-up-unused-header-file-inclusion.patch new file mode 100644 index 0000000000..4b7cf38a98 --- /dev/null +++ b/queue-6.17/raid6-riscv-clean-up-unused-header-file-inclusion.patch @@ -0,0 +1,57 @@ +From 1dfedd2023fe88c7553eabf94d38498caeecd723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jul 2025 15:27:07 +0800 +Subject: raid6: riscv: Clean up unused header file inclusion + +From: Chunyan Zhang + +[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ] + +These two C files don't reference things defined in simd.h or types.h +so remove these redundant #inclusions. + +Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations") +Reviewed-by: Alexandre Ghiti +Signed-off-by: Chunyan Zhang +Reviewed-by: Nutty Liu +Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + lib/raid6/recov_rvv.c | 2 -- + lib/raid6/rvv.c | 3 --- + 2 files changed, 5 deletions(-) + +diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c +index 5d54c4b437df7..5f779719c3d34 100644 +--- a/lib/raid6/recov_rvv.c ++++ b/lib/raid6/recov_rvv.c +@@ -4,9 +4,7 @@ + * Author: Chunyan Zhang + */ + +-#include + #include +-#include + #include + + static int rvv_has_vector(void) +diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c +index 7d82efa5b14f9..b193ea176d5d3 100644 +--- a/lib/raid6/rvv.c ++++ b/lib/raid6/rvv.c +@@ -9,11 +9,8 @@ + * Copyright 2002-2004 H. Peter Anvin + */ + +-#include + #include +-#include + #include +-#include + #include "rvv.h" + + #define NSIZE (riscv_v_vsize / 32) /* NSIZE = vlenb */ +-- +2.51.0 + diff --git a/queue-6.17/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.17/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..38828cfb5f --- /dev/null +++ b/queue-6.17/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From f8c4b894fa491673bcc11cad34f7884ab495aedc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 92678e438ff4d..01bede8ba1055 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1049,8 +1049,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-6.17/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.17/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..bedc0f6c25 --- /dev/null +++ b/queue-6.17/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From d8117e07ff25e8438ce3ebd1481f4fee395542e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index be0743dac3fff..929e89841c12a 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch b/queue-6.17/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch new file mode 100644 index 0000000000..7240d30da9 --- /dev/null +++ b/queue-6.17/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch @@ -0,0 +1,115 @@ +From 506053b2535c083a1b0016b724ddae0d60f78d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:39:56 +0300 +Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Or Har-Toov + +[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ] + +The mlx5 driver currently derives max_qp_wr directly from the +log_max_qp_sz HCA capability: + + props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); + +However, this value represents the number of WQEs in units of Basic +Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size +of a WQE can vary depending on transport type and features (e.g., atomic +operations, UMR, LSO), the actual number of WQEs can be significantly +smaller than the WQEBB count suggests. + +This patch introduces a conservative estimation of the worst-case WQE size +— considering largest segments possible with 1 SGE and no inline data or +special features. It uses this to derive a more accurate max_qp_wr value. + +Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling") +Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org +Reported-by: Chuck Lever +Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/ +Signed-off-by: Or Har-Toov +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++- + 1 file changed, 47 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index d456e4fde3e1f..20d15207a5f1f 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -883,6 +884,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev, + resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask(); + } + ++/* ++ * Calculate maximum SQ overhead across all QP types. ++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT) ++ * have smaller overhead than the types calculated below, ++ * so they are implicitly included. ++ */ ++static u32 mlx5_ib_calc_max_sq_overhead(void) ++{ ++ u32 max_overhead_xrc, overhead_ud_lso, a, b; ++ ++ /* XRC_INI */ ++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg); ++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg); ++ a = sizeof(struct mlx5_wqe_atomic_seg) + ++ sizeof(struct mlx5_wqe_raddr_seg); ++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) + ++ sizeof(struct mlx5_mkey_seg) + ++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD; ++ max_overhead_xrc += max(a, b); ++ ++ /* UD with LSO */ ++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg); ++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg); ++ ++ return max(max_overhead_xrc, overhead_ud_lso); ++} ++ ++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev) ++{ ++ struct mlx5_core_dev *mdev = dev->mdev; ++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ u32 max_wqe_size; ++ /* max QP overhead + 1 SGE, no inline, no special features */ ++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() + ++ sizeof(struct mlx5_wqe_data_seg); ++ ++ max_wqe_size = roundup_pow_of_two(max_wqe_size); ++ ++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB); ++ ++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size; ++} ++ + static int mlx5_ib_query_device(struct ib_device *ibdev, + struct ib_device_attr *props, + struct ib_udata *uhw) +@@ -1041,7 +1087,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, + props->max_mr_size = ~0ull; + props->page_size_cap = ~(min_page_size - 1); + props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp); +- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); ++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev); + max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) / + sizeof(struct mlx5_wqe_data_seg); + max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512); +-- +2.51.0 + diff --git a/queue-6.17/rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-m.patch b/queue-6.17/rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-m.patch new file mode 100644 index 0000000000..66c5f17135 --- /dev/null +++ b/queue-6.17/rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-m.patch @@ -0,0 +1,48 @@ +From 806c2e67e154ad0fe7a36cd1dddae9b5982828e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 17:48:39 +0300 +Subject: RDMA/mlx5: Fix page size bitmap calculation for KSM mode + +From: Edward Srouji + +[ Upstream commit 372fdb5c75b61f038f4abf596abdcf01acbdb7af ] + +When using KSM (Key Scatter-gather Memory) access mode, the HW requires +the IOVA to be aligned to the selected page size. +Without this alignment, the HW may not function correctly. + +Currently, mlx5_umem_mkc_find_best_pgsz() does not filter out page sizes +that would result in misaligned IOVAs for KSM mode. This can lead to +selecting page sizes that are incompatible with the given IOVA. + +Fix this by filtering the page size bitmap when in KSM mode, keeping +only page sizes to which the IOVA is aligned to. + +Fixes: fcfb03597b7d ("RDMA/mlx5: Align mkc page size capability check to PRM") +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250824144839.154717-1-edwards@nvidia.com +Reviewed-by: Michael Guralnik +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 8d21ecf8a996f..15e3962633dc3 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1803,6 +1803,10 @@ mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem, + + bitmap = GENMASK_ULL(max_log_entity_size_cap, min_log_entity_size_cap); + ++ /* In KSM mode HW requires IOVA and mkey's page size to be aligned */ ++ if (access_mode == MLX5_MKC_ACCESS_MODE_KSM && iova) ++ bitmap &= GENMASK_ULL(__ffs64(iova), 0); ++ + return ib_umem_find_best_pgsz(umem, bitmap, iova); + } + +-- +2.51.0 + diff --git a/queue-6.17/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/queue-6.17/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch new file mode 100644 index 0000000000..f1de70a893 --- /dev/null +++ b/queue-6.17/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch @@ -0,0 +1,117 @@ +From f1d830ff001b842b92d69cf3a6b934dfc860d934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:41:19 +0300 +Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device + +From: Patrisious Haddad + +[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ] + +Previously loopback for MPV was supposed to be permanently enabled, +however other driver flows were able to over-ride that configuration and +disable it. + +Add force_lb parameter that indicates that loopback should always be +enabled which prevents all other driver flows from disabling it. + +Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") +Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++---- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 20d15207a5f1f..5fabd39b7492a 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1839,7 +1839,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + } + + static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + int err; + +@@ -1851,6 +1852,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + if (err) + goto out; + ++ lb_state->force_enable = true; + return 0; + + out: +@@ -1859,16 +1861,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + } + + static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + mlx5_nic_vport_update_local_lb(slave, false); + mlx5_nic_vport_update_local_lb(master, false); ++ ++ lb_state->force_enable = false; + } + + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; + ++ if (dev->lb.force_enable) ++ return 0; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td++; +@@ -1890,6 +1898,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + + void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { ++ if (dev->lb.force_enable) ++ return; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td--; +@@ -3569,7 +3580,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + +- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + + mlx5_core_mp_event_replay(ibdev->mdev, + MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, +@@ -3666,7 +3677,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + MLX5_DRIVER_EVENT_AFFILIATION_DONE, + &key); + +- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + if (err) + goto unbind; + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 7ffc7ee92cf03..8d21ecf8a996f 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1109,6 +1109,7 @@ struct mlx5_ib_lb_state { + u32 user_td; + int qps; + bool enabled; ++ bool force_enable; + }; + + struct mlx5_ib_pf_eq { +-- +2.51.0 + diff --git a/queue-6.17/rdma-rxe-fix-race-in-do_task-when-draining.patch b/queue-6.17/rdma-rxe-fix-race-in-do_task-when-draining.patch new file mode 100644 index 0000000000..5846863349 --- /dev/null +++ b/queue-6.17/rdma-rxe-fix-race-in-do_task-when-draining.patch @@ -0,0 +1,62 @@ +From 706031767a5b0c49932986020a5609b1016fb24a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 02:52:12 +0000 +Subject: RDMA/rxe: Fix race in do_task() when draining + +From: Gui-Dong Han + +[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ] + +When do_task() exhausts its iteration budget (!ret), it sets the state +to TASK_STATE_IDLE to reschedule, without a secondary check on the +current task->state. This can overwrite the TASK_STATE_DRAINING state +set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). + +While state changes are protected by a spinlock, both rxe_cleanup_task() +and rxe_disable_task() release the lock while waiting for the task to +finish draining in the while(!is_done(task)) loop. The race occurs if +do_task() hits its iteration limit and acquires the lock in this window. +The cleanup logic may then proceed while the task incorrectly +reschedules itself, leading to a potential use-after-free. + +This bug was introduced during the migration from tasklets to workqueues, +where the special handling for the draining case was lost. + +Fix this by restoring the original pre-migration behavior. If the state is +TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to +force a new loop iteration. This allows the task to finish its work, so +that a subsequent iteration can reach the switch statement and correctly +transition the state to TASK_STATE_DRAINED, stopping the task as intended. + +Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks") +Reviewed-by: Zhu Yanjun +Signed-off-by: Gui-Dong Han +Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 6f8f353e95838..f522820b950c7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) + * yield the cpu and reschedule the task + */ + if (!ret) { +- task->state = TASK_STATE_IDLE; +- resched = 1; ++ if (task->state != TASK_STATE_DRAINING) { ++ task->state = TASK_STATE_IDLE; ++ resched = 1; ++ } else { ++ cont = 1; ++ } + goto exit; + } + +-- +2.51.0 + diff --git a/queue-6.17/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.17/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..f990cf4af9 --- /dev/null +++ b/queue-6.17/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From a8f06f506819a5b78b0735456fcb0c0067877578 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 35c3bde0d00af..efa2f097b5828 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.17/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..9b520618e6 --- /dev/null +++ b/queue-6.17/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From 303eb732681a6558325190d0ef11b64738c8edd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1f3f782a04ba2..6883e1a43fe5d 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +-- +2.51.0 + diff --git a/queue-6.17/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.17/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..3405bf61b1 --- /dev/null +++ b/queue-6.17/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 6ef67f69c98ca3227921edffd5a4ebeab8238222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 9df726f10ad12..6d609c42e4793 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-6.17/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch b/queue-6.17/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch new file mode 100644 index 0000000000..897e47b387 --- /dev/null +++ b/queue-6.17/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch @@ -0,0 +1,86 @@ +From 1887f6be4e5fcb052e7c845d6af8f1393c305468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:35 +0200 +Subject: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E + +From: Stephan Gerhold + +[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ] + +The ADSP firmware on X1E has separate firmware binaries for the main +firmware and the DTB. The same applies for the "lite" firmware loaded by +the boot firmware. + +When preparing to load the new ADSP firmware we shutdown the lite_pas_id +for the main firmware, but we don't shutdown the corresponding lite pas_id +for the DTB. The fact that we're leaving it "running" forever becomes +obvious if you try to reuse (or just access) the memory region used by the +"lite" firmware: The &adsp_boot_mem is accessible, but accessing the +&adsp_boot_dtb_mem results in a crash. + +We don't support reusing the memory regions currently, but nevertheless we +should not keep part of the lite firmware running. Fix this by adding the +lite_dtb_pas_id and shutting it down as well. + +We don't have a way to detect if the lite firmware is actually running yet, +so ignore the return status of qcom_scm_pas_shutdown() for now. This was +already the case before, the assignment to "ret" is not used anywhere. + +Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 02e29171cbbee..f3ec5b06261e8 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -42,6 +42,7 @@ struct qcom_pas_data { + int pas_id; + int dtb_pas_id; + int lite_pas_id; ++ int lite_dtb_pas_id; + unsigned int minidump_id; + bool auto_boot; + bool decrypt_shutdown; +@@ -80,6 +81,7 @@ struct qcom_pas { + int pas_id; + int dtb_pas_id; + int lite_pas_id; ++ int lite_dtb_pas_id; + unsigned int minidump_id; + int crash_reason_smem; + unsigned int smem_host_id; +@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw) + + if (pas->lite_pas_id) + ret = qcom_scm_pas_shutdown(pas->lite_pas_id); ++ if (pas->lite_dtb_pas_id) ++ qcom_scm_pas_shutdown(pas->lite_dtb_pas_id); + + if (pas->dtb_pas_id) { + ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev); +@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev) + pas->minidump_id = desc->minidump_id; + pas->pas_id = desc->pas_id; + pas->lite_pas_id = desc->lite_pas_id; ++ pas->lite_dtb_pas_id = desc->lite_dtb_pas_id; + pas->info_name = desc->sysmon_name; + pas->smem_host_id = desc->smem_host_id; + pas->decrypt_shutdown = desc->decrypt_shutdown; +@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = { + .pas_id = 1, + .dtb_pas_id = 0x24, + .lite_pas_id = 0x1f, ++ .lite_dtb_pas_id = 0x29, + .minidump_id = 5, + .auto_boot = true, + .proxy_pd_names = (char*[]){ +-- +2.51.0 + diff --git a/queue-6.17/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.17/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..11a75cb6b4 --- /dev/null +++ b/queue-6.17/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From 8cd7d44b5bd4d2a90bdb7b1c8a0161f4f63d59c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 4ee5e67a9f03f..769c6d6d6a731 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-6.17/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch b/queue-6.17/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch new file mode 100644 index 0000000000..4c3c462f58 --- /dev/null +++ b/queue-6.17/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch @@ -0,0 +1,57 @@ +From 0d4aeb79a04d401346b1424ec5c7c81ffba1041e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jul 2025 17:47:08 +0300 +Subject: remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 + +From: Dmitry Baryshkov + +[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ] + +On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw +MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was +specified as the firmware image. + +Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss # msm8974pro-fairphone-fp2 +Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com +[bjorn: Unwrapped the long memcpy line, to taste] +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index 0c0199fb0e68d..3087d895b87f4 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region) + release_firmware(dp_fw); + } + ++#define MSM8974_B00_OFFSET 0x1000 ++ + static int q6v5_load(struct rproc *rproc, const struct firmware *fw) + { + struct q6v5 *qproc = rproc->priv; +@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw) + return -EBUSY; + } + +- memcpy(mba_region, fw->data, fw->size); ++ if ((qproc->version == MSS_MSM8974 || ++ qproc->version == MSS_MSM8226 || ++ qproc->version == MSS_MSM8926) && ++ fw->size > MSM8974_B00_OFFSET && ++ !memcmp(fw->data, ELFMAG, SELFMAG)) ++ memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET); ++ else ++ memcpy(mba_region, fw->data, fw->size); + q6v5_debug_policy_load(qproc, mba_region); + memunmap(mba_region); + +-- +2.51.0 + diff --git a/queue-6.17/revert-arm64-dts-ti-k3-j721e-beagleboneai64-fix-reve.patch b/queue-6.17/revert-arm64-dts-ti-k3-j721e-beagleboneai64-fix-reve.patch new file mode 100644 index 0000000000..6504417c12 --- /dev/null +++ b/queue-6.17/revert-arm64-dts-ti-k3-j721e-beagleboneai64-fix-reve.patch @@ -0,0 +1,63 @@ +From 65b6f76861c511a52b694b6a1c12295897b09e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 19:58:14 +0530 +Subject: Revert "arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x + carveout locations" + +From: Beleswar Padhi + +[ Upstream commit 932424a925ce79cbed0a93d36c5f1b69a0128de1 ] + +This reverts commit 1a314099b7559690fe23cdf3300dfff6e830ecb1. + +The C6x carveouts are reversed intentionally. This is due to the +requirement to keep the DMA memory region as non-cached, however the +minimum granular cache region for C6x is 16MB. So, C66x_0 marks the +entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA +memory region of C66x_1 as its own, and vice-versa. + +This was also called out in the original commit which introduced these +reversed carveouts: + "The minimum granularity on the Cache settings on C66x DSP + cores is 16MB, so the DMA memory regions are chosen such that + they are in separate 16MB regions for each DSP, while reserving + a total of 16 MB for each DSP and not changing the overall DSP + remoteproc carveouts." + +Fixes: 1a314099b755 ("arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations") +Signed-off-by: Beleswar Padhi +Acked-by: Andrew Davis +Link: https://patch.msgid.link/20250908142826.1828676-23-b-padhi@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts +index 6a1b32169678e..bb771ce823ec1 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts +@@ -123,7 +123,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 { + no-map; + }; + +- c66_0_dma_memory_region: memory@a6000000 { ++ /* Carveout locations are flipped due to caching */ ++ c66_1_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; +@@ -135,7 +136,8 @@ c66_0_memory_region: memory@a6100000 { + no-map; + }; + +- c66_1_dma_memory_region: memory@a7000000 { ++ /* Carveout locations are flipped due to caching */ ++ c66_0_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; +-- +2.51.0 + diff --git a/queue-6.17/revert-arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-car.patch b/queue-6.17/revert-arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-car.patch new file mode 100644 index 0000000000..dbb8af01d0 --- /dev/null +++ b/queue-6.17/revert-arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-car.patch @@ -0,0 +1,63 @@ +From 929118aec001e85abe65dd207c1de8c504ae1feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 19:58:13 +0530 +Subject: Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout + locations" + +From: Beleswar Padhi + +[ Upstream commit 79a1778c7819c8491cdbdc1f7e46d478cb84d5cf ] + +This reverts commit 9f3814a7c06b7c7296cf8c1622078ad71820454b. + +The C6x carveouts are reversed intentionally. This is due to the +requirement to keep the DMA memory region as non-cached, however the +minimum granular cache region for C6x is 16MB. So, C66x_0 marks the +entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA +memory region of C66x_1 as its own, and vice-versa. + +This was also called out in the original commit which introduced these +reversed carveouts: + "The minimum granularity on the Cache settings on C66x DSP cores + is 16MB, so the DMA memory regions are chosen such that they are + in separate 16MB regions for each DSP, while reserving a total + of 16 MB for each DSP and not changing the overall DSP + remoteproc carveouts." + +Fixes: 9f3814a7c06b ("arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations") +Signed-off-by: Beleswar Padhi +Acked-by: Andrew Davis +Link: https://patch.msgid.link/20250908142826.1828676-22-b-padhi@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +index d1b0257048de2..488c5ebe9e272 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +@@ -120,7 +120,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 { + no-map; + }; + +- c66_0_dma_memory_region: memory@a6000000 { ++ /* Carveout locations are flipped due to caching */ ++ c66_1_dma_memory_region: memory@a6000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa6000000 0x00 0x100000>; + no-map; +@@ -132,7 +133,8 @@ c66_0_memory_region: memory@a6100000 { + no-map; + }; + +- c66_1_dma_memory_region: memory@a7000000 { ++ /* Carveout locations are flipped due to caching */ ++ c66_0_dma_memory_region: memory@a7000000 { + compatible = "shared-dma-pool"; + reg = <0x00 0xa7000000 0x00 0x100000>; + no-map; +-- +2.51.0 + diff --git a/queue-6.17/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.17/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..82c86e48e9 --- /dev/null +++ b/queue-6.17/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From e6b6bf3530e1f981abff85db35b22b189c001b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 66d276a1be836..f4a19ffbb641c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 15eded36b872a..21bb88c5d3dce 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -49,7 +49,6 @@ + #include "en.h" + #include "en/dim.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -3041,11 +3040,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -3055,18 +3052,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.17/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..33dc865d30 --- /dev/null +++ b/queue-6.17/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From 85d6aa5daba3f5b1e3a1e2d7b8074df9824a380b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 4f8f5aab109d0..6309200e93dc3 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +-- +2.51.0 + diff --git a/queue-6.17/risc-v-kvm-write-hgatp-register-with-valid-mode-bits.patch b/queue-6.17/risc-v-kvm-write-hgatp-register-with-valid-mode-bits.patch new file mode 100644 index 0000000000..ae83f08628 --- /dev/null +++ b/queue-6.17/risc-v-kvm-write-hgatp-register-with-valid-mode-bits.patch @@ -0,0 +1,52 @@ +From d5da05cb392568cd7317126190d22fed65b0b88b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 10:25:40 -0400 +Subject: RISC-V: KVM: Write hgatp register with valid mode bits + +From: Fangyu Yu + +[ Upstream commit 2b351e3d04be9e1533f26c3464f1e44a5beace30 ] + +According to the RISC-V Privileged Architecture Spec, when MODE=Bare +is selected,software must write zero to the remaining fields of hgatp. + +We have detected the valid mode supported by the HW before, So using a +valid mode to detect how many vmid bits are supported. + +Fixes: fd7bb4a251df ("RISC-V: KVM: Implement VMID allocator") +Reviewed-by: Nutty Liu +Reviewed-by: Troy Mitchell +Reviewed-by: Guo Ren (Alibaba DAMO Academy) +Signed-off-by: Fangyu Yu +Signed-off-by: Guo Ren (Alibaba DAMO Academy) +Link: https://lore.kernel.org/r/20250821142542.2472079-2-guoren@kernel.org +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +--- + arch/riscv/kvm/vmid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/kvm/vmid.c b/arch/riscv/kvm/vmid.c +index 3b426c800480c..5f33625f40706 100644 +--- a/arch/riscv/kvm/vmid.c ++++ b/arch/riscv/kvm/vmid.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -28,7 +29,7 @@ void __init kvm_riscv_gstage_vmid_detect(void) + + /* Figure-out number of VMID bits in HW */ + old = csr_read(CSR_HGATP); +- csr_write(CSR_HGATP, old | HGATP_VMID); ++ csr_write(CSR_HGATP, (kvm_riscv_gstage_mode << HGATP_MODE_SHIFT) | HGATP_VMID); + vmid_bits = csr_read(CSR_HGATP); + vmid_bits = (vmid_bits & HGATP_VMID) >> HGATP_VMID_SHIFT; + vmid_bits = fls_long(vmid_bits); +-- +2.51.0 + diff --git a/queue-6.17/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch b/queue-6.17/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch new file mode 100644 index 0000000000..94a7290c73 --- /dev/null +++ b/queue-6.17/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch @@ -0,0 +1,139 @@ +From 400f0bd9481b2cafc87eb737ffd08b600aaee1a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 01:24:48 +0000 +Subject: riscv, bpf: Sign extend struct ops return values properly + +From: Hengqi Chen + +[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ] + +The ns_bpf_qdisc selftest triggers a kernel panic: + + Unable to handle kernel paging request at virtual address ffffffffa38dbf58 + Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 + [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 + Oops [#1] + Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] + CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE + Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE + Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 + epc : __qdisc_run+0x82/0x6f0 + ra : __qdisc_run+0x6e/0x6f0 + epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 + gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 + t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 + s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 + a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 + a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 + s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 + s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 + s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 + s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 + t5 : 0000000000000000 t6 : ff60000093a6a8b6 + status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d + [] __qdisc_run+0x82/0x6f0 + [] __dev_queue_xmit+0x4c0/0x1128 + [] neigh_resolve_output+0xd0/0x170 + [] ip6_finish_output2+0x226/0x6c8 + [] ip6_finish_output+0x10c/0x2a0 + [] ip6_output+0x5e/0x178 + [] ip6_xmit+0x29a/0x608 + [] inet6_csk_xmit+0xe6/0x140 + [] __tcp_transmit_skb+0x45c/0xaa8 + [] tcp_connect+0x9ce/0xd10 + [] tcp_v6_connect+0x4ac/0x5e8 + [] __inet_stream_connect+0xd8/0x318 + [] inet_stream_connect+0x3e/0x68 + [] __sys_connect_file+0x50/0x88 + [] __sys_connect+0x96/0xc8 + [] __riscv_sys_connect+0x20/0x30 + [] do_trap_ecall_u+0x256/0x378 + [] handle_exception+0x14a/0x156 + Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 + ---[ end trace 0000000000000000 ]--- + +The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer +is treated as a 32bit value and sign extend to 64bit in epilogue. This +behavior is right for most bpf prog types but wrong for struct ops which +requires RISC-V ABI. + +So let's sign extend struct ops return values according to the function +model and RISC-V ABI([0]). + + [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf + +Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") +Signed-off-by: Hengqi Chen +Signed-off-by: Daniel Borkmann +Tested-by: Pu Lehui +Reviewed-by: Pu Lehui +Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com +Signed-off-by: Sasha Levin +--- + arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c +index 9883a55d61b5b..f1efa4d6b27f3 100644 +--- a/arch/riscv/net/bpf_jit_comp64.c ++++ b/arch/riscv/net/bpf_jit_comp64.c +@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn, + return 0; + } + ++/* ++ * Sign-extend the register if necessary ++ */ ++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) ++{ ++ if (!sign && (sz == 1 || sz == 2)) { ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ return 0; ++ } ++ ++ switch (sz) { ++ case 1: ++ emit_sextb(rd, rs, ctx); ++ break; ++ case 2: ++ emit_sexth(rd, rs, ctx); ++ break; ++ case 4: ++ emit_sextw(rd, rs, ctx); ++ break; ++ case 8: ++ if (rd != rs) ++ emit_mv(rd, rs, ctx); ++ break; ++ default: ++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) + #define BPF_FIXUP_REG_MASK GENMASK(31, 27) + #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */ +@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); + + if (save_ret) { +- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); + emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); ++ if (is_struct_ops) { ++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, ++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); ++ if (ret) ++ goto out; ++ } else { ++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); ++ } + } + + emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); +-- +2.51.0 + diff --git a/queue-6.17/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch b/queue-6.17/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch new file mode 100644 index 0000000000..fc70d3e63c --- /dev/null +++ b/queue-6.17/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch @@ -0,0 +1,45 @@ +From 80ab5f12e52cd46dda4a1d5d66a599ab09d6f0ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 22:02:58 +0200 +Subject: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ] + +mbox_request_channel() returning value was changed in case of error. +It uses returning value of of_parse_phandle_with_args(). +It is returning with -ENOENT instead of -ENODEV when no mboxes property +exists. + +Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Stephan Gerhold +Tested-by: Stephan Gerhold # msm8939 +Signed-off-by: Barnabás Czémán +Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index 87c944d4b4f31..1cbe457b4e96f 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev, + edge->mbox_client.knows_txdone = true; + edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0); + if (IS_ERR(edge->mbox_chan)) { +- if (PTR_ERR(edge->mbox_chan) != -ENODEV) { ++ if (PTR_ERR(edge->mbox_chan) != -ENOENT) { + ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan), + "failed to acquire IPC mailbox\n"); + goto put_node; +-- +2.51.0 + diff --git a/queue-6.17/rust-cpumask-mark-cpumaskvar-as-transparent.patch b/queue-6.17/rust-cpumask-mark-cpumaskvar-as-transparent.patch new file mode 100644 index 0000000000..5af8a79f4f --- /dev/null +++ b/queue-6.17/rust-cpumask-mark-cpumaskvar-as-transparent.patch @@ -0,0 +1,38 @@ +From beee5dcc9c827d87ec9c555d06864d9a2493d56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 16:42:11 +0200 +Subject: rust: cpumask: Mark CpumaskVar as transparent + +From: Baptiste Lepers + +[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ] + +Unsafe code in CpumaskVar's methods assumes that the type has the same +layout as `bindings::cpumask_var_t`. This is not guaranteed by +the default struct representation in Rust, but requires specifying the +`transparent` representation. + +Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions") +Signed-off-by: Baptiste Lepers +Reviewed-by: Alice Ryhl +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + rust/kernel/cpumask.rs | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs +index 3fcbff4386705..05e1c882404e4 100644 +--- a/rust/kernel/cpumask.rs ++++ b/rust/kernel/cpumask.rs +@@ -212,6 +212,7 @@ impl Cpumask { + /// } + /// assert_eq!(mask2.weight(), count); + /// ``` ++#[repr(transparent)] + pub struct CpumaskVar { + #[cfg(CONFIG_CPUMASK_OFFSTACK)] + ptr: NonNull, +-- +2.51.0 + diff --git a/queue-6.17/s390-bpf-do-not-write-tail-call-counter-into-helper-.patch b/queue-6.17/s390-bpf-do-not-write-tail-call-counter-into-helper-.patch new file mode 100644 index 0000000000..dc443db17e --- /dev/null +++ b/queue-6.17/s390-bpf-do-not-write-tail-call-counter-into-helper-.patch @@ -0,0 +1,59 @@ +From 4ab96e2b1e4125dbb4a5b9636c4e6eb1dbb5ba95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:28 +0200 +Subject: s390/bpf: Do not write tail call counter into helper and kfunc frames + +From: Ilya Leoshkevich + +[ Upstream commit eada40e057fc1842358d9daca3abe5cacb21e8a1 ] + +Only BPF functions make use of the tail call counter; helpers and +kfuncs ignore and most likely also clobber it. Writing it into these +functions' frames is pointless and misleading, so do not do it. + +Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-2-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index bb17efe29d657..bfac1ddf3447b 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1790,6 +1790,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + + REG_SET_SEEN(BPF_REG_5); + jit->seen |= SEEN_FUNC; ++ + /* + * Copy the tail call counter to where the callee expects it. + * +@@ -1800,10 +1801,17 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + * Note 2: We assume that the verifier does not let us call the + * main program, which clears the tail call counter on entry. + */ +- /* mvc tail_call_cnt(4,%r15),frame_off+tail_call_cnt(%r15) */ +- _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt), +- 0xf000 | (jit->frame_off + +- offsetof(struct prog_frame, tail_call_cnt))); ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc tail_call_cnt(4,%r15), ++ * frame_off+tail_call_cnt(%r15) ++ */ ++ _EMIT6(0xd203f000 | offsetof(struct prog_frame, ++ tail_call_cnt), ++ 0xf000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt))); + + /* Sign-extend the kfunc arguments. */ + if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { +-- +2.51.0 + diff --git a/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch b/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch new file mode 100644 index 0000000000..ea8944879b --- /dev/null +++ b/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch @@ -0,0 +1,77 @@ +From 3f0e29c3616064333c42b8acf6c39522cc733534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:29 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL + +From: Ilya Leoshkevich + +[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ] + +The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is +as follows: + + entry() + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + +entry() copies its tail call counter to the subprog_tail()'s frame, +which then increments it. However, the incremented result is discarded, +leading to an astronomically large number of tail calls. + +Fix by writing the incremented counter back to the entry()'s frame. + +Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index bfac1ddf3447b..ccb83ac3e6f32 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1793,13 +1793,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + + /* + * Copy the tail call counter to where the callee expects it. +- * +- * Note 1: The callee can increment the tail call counter, but +- * we do not load it back, since the x86 JIT does not do this +- * either. +- * +- * Note 2: We assume that the verifier does not let us call the +- * main program, which clears the tail call counter on entry. + */ + + if (insn->src_reg == BPF_PSEUDO_CALL) +@@ -1833,6 +1826,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + call_r1(jit); + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); ++ ++ /* ++ * Copy the potentially updated tail call counter back. ++ */ ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc frame_off+tail_call_cnt(%r15), ++ * tail_call_cnt(4,%r15) ++ */ ++ _EMIT6(0xd203f000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt)), ++ 0xf000 | offsetof(struct prog_frame, ++ tail_call_cnt)); ++ + break; + } + case BPF_JMP | BPF_TAIL_CALL: { +-- +2.51.0 + diff --git a/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch b/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch new file mode 100644 index 0000000000..2aea190e5e --- /dev/null +++ b/queue-6.17/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch @@ -0,0 +1,52 @@ +From fc3f6661f3d74f43156fc56a3e0bea3e9d7283ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:30 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG + +From: Ilya Leoshkevich + +[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ] + +The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call +graph is as follows: + + entry() + subprog_tail() + trampoline() + fentry() + the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG + return to entry() + +The problem is that the rest of subprog_tail() increments the tail call +counter, but the trampoline discards the incremented value. This +results in an astronomically large number of tail calls. + +Fix by making the trampoline write the incremented tail call counter +back. + +Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index ccb83ac3e6f32..b2b8eb62b82e0 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -2839,6 +2839,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r2,retval_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, + tjit->retval_off); ++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ ++ _EMIT6(0xd203f000 | tjit->tccnt_off, ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + + im->ip_after_call = jit->prg_buf + jit->prg; + +-- +2.51.0 + diff --git a/queue-6.17/sched-fair-get-rid-of-sched_domains_curr_level-hack-.patch b/queue-6.17/sched-fair-get-rid-of-sched_domains_curr_level-hack-.patch new file mode 100644 index 0000000000..99f819cdc0 --- /dev/null +++ b/queue-6.17/sched-fair-get-rid-of-sched_domains_curr_level-hack-.patch @@ -0,0 +1,485 @@ +From b41ddedb18a039d2e0b3d6b010d6257f2f82709c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 12:02:44 +0000 +Subject: sched/fair: Get rid of sched_domains_curr_level hack for + tl->cpumask() + +From: Peter Zijlstra + +[ Upstream commit 661f951e371cc134ea31c84238dbdc9a898b8403 ] + +Leon [1] and Vinicius [2] noted a topology_span_sane() warning during +their testing starting from v6.16-rc1. Debug that followed pointed to +the tl->mask() for the NODE domain being incorrectly resolved to that of +the highest NUMA domain. + +tl->mask() for NODE is set to the sd_numa_mask() which depends on the +global "sched_domains_curr_level" hack. "sched_domains_curr_level" is +set to the "tl->numa_level" during tl traversal in build_sched_domains() +calling sd_init() but was not reset before topology_span_sane(). + +Since "tl->numa_level" still reflected the old value from +build_sched_domains(), topology_span_sane() for the NODE domain trips +when the span of the last NUMA domain overlaps. + +Instead of replicating the "sched_domains_curr_level" hack, get rid of +it entirely and instead, pass the entire "sched_domain_topology_level" +object to tl->cpumask() function to prevent such mishap in the future. + +sd_numa_mask() now directly references "tl->numa_level" instead of +relying on the global "sched_domains_curr_level" hack to index into +sched_domains_numa_masks[]. + +The original warning was reproducible on the following NUMA topology +reported by Leon: + + $ sudo numactl -H + available: 5 nodes (0-4) + node 0 cpus: 0 1 + node 0 size: 2927 MB + node 0 free: 1603 MB + node 1 cpus: 2 3 + node 1 size: 3023 MB + node 1 free: 3008 MB + node 2 cpus: 4 5 + node 2 size: 3023 MB + node 2 free: 3007 MB + node 3 cpus: 6 7 + node 3 size: 3023 MB + node 3 free: 3002 MB + node 4 cpus: 8 9 + node 4 size: 3022 MB + node 4 free: 2718 MB + node distances: + node 0 1 2 3 4 + 0: 10 39 38 37 36 + 1: 39 10 38 37 36 + 2: 38 38 10 37 36 + 3: 37 37 37 10 36 + 4: 36 36 36 36 10 + +The above topology can be mimicked using the following QEMU cmd that was +used to reproduce the warning and test the fix: + + sudo qemu-system-x86_64 -enable-kvm -cpu host \ + -m 20G -smp cpus=10,sockets=10 -machine q35 \ + -object memory-backend-ram,size=4G,id=m0 \ + -object memory-backend-ram,size=4G,id=m1 \ + -object memory-backend-ram,size=4G,id=m2 \ + -object memory-backend-ram,size=4G,id=m3 \ + -object memory-backend-ram,size=4G,id=m4 \ + -numa node,cpus=0-1,memdev=m0,nodeid=0 \ + -numa node,cpus=2-3,memdev=m1,nodeid=1 \ + -numa node,cpus=4-5,memdev=m2,nodeid=2 \ + -numa node,cpus=6-7,memdev=m3,nodeid=3 \ + -numa node,cpus=8-9,memdev=m4,nodeid=4 \ + -numa dist,src=0,dst=1,val=39 \ + -numa dist,src=0,dst=2,val=38 \ + -numa dist,src=0,dst=3,val=37 \ + -numa dist,src=0,dst=4,val=36 \ + -numa dist,src=1,dst=0,val=39 \ + -numa dist,src=1,dst=2,val=38 \ + -numa dist,src=1,dst=3,val=37 \ + -numa dist,src=1,dst=4,val=36 \ + -numa dist,src=2,dst=0,val=38 \ + -numa dist,src=2,dst=1,val=38 \ + -numa dist,src=2,dst=3,val=37 \ + -numa dist,src=2,dst=4,val=36 \ + -numa dist,src=3,dst=0,val=37 \ + -numa dist,src=3,dst=1,val=37 \ + -numa dist,src=3,dst=2,val=37 \ + -numa dist,src=3,dst=4,val=36 \ + -numa dist,src=4,dst=0,val=36 \ + -numa dist,src=4,dst=1,val=36 \ + -numa dist,src=4,dst=2,val=36 \ + -numa dist,src=4,dst=3,val=36 \ + ... + + [ prateek: Moved common functions to include/linux/sched/topology.h, + reuse the common bits for s390 and ppc, commit message ] + +Closes: https://lore.kernel.org/lkml/20250610110701.GA256154@unreal/ [1] +Fixes: ccf74128d66c ("sched/topology: Assert non-NUMA topology masks don't (partially) overlap") # ce29a7da84cd, f55dac1dafb3 +Signed-off-by: Peter Zijlstra (Intel) +Reported-by: Leon Romanovsky +Signed-off-by: K Prateek Nayak +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Reviewed-by: Shrikanth Hegde +Tested-by: Valentin Schneider # x86 +Tested-by: Shrikanth Hegde # powerpc +Link: https://lore.kernel.org/lkml/a3de98387abad28592e6ab591f3ff6107fe01dc1.1755893468.git.tim.c.chen@linux.intel.com/ [2] +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig | 4 ++++ + arch/powerpc/include/asm/topology.h | 2 ++ + arch/powerpc/kernel/smp.c | 27 +++++++++++---------------- + arch/s390/kernel/topology.c | 20 +++++++------------- + arch/x86/kernel/smpboot.c | 8 ++++---- + include/linux/sched/topology.h | 28 +++++++++++++++++++++++++++- + include/linux/topology.h | 2 +- + kernel/sched/topology.c | 28 ++++++++++------------------ + 8 files changed, 66 insertions(+), 53 deletions(-) + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 93402a1d9c9fc..e51a595a06228 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -971,6 +971,10 @@ config SCHED_SMT + when dealing with POWER5 cpus at a cost of slightly increased + overhead in some places. If unsure say N here. + ++config SCHED_MC ++ def_bool y ++ depends on SMP ++ + config PPC_DENORMALISATION + bool "PowerPC denormalisation exception handling" + depends on PPC_BOOK3S_64 +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index da15b5efe8071..f19ca44512d1e 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -131,6 +131,8 @@ static inline int cpu_to_coregroup_id(int cpu) + #ifdef CONFIG_SMP + #include + ++struct cpumask *cpu_coregroup_mask(int cpu); ++ + #ifdef CONFIG_PPC64 + #include + +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index f59e4b9cc2074..68edb66c2964b 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -1028,19 +1028,19 @@ static int powerpc_shared_proc_flags(void) + * We can't just pass cpu_l2_cache_mask() directly because + * returns a non-const pointer and the compiler barfs on that. + */ +-static const struct cpumask *shared_cache_mask(int cpu) ++static const struct cpumask *tl_cache_mask(struct sched_domain_topology_level *tl, int cpu) + { + return per_cpu(cpu_l2_cache_map, cpu); + } + + #ifdef CONFIG_SCHED_SMT +-static const struct cpumask *smallcore_smt_mask(int cpu) ++static const struct cpumask *tl_smallcore_smt_mask(struct sched_domain_topology_level *tl, int cpu) + { + return cpu_smallcore_mask(cpu); + } + #endif + +-static struct cpumask *cpu_coregroup_mask(int cpu) ++struct cpumask *cpu_coregroup_mask(int cpu) + { + return per_cpu(cpu_coregroup_map, cpu); + } +@@ -1054,11 +1054,6 @@ static bool has_coregroup_support(void) + return coregroup_enabled; + } + +-static const struct cpumask *cpu_mc_mask(int cpu) +-{ +- return cpu_coregroup_mask(cpu); +-} +- + static int __init init_big_cores(void) + { + int cpu; +@@ -1448,7 +1443,7 @@ static bool update_mask_by_l2(int cpu, cpumask_var_t *mask) + return false; + } + +- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu)); ++ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu)); + + /* Update l2-cache mask with all the CPUs that are part of submask */ + or_cpumasks_related(cpu, cpu, submask_fn, cpu_l2_cache_mask); +@@ -1538,7 +1533,7 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask) + return; + } + +- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu)); ++ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu)); + + /* Update coregroup mask with all the CPUs that are part of submask */ + or_cpumasks_related(cpu, cpu, submask_fn, cpu_coregroup_mask); +@@ -1601,7 +1596,7 @@ static void add_cpu_to_masks(int cpu) + + /* If chip_id is -1; limit the cpu_core_mask to within PKG */ + if (chip_id == -1) +- cpumask_and(mask, mask, cpu_cpu_mask(cpu)); ++ cpumask_and(mask, mask, cpu_node_mask(cpu)); + + for_each_cpu(i, mask) { + if (chip_id == cpu_to_chip_id(i)) { +@@ -1701,22 +1696,22 @@ static void __init build_sched_topology(void) + if (has_big_cores) { + pr_info("Big cores detected but using small core scheduling\n"); + powerpc_topology[i++] = +- SDTL_INIT(smallcore_smt_mask, powerpc_smt_flags, SMT); ++ SDTL_INIT(tl_smallcore_smt_mask, powerpc_smt_flags, SMT); + } else { +- powerpc_topology[i++] = SDTL_INIT(cpu_smt_mask, powerpc_smt_flags, SMT); ++ powerpc_topology[i++] = SDTL_INIT(tl_smt_mask, powerpc_smt_flags, SMT); + } + #endif + if (shared_caches) { + powerpc_topology[i++] = +- SDTL_INIT(shared_cache_mask, powerpc_shared_cache_flags, CACHE); ++ SDTL_INIT(tl_cache_mask, powerpc_shared_cache_flags, CACHE); + } + + if (has_coregroup_support()) { + powerpc_topology[i++] = +- SDTL_INIT(cpu_mc_mask, powerpc_shared_proc_flags, MC); ++ SDTL_INIT(tl_mc_mask, powerpc_shared_proc_flags, MC); + } + +- powerpc_topology[i++] = SDTL_INIT(cpu_cpu_mask, powerpc_shared_proc_flags, PKG); ++ powerpc_topology[i++] = SDTL_INIT(tl_pkg_mask, powerpc_shared_proc_flags, PKG); + + /* There must be one trailing NULL entry left. */ + BUG_ON(i >= ARRAY_SIZE(powerpc_topology) - 1); +diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c +index 46569b8e47dde..1594c80e9bc4d 100644 +--- a/arch/s390/kernel/topology.c ++++ b/arch/s390/kernel/topology.c +@@ -509,33 +509,27 @@ int topology_cpu_init(struct cpu *cpu) + return rc; + } + +-static const struct cpumask *cpu_thread_mask(int cpu) +-{ +- return &cpu_topology[cpu].thread_mask; +-} +- +- + const struct cpumask *cpu_coregroup_mask(int cpu) + { + return &cpu_topology[cpu].core_mask; + } + +-static const struct cpumask *cpu_book_mask(int cpu) ++static const struct cpumask *tl_book_mask(struct sched_domain_topology_level *tl, int cpu) + { + return &cpu_topology[cpu].book_mask; + } + +-static const struct cpumask *cpu_drawer_mask(int cpu) ++static const struct cpumask *tl_drawer_mask(struct sched_domain_topology_level *tl, int cpu) + { + return &cpu_topology[cpu].drawer_mask; + } + + static struct sched_domain_topology_level s390_topology[] = { +- SDTL_INIT(cpu_thread_mask, cpu_smt_flags, SMT), +- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC), +- SDTL_INIT(cpu_book_mask, NULL, BOOK), +- SDTL_INIT(cpu_drawer_mask, NULL, DRAWER), +- SDTL_INIT(cpu_cpu_mask, NULL, PKG), ++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT), ++ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC), ++ SDTL_INIT(tl_book_mask, NULL, BOOK), ++ SDTL_INIT(tl_drawer_mask, NULL, DRAWER), ++ SDTL_INIT(tl_pkg_mask, NULL, PKG), + { NULL, }, + }; + +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 33e166f6ab122..eb289abece237 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -479,14 +479,14 @@ static int x86_cluster_flags(void) + static bool x86_has_numa_in_package; + + static struct sched_domain_topology_level x86_topology[] = { +- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT), ++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT), + #ifdef CONFIG_SCHED_CLUSTER +- SDTL_INIT(cpu_clustergroup_mask, x86_cluster_flags, CLS), ++ SDTL_INIT(tl_cls_mask, x86_cluster_flags, CLS), + #endif + #ifdef CONFIG_SCHED_MC +- SDTL_INIT(cpu_coregroup_mask, x86_core_flags, MC), ++ SDTL_INIT(tl_mc_mask, x86_core_flags, MC), + #endif +- SDTL_INIT(cpu_cpu_mask, x86_sched_itmt_flags, PKG), ++ SDTL_INIT(tl_pkg_mask, x86_sched_itmt_flags, PKG), + { NULL }, + }; + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index 5263746b63e8c..a3a24e115d446 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -30,11 +30,19 @@ struct sd_flag_debug { + }; + extern const struct sd_flag_debug sd_flag_debug[]; + ++struct sched_domain_topology_level; ++ + #ifdef CONFIG_SCHED_SMT + static inline int cpu_smt_flags(void) + { + return SD_SHARE_CPUCAPACITY | SD_SHARE_LLC; + } ++ ++static inline const ++struct cpumask *tl_smt_mask(struct sched_domain_topology_level *tl, int cpu) ++{ ++ return cpu_smt_mask(cpu); ++} + #endif + + #ifdef CONFIG_SCHED_CLUSTER +@@ -42,6 +50,12 @@ static inline int cpu_cluster_flags(void) + { + return SD_CLUSTER | SD_SHARE_LLC; + } ++ ++static inline const ++struct cpumask *tl_cls_mask(struct sched_domain_topology_level *tl, int cpu) ++{ ++ return cpu_clustergroup_mask(cpu); ++} + #endif + + #ifdef CONFIG_SCHED_MC +@@ -49,8 +63,20 @@ static inline int cpu_core_flags(void) + { + return SD_SHARE_LLC; + } ++ ++static inline const ++struct cpumask *tl_mc_mask(struct sched_domain_topology_level *tl, int cpu) ++{ ++ return cpu_coregroup_mask(cpu); ++} + #endif + ++static inline const ++struct cpumask *tl_pkg_mask(struct sched_domain_topology_level *tl, int cpu) ++{ ++ return cpu_node_mask(cpu); ++} ++ + #ifdef CONFIG_NUMA + static inline int cpu_numa_flags(void) + { +@@ -172,7 +198,7 @@ bool cpus_equal_capacity(int this_cpu, int that_cpu); + bool cpus_share_cache(int this_cpu, int that_cpu); + bool cpus_share_resources(int this_cpu, int that_cpu); + +-typedef const struct cpumask *(*sched_domain_mask_f)(int cpu); ++typedef const struct cpumask *(*sched_domain_mask_f)(struct sched_domain_topology_level *tl, int cpu); + typedef int (*sched_domain_flags_f)(void); + + struct sd_data { +diff --git a/include/linux/topology.h b/include/linux/topology.h +index 33b7fda97d390..6575af39fd10f 100644 +--- a/include/linux/topology.h ++++ b/include/linux/topology.h +@@ -260,7 +260,7 @@ static inline bool topology_is_primary_thread(unsigned int cpu) + + #endif + +-static inline const struct cpumask *cpu_cpu_mask(int cpu) ++static inline const struct cpumask *cpu_node_mask(int cpu) + { + return cpumask_of_node(cpu_to_node(cpu)); + } +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6e2f54169e66c..36d4f9f063516 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1591,7 +1591,6 @@ static void claim_allocations(int cpu, struct sched_domain *sd) + enum numa_topology_type sched_numa_topology_type; + + static int sched_domains_numa_levels; +-static int sched_domains_curr_level; + + int sched_max_numa_distance; + static int *sched_domains_numa_distance; +@@ -1632,14 +1631,7 @@ sd_init(struct sched_domain_topology_level *tl, + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; + +-#ifdef CONFIG_NUMA +- /* +- * Ugly hack to pass state to sd_numa_mask()... +- */ +- sched_domains_curr_level = tl->numa_level; +-#endif +- +- sd_weight = cpumask_weight(tl->mask(cpu)); ++ sd_weight = cpumask_weight(tl->mask(tl, cpu)); + + if (tl->sd_flags) + sd_flags = (*tl->sd_flags)(); +@@ -1677,7 +1669,7 @@ sd_init(struct sched_domain_topology_level *tl, + }; + + sd_span = sched_domain_span(sd); +- cpumask_and(sd_span, cpu_map, tl->mask(cpu)); ++ cpumask_and(sd_span, cpu_map, tl->mask(tl, cpu)); + sd_id = cpumask_first(sd_span); + + sd->flags |= asym_cpu_capacity_classify(sd_span, cpu_map); +@@ -1737,17 +1729,17 @@ sd_init(struct sched_domain_topology_level *tl, + */ + static struct sched_domain_topology_level default_topology[] = { + #ifdef CONFIG_SCHED_SMT +- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT), ++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT), + #endif + + #ifdef CONFIG_SCHED_CLUSTER +- SDTL_INIT(cpu_clustergroup_mask, cpu_cluster_flags, CLS), ++ SDTL_INIT(tl_cls_mask, cpu_cluster_flags, CLS), + #endif + + #ifdef CONFIG_SCHED_MC +- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC), ++ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC), + #endif +- SDTL_INIT(cpu_cpu_mask, NULL, PKG), ++ SDTL_INIT(tl_pkg_mask, NULL, PKG), + { NULL, }, + }; + +@@ -1769,9 +1761,9 @@ void __init set_sched_topology(struct sched_domain_topology_level *tl) + + #ifdef CONFIG_NUMA + +-static const struct cpumask *sd_numa_mask(int cpu) ++static const struct cpumask *sd_numa_mask(struct sched_domain_topology_level *tl, int cpu) + { +- return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)]; ++ return sched_domains_numa_masks[tl->numa_level][cpu_to_node(cpu)]; + } + + static void sched_numa_warn(const char *str) +@@ -2413,7 +2405,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map) + * breaks the linking done for an earlier span. + */ + for_each_cpu(cpu, cpu_map) { +- const struct cpumask *tl_cpu_mask = tl->mask(cpu); ++ const struct cpumask *tl_cpu_mask = tl->mask(tl, cpu); + int id; + + /* lowest bit set in this mask is used as a unique id */ +@@ -2421,7 +2413,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map) + + if (cpumask_test_cpu(id, id_seen)) { + /* First CPU has already been seen, ensure identical spans */ +- if (!cpumask_equal(tl->mask(id), tl_cpu_mask)) ++ if (!cpumask_equal(tl->mask(tl, id), tl_cpu_mask)) + return false; + } else { + /* First CPU hasn't been seen before, ensure it's a completely new span */ +-- +2.51.0 + diff --git a/queue-6.17/scripts-misc-check-update-export-checks-for-export_s.patch b/queue-6.17/scripts-misc-check-update-export-checks-for-export_s.patch new file mode 100644 index 0000000000..7779c79e45 --- /dev/null +++ b/queue-6.17/scripts-misc-check-update-export-checks-for-export_s.patch @@ -0,0 +1,49 @@ +From a865160638ed4bd2c8b39002efb724fa1e138e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 17:00:37 +0200 +Subject: scripts/misc-check: update export checks for + EXPORT_SYMBOL_FOR_MODULES() + +From: Vlastimil Babka + +[ Upstream commit 0354e81b7bd629f9c3379c9524e988ebc504fa25 ] + +The module export checks are looking for EXPORT_SYMBOL_GPL_FOR_MODULES() +which was renamed to EXPORT_SYMBOL_FOR_MODULES(). Update the checks. + +Fixes: 6d3c3ca4c77e ("module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES") +Signed-off-by: Vlastimil Babka +Reviewed-by: Daniel Gomez +Reviewed-by: Nicolas Schier +Link: https://lore.kernel.org/r/20250825-export_modules_fix-v1-1-5c331e949538@suse.cz +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + scripts/misc-check | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/misc-check b/scripts/misc-check +index 84f08da17b2c0..40e5a4b01ff47 100755 +--- a/scripts/misc-check ++++ b/scripts/misc-check +@@ -45,7 +45,7 @@ check_tracked_ignored_files () { + # does not automatically fix it. + check_missing_include_linux_export_h () { + +- git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' \ ++ git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' \ + -- '*.[ch]' :^tools/ :^include/linux/export.h | + xargs -r git -C "${srctree:-.}" grep --files-without-match '#include[[:space:]]*' | + xargs -r printf "%s: warning: EXPORT_SYMBOL() is used, but #include is missing\n" >&2 +@@ -58,7 +58,7 @@ check_unnecessary_include_linux_export_h () { + + git -C "${srctree:-.}" grep --files-with-matches '#include[[:space:]]*' \ + -- '*.[c]' :^tools/ | +- xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' | ++ xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' | + xargs -r printf "%s: warning: EXPORT_SYMBOL() is not used, but #include is present\n" >&2 + } + +-- +2.51.0 + diff --git a/queue-6.17/scsi-libsas-add-dev_parent_is_expander-helper.patch b/queue-6.17/scsi-libsas-add-dev_parent_is_expander-helper.patch new file mode 100644 index 0000000000..000753027c --- /dev/null +++ b/queue-6.17/scsi-libsas-add-dev_parent_is_expander-helper.patch @@ -0,0 +1,64 @@ +From b49b661c0c2fb4150cad61dba9d8fd510067f67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:18 +0200 +Subject: scsi: libsas: Add dev_parent_is_expander() helper + +From: Niklas Cassel + +[ Upstream commit e5eb72c92eb724aa14c50c7d92d1a576dd50d7e6 ] + +Many libsas drivers check if the parent of the device is an expander. +Create a helper that the libsas drivers will use in follow up commits. + +Suggested-by: Damien Le Moal +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-15-cassel@kernel.org +Reviewed-by: Damien Le Moal +Reviewed-by: John Garry +Reviewed-by: Jason Yan +Signed-off-by: Martin K. Petersen +Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander") +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 5 +---- + include/scsi/libsas.h | 8 ++++++++ + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 869b5d4db44cb..d953225f6cc24 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -1313,10 +1313,7 @@ static int sas_check_parent_topology(struct domain_device *child) + int i; + int res = 0; + +- if (!child->parent) +- return 0; +- +- if (!dev_is_expander(child->parent->dev_type)) ++ if (!dev_parent_is_expander(child)) + return 0; + + parent_ex = &child->parent->ex_dev; +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index ba460b6c0374d..8d38565e99fa1 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -203,6 +203,14 @@ static inline bool dev_is_expander(enum sas_device_type type) + type == SAS_FANOUT_EXPANDER_DEVICE; + } + ++static inline bool dev_parent_is_expander(struct domain_device *dev) ++{ ++ if (!dev->parent) ++ return false; ++ ++ return dev_is_expander(dev->parent->dev_type); ++} ++ + static inline void INIT_SAS_WORK(struct sas_work *sw, void (*fn)(struct work_struct *)) + { + INIT_WORK(&sw->work, fn); +-- +2.51.0 + diff --git a/queue-6.17/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.17/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..371bd4012c --- /dev/null +++ b/queue-6.17/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From c4ac4ed59482f7e301bbd6740b714863a9c18958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index dc74ebc6405ac..66fd301f03b0d 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-6.17/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.17/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..b2dfab0037 --- /dev/null +++ b/queue-6.17/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From f99fec551fc73a93a3341b2dca336d41e72a6f7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index 95af3bb03834c..a58abd796603b 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-6.17/scsi-pm80xx-add-helper-function-to-get-the-local-phy.patch b/queue-6.17/scsi-pm80xx-add-helper-function-to-get-the-local-phy.patch new file mode 100644 index 0000000000..94cfb5d359 --- /dev/null +++ b/queue-6.17/scsi-pm80xx-add-helper-function-to-get-the-local-phy.patch @@ -0,0 +1,97 @@ +From 865c5b7d216c9b107ed3d925592679ca3fc0cc11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:23 +0200 +Subject: scsi: pm80xx: Add helper function to get the local phy id + +From: Niklas Cassel + +[ Upstream commit b4ec98303f9fc9b1da0053106716db6a7e002d8b ] + +Avoid duplicated code by adding a helper to get the local phy id. + +No functional changes intended. + +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-20-cassel@kernel.org +Reviewed-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander") +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 7 +++---- + drivers/scsi/pm8001/pm8001_sas.c | 10 ++++++++++ + drivers/scsi/pm8001/pm8001_sas.h | 1 + + drivers/scsi/pm8001/pm80xx_hwi.c | 6 ++---- + 4 files changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index fb4913547b00f..8005995a317c1 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4184,10 +4184,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + dev_is_expander(pm8001_dev->dev_type)) + stp_sspsmp_sata = 0x01; /*ssp or smp*/ + } +- if (dev_parent_is_expander(dev)) +- phy_id = dev->parent->ex_dev.ex_phy->phy_id; +- else +- phy_id = pm8001_dev->attached_phy; ++ ++ phy_id = pm80xx_get_local_phy_id(dev); ++ + opc = OPC_INB_REG_DEV; + linkrate = (pm8001_dev->sas_device->linkrate < dev->port->linkrate) ? + pm8001_dev->sas_device->linkrate : dev->port->linkrate; +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 2bdeace6c6bfe..5595913eb7fc1 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -130,6 +130,16 @@ static void pm80xx_get_tag_opcodes(struct sas_task *task, int *ata_op, + } + } + ++u32 pm80xx_get_local_phy_id(struct domain_device *dev) ++{ ++ struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ ++ if (dev_parent_is_expander(dev)) ++ return dev->parent->ex_dev.ex_phy->phy_id; ++ ++ return pm8001_dev->attached_phy; ++} ++ + void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha, + struct pm8001_device *target_pm8001_dev) + { +diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h +index 334485bb2c12d..91b2cdf3535cd 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.h ++++ b/drivers/scsi/pm8001/pm8001_sas.h +@@ -798,6 +798,7 @@ void pm8001_setds_completion(struct domain_device *dev); + void pm8001_tmf_aborted(struct sas_task *task); + void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha, + struct pm8001_device *dev); ++u32 pm80xx_get_local_phy_id(struct domain_device *dev); + + #endif + +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 546d0d26f7a17..31960b72c1e92 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -4797,10 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + dev_is_expander(pm8001_dev->dev_type)) + stp_sspsmp_sata = 0x01; /*ssp or smp*/ + } +- if (dev_parent_is_expander(dev)) +- phy_id = dev->parent->ex_dev.ex_phy->phy_id; +- else +- phy_id = pm8001_dev->attached_phy; ++ ++ phy_id = pm80xx_get_local_phy_id(dev); + + opc = OPC_INB_REG_DEV; + +-- +2.51.0 + diff --git a/queue-6.17/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.17/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..9383a15287 --- /dev/null +++ b/queue-6.17/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From 02b880b288204da564ef0dce4051458f06863e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 753c09363cbbc..3e1dac4b820fe 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-6.17/scsi-pm80xx-fix-pm8001_abort_task-for-chip_8006-when.patch b/queue-6.17/scsi-pm80xx-fix-pm8001_abort_task-for-chip_8006-when.patch new file mode 100644 index 0000000000..b55b179892 --- /dev/null +++ b/queue-6.17/scsi-pm80xx-fix-pm8001_abort_task-for-chip_8006-when.patch @@ -0,0 +1,69 @@ +From ad7bd44ac0a20351295a705db5164fed4cff0740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:24 +0200 +Subject: scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an + expander + +From: Niklas Cassel + +[ Upstream commit ad70c6bc776b53e61c8db6533c833aff0ff5da8b ] + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. + +Thus, you cannot use attached_phy to index the pm8001_ha->phy array, +without first verifying that the device is directly attached. + +Use the pm80xx_get_local_phy_id() helper to make sure that we use the +local phy id to index the array, regardless if the device is directly +attached or not. + +Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org +Reviewed-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 5595913eb7fc1..c5354263b45e8 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -1063,7 +1063,7 @@ int pm8001_abort_task(struct sas_task *task) + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev; + int rc = TMF_RESP_FUNC_FAILED, ret; +- u32 phy_id, port_id; ++ u32 port_id; + struct sas_task_slow slow_task; + + if (!task->lldd_task || !task->dev) +@@ -1072,7 +1072,6 @@ int pm8001_abort_task(struct sas_task *task) + dev = task->dev; + pm8001_dev = dev->lldd_dev; + pm8001_ha = pm8001_find_ha_by_dev(dev); +- phy_id = pm8001_dev->attached_phy; + + if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) { + // If the controller is seeing fatal errors +@@ -1104,7 +1103,8 @@ int pm8001_abort_task(struct sas_task *task) + if (pm8001_ha->chip_id == chip_8006) { + DECLARE_COMPLETION_ONSTACK(completion_reset); + DECLARE_COMPLETION_ONSTACK(completion); +- struct pm8001_phy *phy = pm8001_ha->phy + phy_id; ++ u32 phy_id = pm80xx_get_local_phy_id(dev); ++ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id]; + port_id = phy->port->port_id; + + /* 1. Set Device state as Recovery */ +-- +2.51.0 + diff --git a/queue-6.17/scsi-pm80xx-restore-support-for-expanders.patch b/queue-6.17/scsi-pm80xx-restore-support-for-expanders.patch new file mode 100644 index 0000000000..777808bd82 --- /dev/null +++ b/queue-6.17/scsi-pm80xx-restore-support-for-expanders.patch @@ -0,0 +1,59 @@ +From e4a679a4fc55d0caf179b9b6db114d089b25f7bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:16 +0200 +Subject: scsi: pm80xx: Restore support for expanders + +From: Niklas Cassel + +[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ] + +Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke +support for expanders. After the commit, devices behind an expander are +no longer detected. + +Simply reverting the commit restores support for devices behind an +expander. + +Instead of reverting the commit (and reintroducing a helper to get the +port), get the port directly from the lldd_port pointer in struct +asd_sas_port. + +Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") +Suggested-by: Igor Pylypiv +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index f7067878b34f3..753c09363cbbc 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags) + struct pm8001_device *pm8001_dev = dev->lldd_dev; + bool internal_abort = sas_is_internal_abort(task); + struct pm8001_hba_info *pm8001_ha; +- struct pm8001_port *port = NULL; ++ struct pm8001_port *port; + struct pm8001_ccb_info *ccb; + unsigned long flags; + u32 n_elem = 0; +@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags) + + spin_lock_irqsave(&pm8001_ha->lock, flags); + +- pm8001_dev = dev->lldd_dev; +- port = pm8001_ha->phy[pm8001_dev->attached_phy].port; ++ port = dev->port->lldd_port; + + if (!internal_abort && + (DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) { +-- +2.51.0 + diff --git a/queue-6.17/scsi-pm80xx-use-dev_parent_is_expander-helper.patch b/queue-6.17/scsi-pm80xx-use-dev_parent_is_expander-helper.patch new file mode 100644 index 0000000000..cb0385b4aa --- /dev/null +++ b/queue-6.17/scsi-pm80xx-use-dev_parent_is_expander-helper.patch @@ -0,0 +1,125 @@ +From 21d26177b66948f88442e9f2e738717d2d942818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:22 +0200 +Subject: scsi: pm80xx: Use dev_parent_is_expander() helper + +From: Niklas Cassel + +[ Upstream commit 35e388696c3f3b6bf70e2010873c5e0c1d37d579 ] + +Make use of the dev_parent_is_expander() helper. + +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-19-cassel@kernel.org +Reviewed-by: Damien Le Moal +Reviewed-by: John Garry +Reviewed-by: Igor Pylypiv +Acked-by: Jack Wang +Signed-off-by: Martin K. Petersen +Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander") +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 8 +++----- + drivers/scsi/pm8001/pm8001_sas.c | 5 ++--- + drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++----- + 3 files changed, 8 insertions(+), 13 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 42a4eeac24c94..fb4913547b00f 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -2163,8 +2163,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb) + /* Print sas address of IO failed device */ + if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) && + (status != IO_UNDERFLOW)) { +- if (!((t->dev->parent) && +- (dev_is_expander(t->dev->parent->dev_type)))) { ++ if (!dev_parent_is_expander(t->dev)) { + for (i = 0, j = 4; j <= 7 && i <= 3; i++, j++) + sata_addr_low[i] = pm8001_ha->sas_addr[j]; + for (i = 0, j = 0; j <= 3 && i <= 3; i++, j++) +@@ -4168,7 +4167,6 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + u16 firstBurstSize = 0; + u16 ITNT = 2000; + struct domain_device *dev = pm8001_dev->sas_device; +- struct domain_device *parent_dev = dev->parent; + struct pm8001_port *port = dev->port->lldd_port; + + memset(&payload, 0, sizeof(payload)); +@@ -4186,8 +4184,8 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + dev_is_expander(pm8001_dev->dev_type)) + stp_sspsmp_sata = 0x01; /*ssp or smp*/ + } +- if (parent_dev && dev_is_expander(parent_dev->dev_type)) +- phy_id = parent_dev->ex_dev.ex_phy->phy_id; ++ if (dev_parent_is_expander(dev)) ++ phy_id = dev->parent->ex_dev.ex_phy->phy_id; + else + phy_id = pm8001_dev->attached_phy; + opc = OPC_INB_REG_DEV; +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 3e1dac4b820fe..2bdeace6c6bfe 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -700,7 +700,7 @@ static int pm8001_dev_found_notify(struct domain_device *dev) + dev->lldd_dev = pm8001_device; + pm8001_device->dev_type = dev->dev_type; + pm8001_device->dcompletion = &completion; +- if (parent_dev && dev_is_expander(parent_dev->dev_type)) { ++ if (dev_parent_is_expander(dev)) { + int phy_id; + + phy_id = sas_find_attached_phy_id(&parent_dev->ex_dev, dev); +@@ -749,7 +749,6 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; +- struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -771,7 +770,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + * The phy array only contains local phys. Thus, we cannot clear + * phy_attached for a device behind an expander. + */ +- if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ if (!dev_parent_is_expander(dev)) + pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index c1bae995a4128..546d0d26f7a17 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -2340,8 +2340,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, + /* Print sas address of IO failed device */ + if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) && + (status != IO_UNDERFLOW)) { +- if (!((t->dev->parent) && +- (dev_is_expander(t->dev->parent->dev_type)))) { ++ if (!dev_parent_is_expander(t->dev)) { + for (i = 0, j = 4; i <= 3 && j <= 7; i++, j++) + sata_addr_low[i] = pm8001_ha->sas_addr[j]; + for (i = 0, j = 0; i <= 3 && j <= 3; i++, j++) +@@ -4780,7 +4779,6 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + u16 firstBurstSize = 0; + u16 ITNT = 2000; + struct domain_device *dev = pm8001_dev->sas_device; +- struct domain_device *parent_dev = dev->parent; + struct pm8001_port *port = dev->port->lldd_port; + + memset(&payload, 0, sizeof(payload)); +@@ -4799,8 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + dev_is_expander(pm8001_dev->dev_type)) + stp_sspsmp_sata = 0x01; /*ssp or smp*/ + } +- if (parent_dev && dev_is_expander(parent_dev->dev_type)) +- phy_id = parent_dev->ex_dev.ex_phy->phy_id; ++ if (dev_parent_is_expander(dev)) ++ phy_id = dev->parent->ex_dev.ex_phy->phy_id; + else + phy_id = pm8001_dev->attached_phy; + +-- +2.51.0 + diff --git a/queue-6.17/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.17/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..20d68c1022 --- /dev/null +++ b/queue-6.17/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From f78286f5fddc4cddf6f08da5485e96453ebdaddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 91bbd3b75bff9..ccd4485087a10 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch b/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch new file mode 100644 index 0000000000..c375d76f2c --- /dev/null +++ b/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch @@ -0,0 +1,39 @@ +From 6e5d56b91951a13a1947234b7b2e664dead29636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:45 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + qla_nvme_xmt_ls_rsp() + +From: Qianfeng Rong + +[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ] + +Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to +align with qla2x00_start_sp() returning negative error codes or +QLA_SUCCESS, preventing logical errors. + +Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 8ee2e337c9e1b..316594aa40cc5 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(PURLS_MSLEEP_INTERVAL); + cnt++; + if (cnt < PURLS_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..6656a3c999 --- /dev/null +++ b/queue-6.17/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From 57e5bf6bb6b9ef9e0846d275c559a304575ff484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index be211ff22acbd..6a2e1c7fd1251 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-6.17/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch b/queue-6.17/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch new file mode 100644 index 0000000000..b0e07a0631 --- /dev/null +++ b/queue-6.17/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch @@ -0,0 +1,130 @@ +From 6759d89fb5aa69879ebcf93ac4d00d86aa44a111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 17:41:43 +0800 +Subject: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling + +From: Zhongqiu Han + +[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ] + +The cpu_latency_qos_add/remove/update_request interfaces lack internal +synchronization by design, requiring the caller to ensure thread safety. +The current implementation relies on the 'pm_qos_enabled' flag, which is +insufficient to prevent concurrent access and cannot serve as a proper +synchronization mechanism. This has led to data races and list +corruption issues. + +A typical race condition call trace is: + +[Thread A] +ufshcd_pm_qos_exit() + --> cpu_latency_qos_remove_request() + --> cpu_latency_qos_apply(); + --> pm_qos_update_target() + --> plist_del <--(1) delete plist node + --> memset(req, 0, sizeof(*req)); + --> hba->pm_qos_enabled = false; + +[Thread B] +ufshcd_devfreq_target + --> ufshcd_devfreq_scale + --> ufshcd_scale_clks + --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true + --> cpu_latency_qos_update_request + --> pm_qos_update_target + --> plist_del <--(3) plist node use-after-free + +Introduces a dedicated mutex to serialize PM QoS operations, preventing +data races and ensuring safe access to PM QoS resources, including sysfs +interface reads. + +Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver") +Signed-off-by: Zhongqiu Han +Reviewed-by: Bart Van Assche +Tested-by: Huan Tang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-sysfs.c | 2 ++ + drivers/ufs/core/ufshcd.c | 9 +++++++++ + include/ufs/ufshcd.h | 3 +++ + 3 files changed, 14 insertions(+) + +diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c +index 4bd7d491e3c5a..0086816b27cd9 100644 +--- a/drivers/ufs/core/ufs-sysfs.c ++++ b/drivers/ufs/core/ufs-sysfs.c +@@ -512,6 +512,8 @@ static ssize_t pm_qos_enable_show(struct device *dev, + { + struct ufs_hba *hba = dev_get_drvdata(dev); + ++ guard(mutex)(&hba->pm_qos_mutex); ++ + return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled); + } + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 9a43102b2b21e..f2b6d1e94f76b 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -1045,6 +1045,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active); + */ + void ufshcd_pm_qos_init(struct ufs_hba *hba) + { ++ guard(mutex)(&hba->pm_qos_mutex); + + if (hba->pm_qos_enabled) + return; +@@ -1061,6 +1062,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba) + */ + void ufshcd_pm_qos_exit(struct ufs_hba *hba) + { ++ guard(mutex)(&hba->pm_qos_mutex); ++ + if (!hba->pm_qos_enabled) + return; + +@@ -1075,6 +1078,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba) + */ + static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on) + { ++ guard(mutex)(&hba->pm_qos_mutex); ++ + if (!hba->pm_qos_enabled) + return; + +@@ -10756,6 +10761,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + mutex_init(&hba->ee_ctrl_mutex); + + mutex_init(&hba->wb_mutex); ++ ++ /* Initialize mutex for PM QoS request synchronization */ ++ mutex_init(&hba->pm_qos_mutex); ++ + init_rwsem(&hba->clk_scaling_lock); + + ufshcd_init_clk_gating(hba); +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 1d39437775842..a3fa98540d184 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr { + * @ufs_rtc_update_work: A work for UFS RTC periodic update + * @pm_qos_req: PM QoS request handle + * @pm_qos_enabled: flag to check if pm qos is enabled ++ * @pm_qos_mutex: synchronizes PM QoS request and status updates + * @critical_health_count: count of critical health exceptions + * @dev_lvl_exception_count: count of device level exceptions since last reset + * @dev_lvl_exception_id: vendor specific information about the +@@ -1136,6 +1137,8 @@ struct ufs_hba { + struct delayed_work ufs_rtc_update_work; + struct pm_qos_request pm_qos_req; + bool pm_qos_enabled; ++ /* synchronizes PM QoS request and status updates */ ++ struct mutex pm_qos_mutex; + + int critical_health_count; + atomic_t dev_lvl_exception_count; +-- +2.51.0 + diff --git a/queue-6.17/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.17/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch new file mode 100644 index 0000000000..16b699da58 --- /dev/null +++ b/queue-6.17/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch @@ -0,0 +1,78 @@ +From a78921af9c6075f59fba439aef8b85335625c687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 18:31:18 +0200 +Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too + fast + +From: Johannes Nixdorf + +[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ] + +Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an +event to the tracer, and starts to wait interruptibly. With +SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the +message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting +and is subsequently interrupted, the tracee begins to wait again +uninterruptibly (but killable). + +This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee +is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a +condition to begin waiting again. In this case the tracee is interrupted +even though the tracer already acted on its behalf. This breaks the +assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, +namely that the tracer can be sure the syscall is not interrupted or +restarted on the tracee after it is received on the tracer. Fix this +by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to +switch to uninterruptible waiting. + +With the condition changed the loop in seccomp_do_user_notification() +would exit immediately after deciding that noninterruptible waiting +is required if the operation already reached SECCOMP_NOTIFY_REPLIED, +skipping the code that processes pending addfd commands first. Prevent +this by executing the remaining loop body one last time in this case. + +Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") +Reported-by: Ali Polatel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 +Signed-off-by: Johannes Nixdorf +Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + kernel/seccomp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 41aa761c7738c..3bbfba30a777a 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +-- +2.51.0 + diff --git a/queue-6.17/selftest-futex-compile-also-with-libnuma-2.0.16.patch b/queue-6.17/selftest-futex-compile-also-with-libnuma-2.0.16.patch new file mode 100644 index 0000000000..21075ca31d --- /dev/null +++ b/queue-6.17/selftest-futex-compile-also-with-libnuma-2.0.16.patch @@ -0,0 +1,119 @@ +From c56868089813b424a8212ae345e6b3e47be5ca77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 23:26:30 +0200 +Subject: selftest/futex: Compile also with libnuma < 2.0.16 + +From: Sebastian Andrzej Siewior + +[ Upstream commit ed323aeda5e09fa1ab95946673939c8c425c329c ] + +After using numa_set_mempolicy_home_node() the test fails to compile on +systems with libnuma library versioned lower than 2.0.16. + +In order to allow lower library version add a pkg-config related check +and exclude that part of the code. Without the proper MPOL setup it +can't be tested. + +Make a total number of tests two. The first one is the first batch and +the second is the MPOL related one. The goal is to let the user know if +it has been skipped due to library limitation. + +Remove test_futex_mpol(), it was unused and it is now complained by the +compiler if the part is not compiled. + +Fixes: 0ecb4232fc65e ("selftests/futex: Set the home_node in futex_numa_mpol") +Closes: https://lore.kernel.org/oe-lkp/202507150858.bedaf012-lkp@intel.com +Reported-by: kernel test robot +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Sasha Levin +--- + .../selftests/futex/functional/Makefile | 5 ++++- + .../futex/functional/futex_numa_mpol.c | 21 +++++++++---------- + 2 files changed, 14 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile +index ddfa61d857b9b..bd50aecfca8a3 100644 +--- a/tools/testing/selftests/futex/functional/Makefile ++++ b/tools/testing/selftests/futex/functional/Makefile +@@ -1,6 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0 ++PKG_CONFIG ?= pkg-config ++LIBNUMA_TEST = $(shell sh -c "$(PKG_CONFIG) numa --atleast-version 2.0.16 > /dev/null 2>&1 && echo SUFFICIENT || echo NO") ++ + INCLUDES := -I../include -I../../ $(KHDR_INCLUDES) +-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES) ++CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES) -DLIBNUMA_VER_$(LIBNUMA_TEST)=1 + LDLIBS := -lpthread -lrt -lnuma + + LOCAL_HDRS := \ +diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +index dd7b05e8cda45..7f2b2e1ff9f8a 100644 +--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c ++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +@@ -131,11 +131,6 @@ static void test_futex(void *futex_ptr, int err_value) + __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA); + } + +-static void test_futex_mpol(void *futex_ptr, int err_value) +-{ +- __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL); +-} +- + static void usage(char *prog) + { + printf("Usage: %s\n", prog); +@@ -148,7 +143,7 @@ static void usage(char *prog) + int main(int argc, char *argv[]) + { + struct futex32_numa *futex_numa; +- int mem_size, i; ++ int mem_size; + void *futex_ptr; + int c; + +@@ -171,7 +166,7 @@ int main(int argc, char *argv[]) + } + + ksft_print_header(); +- ksft_set_plan(1); ++ ksft_set_plan(2); + + mem_size = sysconf(_SC_PAGE_SIZE); + futex_ptr = mmap(NULL, mem_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); +@@ -205,8 +200,11 @@ int main(int argc, char *argv[]) + ksft_print_msg("Memory back to RW\n"); + test_futex(futex_ptr, 0); + ++ ksft_test_result_pass("futex2 memory boundarie tests passed\n"); ++ + /* MPOL test. Does not work as expected */ +- for (i = 0; i < 4; i++) { ++#ifdef LIBNUMA_VER_SUFFICIENT ++ for (int i = 0; i < 4; i++) { + unsigned long nodemask; + int ret; + +@@ -225,15 +223,16 @@ int main(int argc, char *argv[]) + ret = futex2_wake(futex_ptr, 0, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL); + if (ret < 0) + ksft_test_result_fail("Failed to wake 0 with MPOL: %m\n"); +- if (0) +- test_futex_mpol(futex_numa, 0); + if (futex_numa->numa != i) { + ksft_exit_fail_msg("Returned NUMA node is %d expected %d\n", + futex_numa->numa, i); + } + } + } +- ksft_test_result_pass("NUMA MPOL tests passed\n"); ++ ksft_test_result_pass("futex2 MPOL hints test passed\n"); ++#else ++ ksft_test_result_skip("futex2 MPOL hints test requires libnuma 2.0.16+\n"); ++#endif + ksft_finished(); + return 0; + } +-- +2.51.0 + diff --git a/queue-6.17/selftest-futex-make-the-error-check-more-precise-for.patch b/queue-6.17/selftest-futex-make-the-error-check-more-precise-for.patch new file mode 100644 index 0000000000..b5d4a657e3 --- /dev/null +++ b/queue-6.17/selftest-futex-make-the-error-check-more-precise-for.patch @@ -0,0 +1,120 @@ +From 91d9b3d2ecf968cf52d90771ece4eb17eb0c0b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 23:26:28 +0200 +Subject: selftest/futex: Make the error check more precise for futex_numa_mpol +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Almeida + +[ Upstream commit c1c863457780adfb2e29fa9a85897179ad3903e6 ] + +Instead of just checking if the syscall failed as expected, check as +well if the returned error code matches the expected error code. + +[ bigeasy: reword the commmit message ] + +Signed-off-by: André Almeida +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Waiman Long +Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16") +Signed-off-by: Sasha Levin +--- + .../futex/functional/futex_numa_mpol.c | 36 +++++++++++-------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +index 802c15c821906..dd7b05e8cda45 100644 +--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c ++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +@@ -77,7 +77,7 @@ static void join_max_threads(void) + } + } + +-static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flags) ++static void __test_futex(void *futex_ptr, int err_value, unsigned int futex_flags) + { + int to_wake, ret, i, need_exit = 0; + +@@ -88,11 +88,17 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag + + do { + ret = futex2_wake(futex_ptr, to_wake, futex_flags); +- if (must_fail) { +- if (ret < 0) +- break; +- ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n", +- to_wake, futex_flags); ++ ++ if (err_value) { ++ if (ret >= 0) ++ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n", ++ to_wake, futex_flags); ++ ++ if (errno != err_value) ++ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) expected error was %d, but returned %d (%s)\n", ++ to_wake, futex_flags, err_value, errno, strerror(errno)); ++ ++ break; + } + if (ret < 0) { + ksft_exit_fail_msg("Failed futex2_wake(%d, 0x%x): %m\n", +@@ -106,12 +112,12 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag + join_max_threads(); + + for (i = 0; i < MAX_THREADS; i++) { +- if (must_fail && thread_args[i].result != -1) { ++ if (err_value && thread_args[i].result != -1) { + ksft_print_msg("Thread %d should fail but succeeded (%d)\n", + i, thread_args[i].result); + need_exit = 1; + } +- if (!must_fail && thread_args[i].result != 0) { ++ if (!err_value && thread_args[i].result != 0) { + ksft_print_msg("Thread %d failed (%d)\n", i, thread_args[i].result); + need_exit = 1; + } +@@ -120,14 +126,14 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag + ksft_exit_fail_msg("Aborting due to earlier errors.\n"); + } + +-static void test_futex(void *futex_ptr, int must_fail) ++static void test_futex(void *futex_ptr, int err_value) + { +- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA); ++ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA); + } + +-static void test_futex_mpol(void *futex_ptr, int must_fail) ++static void test_futex_mpol(void *futex_ptr, int err_value) + { +- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL); ++ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL); + } + + static void usage(char *prog) +@@ -184,16 +190,16 @@ int main(int argc, char *argv[]) + + /* FUTEX2_NUMA futex must be 8-byte aligned */ + ksft_print_msg("Mis-aligned futex\n"); +- test_futex(futex_ptr + mem_size - 4, 1); ++ test_futex(futex_ptr + mem_size - 4, EINVAL); + + futex_numa->numa = FUTEX_NO_NODE; + mprotect(futex_ptr, mem_size, PROT_READ); + ksft_print_msg("Memory, RO\n"); +- test_futex(futex_ptr, 1); ++ test_futex(futex_ptr, EFAULT); + + mprotect(futex_ptr, mem_size, PROT_NONE); + ksft_print_msg("Memory, no access\n"); +- test_futex(futex_ptr, 1); ++ test_futex(futex_ptr, EFAULT); + + mprotect(futex_ptr, mem_size, PROT_READ | PROT_WRITE); + ksft_print_msg("Memory back to RW\n"); +-- +2.51.0 + diff --git a/queue-6.17/selftests-always-install-uapi-headers-to-the-correct.patch b/queue-6.17/selftests-always-install-uapi-headers-to-the-correct.patch new file mode 100644 index 0000000000..9d762579cf --- /dev/null +++ b/queue-6.17/selftests-always-install-uapi-headers-to-the-correct.patch @@ -0,0 +1,52 @@ +From c9ee549b5779f36aa8f676bc7bb41ef7a369f77a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:56:36 +0200 +Subject: selftests: always install UAPI headers to the correct directory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ] + +Currently the UAPI headers are always installed into the source directory. +When building out-of-tree this doesn't work, as the include path will be +wrong and it dirties the source tree, leading to complains by kbuild. + +Make sure the 'headers' target installs the UAPI headers in the correctly. + +The real target directory can come from multiple places. To handle them all +extract the target directory from KHDR_INCLUDES. + +Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de +Reported-by: Jason Gunthorpe +Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/ +Fixes: 1a59f5d31569 ("selftests: Add headers target") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Jason Gunthorpe +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/lib.mk | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index 5303900339292..a448fae57831d 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S + $(LINK.S) $^ $(LDLIBS) -o $@ + endif + ++# Extract the expected header directory ++khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES))) ++ + headers: +- $(Q)$(MAKE) -C $(top_srcdir) headers ++ $(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers + + .PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers +-- +2.51.0 + diff --git a/queue-6.17/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.17/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..9b2554edf7 --- /dev/null +++ b/queue-6.17/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From 67af2dc3971d110a8f1e77bc17c6e05d3675fbec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-6.17/selftests-arm64-fix-waddress-warning-in-tpidr2-test.patch b/queue-6.17/selftests-arm64-fix-waddress-warning-in-tpidr2-test.patch new file mode 100644 index 0000000000..f9770ad3af --- /dev/null +++ b/queue-6.17/selftests-arm64-fix-waddress-warning-in-tpidr2-test.patch @@ -0,0 +1,46 @@ +From 5d669a2a51feb44e27bbaed12c182ce92191b815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 17:12:29 +0530 +Subject: selftests: arm64: Fix -Waddress warning in tpidr2 test + +From: Bala-Vignesh-Reddy + +[ Upstream commit 50af02425afc72b1b47c4a0a0b9c9bdaa1a1b347 ] + +Thanks to -Waddress, the compiler warns that the ksft_test_result() +invocations in the arm64 tpidr2 selftest are always true. Oops. + +Fix the test by, err, actually running the test functions. + +Fixes: 6d80cb73131d ("kselftest/arm64: Convert tpidr2 test to use kselftest.h") +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Anshuman Khandual +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/abi/tpidr2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c +index f58a9f89b952c..4c89ab0f10101 100644 +--- a/tools/testing/selftests/arm64/abi/tpidr2.c ++++ b/tools/testing/selftests/arm64/abi/tpidr2.c +@@ -227,10 +227,10 @@ int main(int argc, char **argv) + ret = open("/proc/sys/abi/sme_default_vector_length", O_RDONLY, 0); + if (ret >= 0) { + ksft_test_result(default_value(), "default_value\n"); +- ksft_test_result(write_read, "write_read\n"); +- ksft_test_result(write_sleep_read, "write_sleep_read\n"); +- ksft_test_result(write_fork_read, "write_fork_read\n"); +- ksft_test_result(write_clone_read, "write_clone_read\n"); ++ ksft_test_result(write_read(), "write_read\n"); ++ ksft_test_result(write_sleep_read(), "write_sleep_read\n"); ++ ksft_test_result(write_fork_read(), "write_fork_read\n"); ++ ksft_test_result(write_clone_read(), "write_clone_read\n"); + + } else { + ksft_print_msg("SME support not present\n"); +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-copy-test_kmods-when-installing-selfte.patch b/queue-6.17/selftests-bpf-copy-test_kmods-when-installing-selfte.patch new file mode 100644 index 0000000000..8e68a50306 --- /dev/null +++ b/queue-6.17/selftests-bpf-copy-test_kmods-when-installing-selfte.patch @@ -0,0 +1,40 @@ +From 689b0a87d71a17198e474aea95eaa0686354ea28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 10:50:39 -0700 +Subject: selftests/bpf: Copy test_kmods when installing selftest + +From: Amery Hung + +[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ] + +Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into +common directory") consolidated the Makefile of test_kmods. However, +since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel +modules required by bpf selftests are now missing from kselftest_install +when "make install". Fix it by adding test_kmod to TEST_GEN_FILES. + +Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory") +Signed-off-by: Amery Hung +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 4863106034dfb..77794efc020ea 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -137,7 +137,7 @@ TEST_GEN_PROGS_EXTENDED = \ + xdping \ + xskxceiver + +-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi ++TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi + + ifneq ($(V),1) + submake_extras := feature_display=0 +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch b/queue-6.17/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch new file mode 100644 index 0000000000..a0b19193ab --- /dev/null +++ b/queue-6.17/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch @@ -0,0 +1,61 @@ +From 65ce0aaf794a2da376ea76ed2f8b11f79d7feaa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:33:49 -0300 +Subject: selftests/bpf: Fix count write in testapp_xdp_metadata_copy() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ricardo B. Marlière + +[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ] + +Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support +check") added a new global to xsk_xdp_progs.c, but left out the access in +the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will +write to the whole bss section, it gets truncated. Fix by writing to +skel_rx->bss->count directly. + +Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check") +Signed-off-by: Ricardo B. Marlière +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xskxceiver.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index a29de0713f19f..352adc8df2d1c 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -2276,25 +2276,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test) + { + struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs; + struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs; +- struct bpf_map *data_map; +- int count = 0; +- int key = 0; + + test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata, + skel_tx->progs.xsk_xdp_populate_metadata, + skel_rx->maps.xsk, skel_tx->maps.xsk); + test->ifobj_rx->use_metadata = true; + +- data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss"); +- if (!data_map || !bpf_map__is_internal(data_map)) { +- ksft_print_msg("Error: could not find bss section of XDP program\n"); +- return TEST_FAILURE; +- } +- +- if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) { +- ksft_print_msg("Error: could not update count element\n"); +- return TEST_FAILURE; +- } ++ skel_rx->bss->count = 0; + + return testapp_validate_traffic(test); + } +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-fix-realloc-size-in-bpf_get_addrs.patch b/queue-6.17/selftests-bpf-fix-realloc-size-in-bpf_get_addrs.patch new file mode 100644 index 0000000000..87e126608e --- /dev/null +++ b/queue-6.17/selftests-bpf-fix-realloc-size-in-bpf_get_addrs.patch @@ -0,0 +1,36 @@ +From 0f507380f7206595ce342198dfd0f0339c068a46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Oct 2025 14:22:23 +0200 +Subject: selftests/bpf: Fix realloc size in bpf_get_addrs + +From: Jiri Olsa + +[ Upstream commit 0c342bfc9949dffeaa83ebdde3b4b0ce59009348 ] + +We will segfault once we call realloc in bpf_get_addrs due to +wrong size argument. + +Fixes: 6302bdeb91df ("selftests/bpf: Add a kprobe_multi subtest to use addrs instead of syms") +Signed-off-by: Jiri Olsa +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/trace_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c +index d24baf244d1f3..03f223333aa4a 100644 +--- a/tools/testing/selftests/bpf/trace_helpers.c ++++ b/tools/testing/selftests/bpf/trace_helpers.c +@@ -712,7 +712,7 @@ int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel) + + if (cnt == max_cnt) { + max_cnt += inc_cnt; +- tmp_addrs = realloc(addrs, max_cnt); ++ tmp_addrs = realloc(addrs, max_cnt * sizeof(long)); + if (!tmp_addrs) { + err = -ENOMEM; + goto error; +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-fix-typos-and-grammar-in-test-sources.patch b/queue-6.17/selftests-bpf-fix-typos-and-grammar-in-test-sources.patch new file mode 100644 index 0000000000..5da4dad4aa --- /dev/null +++ b/queue-6.17/selftests-bpf-fix-typos-and-grammar-in-test-sources.patch @@ -0,0 +1,465 @@ +From 1e455c9d2fa6ffb110a7fe04d06da6661a2ae6dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 18:27:46 +0530 +Subject: selftests/bpf: Fix typos and grammar in test sources + +From: Shubham Sharma + +[ Upstream commit d3abefe897408718799ae3bd06295b89b870a38e ] + +Fix spelling typos and grammar errors in BPF selftests source code. + +Signed-off-by: Shubham Sharma +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250826125746.17983-1-slopixelz@gmail.com +Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 2 +- + tools/testing/selftests/bpf/bench.c | 2 +- + tools/testing/selftests/bpf/prog_tests/btf_dump.c | 2 +- + tools/testing/selftests/bpf/prog_tests/fd_array.c | 2 +- + .../testing/selftests/bpf/prog_tests/kprobe_multi_test.c | 2 +- + tools/testing/selftests/bpf/prog_tests/module_attach.c | 2 +- + tools/testing/selftests/bpf/prog_tests/reg_bounds.c | 4 ++-- + .../selftests/bpf/prog_tests/stacktrace_build_id.c | 2 +- + .../selftests/bpf/prog_tests/stacktrace_build_id_nmi.c | 2 +- + tools/testing/selftests/bpf/prog_tests/stacktrace_map.c | 2 +- + .../selftests/bpf/prog_tests/stacktrace_map_raw_tp.c | 2 +- + .../selftests/bpf/prog_tests/stacktrace_map_skip.c | 2 +- + tools/testing/selftests/bpf/progs/bpf_cc_cubic.c | 2 +- + tools/testing/selftests/bpf/progs/bpf_dctcp.c | 2 +- + .../selftests/bpf/progs/freplace_connect_v4_prog.c | 2 +- + tools/testing/selftests/bpf/progs/iters_state_safety.c | 2 +- + tools/testing/selftests/bpf/progs/rbtree_search.c | 2 +- + .../testing/selftests/bpf/progs/struct_ops_kptr_return.c | 2 +- + tools/testing/selftests/bpf/progs/struct_ops_refcounted.c | 2 +- + tools/testing/selftests/bpf/progs/test_cls_redirect.c | 2 +- + .../selftests/bpf/progs/test_cls_redirect_dynptr.c | 2 +- + tools/testing/selftests/bpf/progs/uretprobe_stack.c | 4 ++-- + tools/testing/selftests/bpf/progs/verifier_scalar_ids.c | 2 +- + tools/testing/selftests/bpf/progs/verifier_var_off.c | 6 +++--- + tools/testing/selftests/bpf/test_sockmap.c | 2 +- + tools/testing/selftests/bpf/verifier/calls.c | 8 ++++---- + tools/testing/selftests/bpf/xdping.c | 2 +- + tools/testing/selftests/bpf/xsk.h | 4 ++-- + 28 files changed, 36 insertions(+), 36 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 77794efc020ea..fd6b370c81698 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -398,7 +398,7 @@ $(HOST_BPFOBJ): $(wildcard $(BPFDIR)/*.[ch] $(BPFDIR)/Makefile) \ + DESTDIR=$(HOST_SCRATCH_DIR)/ prefix= all install_headers + endif + +-# vmlinux.h is first dumped to a temprorary file and then compared to ++# vmlinux.h is first dumped to a temporary file and then compared to + # the previous version. This helps to avoid unnecessary re-builds of + # $(TRUNNER_BPF_OBJS) + $(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) | $(INCLUDE_DIR) +diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c +index ddd73d06a1eb2..3ecc226ea7b25 100644 +--- a/tools/testing/selftests/bpf/bench.c ++++ b/tools/testing/selftests/bpf/bench.c +@@ -499,7 +499,7 @@ extern const struct bench bench_rename_rawtp; + extern const struct bench bench_rename_fentry; + extern const struct bench bench_rename_fexit; + +-/* pure counting benchmarks to establish theoretical lmits */ ++/* pure counting benchmarks to establish theoretical limits */ + extern const struct bench bench_trig_usermode_count; + extern const struct bench bench_trig_syscall_count; + extern const struct bench bench_trig_kernel_count; +diff --git a/tools/testing/selftests/bpf/prog_tests/btf_dump.c b/tools/testing/selftests/bpf/prog_tests/btf_dump.c +index 82903585c8700..10cba526d3e63 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf_dump.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf_dump.c +@@ -63,7 +63,7 @@ static int test_btf_dump_case(int n, struct btf_dump_test_case *t) + + /* tests with t->known_ptr_sz have no "long" or "unsigned long" type, + * so it's impossible to determine correct pointer size; but if they +- * do, it should be 8 regardless of host architecture, becaues BPF ++ * do, it should be 8 regardless of host architecture, because BPF + * target is always 64-bit + */ + if (!t->known_ptr_sz) { +diff --git a/tools/testing/selftests/bpf/prog_tests/fd_array.c b/tools/testing/selftests/bpf/prog_tests/fd_array.c +index 241b2c8c6e0f1..c534b4d5f9da8 100644 +--- a/tools/testing/selftests/bpf/prog_tests/fd_array.c ++++ b/tools/testing/selftests/bpf/prog_tests/fd_array.c +@@ -293,7 +293,7 @@ static int get_btf_id_by_fd(int btf_fd, __u32 *id) + * 1) Create a new btf, it's referenced only by a file descriptor, so refcnt=1 + * 2) Load a BPF prog with fd_array[0] = btf_fd; now btf's refcnt=2 + * 3) Close the btf_fd, now refcnt=1 +- * Wait and check that BTF stil exists. ++ * Wait and check that BTF still exists. + */ + static void check_fd_array_cnt__referenced_btfs(void) + { +diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c +index e19ef509ebf85..f377bea0b82d4 100644 +--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c ++++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c +@@ -463,7 +463,7 @@ static bool skip_entry(char *name) + return false; + } + +-/* Do comparision by ignoring '.llvm.' suffixes. */ ++/* Do comparison by ignoring '.llvm.' suffixes. */ + static int compare_name(const char *name1, const char *name2) + { + const char *res1, *res2; +diff --git a/tools/testing/selftests/bpf/prog_tests/module_attach.c b/tools/testing/selftests/bpf/prog_tests/module_attach.c +index 6d391d95f96e0..70fa7ae93173b 100644 +--- a/tools/testing/selftests/bpf/prog_tests/module_attach.c ++++ b/tools/testing/selftests/bpf/prog_tests/module_attach.c +@@ -90,7 +90,7 @@ void test_module_attach(void) + + test_module_attach__detach(skel); + +- /* attach fentry/fexit and make sure it get's module reference */ ++ /* attach fentry/fexit and make sure it gets module reference */ + link = bpf_program__attach(skel->progs.handle_fentry); + if (!ASSERT_OK_PTR(link, "attach_fentry")) + goto cleanup; +diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c +index e261b0e872dbb..d93a0c7b1786f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c ++++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c +@@ -623,7 +623,7 @@ static void range_cond(enum num_t t, struct range x, struct range y, + *newx = range(t, x.a, x.b); + *newy = range(t, y.a + 1, y.b); + } else if (x.a == x.b && x.b == y.b) { +- /* X is a constant matching rigth side of Y */ ++ /* X is a constant matching right side of Y */ + *newx = range(t, x.a, x.b); + *newy = range(t, y.a, y.b - 1); + } else if (y.a == y.b && x.a == y.a) { +@@ -631,7 +631,7 @@ static void range_cond(enum num_t t, struct range x, struct range y, + *newx = range(t, x.a + 1, x.b); + *newy = range(t, y.a, y.b); + } else if (y.a == y.b && x.b == y.b) { +- /* Y is a constant matching rigth side of X */ ++ /* Y is a constant matching right side of X */ + *newx = range(t, x.a, x.b - 1); + *newy = range(t, y.a, y.b); + } else { +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c +index b7ba5cd47d96f..271b5cc9fc015 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c +@@ -39,7 +39,7 @@ void test_stacktrace_build_id(void) + bpf_map_update_elem(control_map_fd, &key, &val, 0); + + /* for every element in stackid_hmap, we can find a corresponding one +- * in stackmap, and vise versa. ++ * in stackmap, and vice versa. + */ + err = compare_map_keys(stackid_hmap_fd, stackmap_fd); + if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap", +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c +index 0832fd7874575..b277dddd5af7f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c +@@ -66,7 +66,7 @@ void test_stacktrace_build_id_nmi(void) + bpf_map_update_elem(control_map_fd, &key, &val, 0); + + /* for every element in stackid_hmap, we can find a corresponding one +- * in stackmap, and vise versa. ++ * in stackmap, and vice versa. + */ + err = compare_map_keys(stackid_hmap_fd, stackmap_fd); + if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap", +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c +index df59e4ae29510..84a7e405e9129 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c +@@ -50,7 +50,7 @@ void test_stacktrace_map(void) + bpf_map_update_elem(control_map_fd, &key, &val, 0); + + /* for every element in stackid_hmap, we can find a corresponding one +- * in stackmap, and vise versa. ++ * in stackmap, and vice versa. + */ + err = compare_map_keys(stackid_hmap_fd, stackmap_fd); + if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap", +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c +index c6ef06f55cdb4..e0cb4697b4b3c 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c +@@ -46,7 +46,7 @@ void test_stacktrace_map_raw_tp(void) + bpf_map_update_elem(control_map_fd, &key, &val, 0); + + /* for every element in stackid_hmap, we can find a corresponding one +- * in stackmap, and vise versa. ++ * in stackmap, and vice versa. + */ + err = compare_map_keys(stackid_hmap_fd, stackmap_fd); + if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap", +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c +index 1932b1e0685cf..dc2ccf6a14d13 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c +@@ -40,7 +40,7 @@ void test_stacktrace_map_skip(void) + skel->bss->control = 1; + + /* for every element in stackid_hmap, we can find a corresponding one +- * in stackmap, and vise versa. ++ * in stackmap, and vice versa. + */ + err = compare_map_keys(stackid_hmap_fd, stackmap_fd); + if (!ASSERT_OK(err, "compare_map_keys stackid_hmap vs. stackmap")) +diff --git a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c +index 1654a530aa3dc..4e51785e7606e 100644 +--- a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c ++++ b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c +@@ -101,7 +101,7 @@ static void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked, + tp->snd_cwnd = pkts_in_flight + sndcnt; + } + +-/* Decide wheather to run the increase function of congestion control. */ ++/* Decide whether to run the increase function of congestion control. */ + static bool tcp_may_raise_cwnd(const struct sock *sk, const int flag) + { + if (tcp_sk(sk)->reordering > TCP_REORDERING) +diff --git a/tools/testing/selftests/bpf/progs/bpf_dctcp.c b/tools/testing/selftests/bpf/progs/bpf_dctcp.c +index 7cd73e75f52a2..32c511bcd60b3 100644 +--- a/tools/testing/selftests/bpf/progs/bpf_dctcp.c ++++ b/tools/testing/selftests/bpf/progs/bpf_dctcp.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + /* Copyright (c) 2019 Facebook */ + +-/* WARNING: This implemenation is not necessarily the same ++/* WARNING: This implementation is not necessarily the same + * as the tcp_dctcp.c. The purpose is mainly for testing + * the kernel BPF logic. + */ +diff --git a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c +index 544e5ac904610..d09bbd8ae8a85 100644 +--- a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c ++++ b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c +@@ -12,7 +12,7 @@ + SEC("freplace/connect_v4_prog") + int new_connect_v4_prog(struct bpf_sock_addr *ctx) + { +- // return value thats in invalid range ++ // return value that's in invalid range + return 255; + } + +diff --git a/tools/testing/selftests/bpf/progs/iters_state_safety.c b/tools/testing/selftests/bpf/progs/iters_state_safety.c +index f41257eadbb25..b381ac0c736cf 100644 +--- a/tools/testing/selftests/bpf/progs/iters_state_safety.c ++++ b/tools/testing/selftests/bpf/progs/iters_state_safety.c +@@ -345,7 +345,7 @@ int __naked read_from_iter_slot_fail(void) + "r3 = 1000;" + "call %[bpf_iter_num_new];" + +- /* attemp to leak bpf_iter_num state */ ++ /* attempt to leak bpf_iter_num state */ + "r7 = *(u64 *)(r6 + 0);" + "r8 = *(u64 *)(r6 + 8);" + +diff --git a/tools/testing/selftests/bpf/progs/rbtree_search.c b/tools/testing/selftests/bpf/progs/rbtree_search.c +index 098ef970fac16..b05565d1db0d4 100644 +--- a/tools/testing/selftests/bpf/progs/rbtree_search.c ++++ b/tools/testing/selftests/bpf/progs/rbtree_search.c +@@ -183,7 +183,7 @@ long test_##op##_spinlock_##dolock(void *ctx) \ + } + + /* +- * Use a spearate MSG macro instead of passing to TEST_XXX(..., MSG) ++ * Use a separate MSG macro instead of passing to TEST_XXX(..., MSG) + * to ensure the message itself is not in the bpf prog lineinfo + * which the verifier includes in its log. + * Otherwise, the test_loader will incorrectly match the prog lineinfo +diff --git a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c +index 36386b3c23a1f..2b98b7710816d 100644 +--- a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c ++++ b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c +@@ -9,7 +9,7 @@ void bpf_task_release(struct task_struct *p) __ksym; + + /* This test struct_ops BPF programs returning referenced kptr. The verifier should + * allow a referenced kptr or a NULL pointer to be returned. A referenced kptr to task +- * here is acquried automatically as the task argument is tagged with "__ref". ++ * here is acquired automatically as the task argument is tagged with "__ref". + */ + SEC("struct_ops/test_return_ref_kptr") + struct task_struct *BPF_PROG(kptr_return, int dummy, +diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c +index 76dcb6089d7f8..9c0a65466356c 100644 +--- a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c ++++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c +@@ -9,7 +9,7 @@ __attribute__((nomerge)) extern void bpf_task_release(struct task_struct *p) __k + + /* This is a test BPF program that uses struct_ops to access a referenced + * kptr argument. This is a test for the verifier to ensure that it +- * 1) recongnizes the task as a referenced object (i.e., ref_obj_id > 0), and ++ * 1) recognizes the task as a referenced object (i.e., ref_obj_id > 0), and + * 2) the same reference can be acquired from multiple paths as long as it + * has not been released. + */ +diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.c b/tools/testing/selftests/bpf/progs/test_cls_redirect.c +index f344c6835e84e..823169fb6e4c7 100644 +--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.c ++++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.c +@@ -129,7 +129,7 @@ typedef uint8_t *net_ptr __attribute__((align_value(8))); + typedef struct buf { + struct __sk_buff *skb; + net_ptr head; +- /* NB: tail musn't have alignment other than 1, otherwise ++ /* NB: tail mustn't have alignment other than 1, otherwise + * LLVM will go and eliminate code, e.g. when checking packet lengths. + */ + uint8_t *const tail; +diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c +index d0f7670351e58..dfd4a2710391d 100644 +--- a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c ++++ b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c +@@ -494,7 +494,7 @@ static ret_t get_next_hop(struct bpf_dynptr *dynptr, __u64 *offset, encap_header + + *offset += sizeof(*next_hop); + +- /* Skip the remainig next hops (may be zero). */ ++ /* Skip the remaining next hops (may be zero). */ + return skip_next_hops(offset, encap->unigue.hop_count - encap->unigue.next_hop - 1); + } + +diff --git a/tools/testing/selftests/bpf/progs/uretprobe_stack.c b/tools/testing/selftests/bpf/progs/uretprobe_stack.c +index 9fdcf396b8f46..a2951e2f1711b 100644 +--- a/tools/testing/selftests/bpf/progs/uretprobe_stack.c ++++ b/tools/testing/selftests/bpf/progs/uretprobe_stack.c +@@ -26,8 +26,8 @@ int usdt_len; + SEC("uprobe//proc/self/exe:target_1") + int BPF_UPROBE(uprobe_1) + { +- /* target_1 is recursive wit depth of 2, so we capture two separate +- * stack traces, depending on which occurence it is ++ /* target_1 is recursive with depth of 2, so we capture two separate ++ * stack traces, depending on which occurrence it is + */ + static bool recur = false; + +diff --git a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c +index 7c5e5e6d10ebc..dba3ca728f6e6 100644 +--- a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c ++++ b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c +@@ -349,7 +349,7 @@ __naked void precision_two_ids(void) + SEC("socket") + __success __log_level(2) + __flag(BPF_F_TEST_STATE_FREQ) +-/* check thar r0 and r6 have different IDs after 'if', ++/* check that r0 and r6 have different IDs after 'if', + * collect_linked_regs() can't tie more than 6 registers for a single insn. + */ + __msg("8: (25) if r0 > 0x7 goto pc+0 ; R0=scalar(id=1") +diff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c +index 1d36d01b746e7..f345466bca686 100644 +--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c ++++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c +@@ -114,8 +114,8 @@ __naked void stack_write_priv_vs_unpriv(void) + } + + /* Similar to the previous test, but this time also perform a read from the +- * address written to with a variable offset. The read is allowed, showing that, +- * after a variable-offset write, a priviledged program can read the slots that ++ * address written to with a variable offet. The read is allowed, showing that, ++ * after a variable-offset write, a privileged program can read the slots that + * were in the range of that write (even if the verifier doesn't actually know if + * the slot being read was really written to or not. + * +@@ -157,7 +157,7 @@ __naked void stack_write_followed_by_read(void) + SEC("socket") + __description("variable-offset stack write clobbers spilled regs") + __failure +-/* In the priviledged case, dereferencing a spilled-and-then-filled ++/* In the privileged case, dereferencing a spilled-and-then-filled + * register is rejected because the previous variable offset stack + * write might have overwritten the spilled pointer (i.e. we lose track + * of the spilled register when we analyze the write). +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index fd2da2234cc9b..76568db7a6642 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -1372,7 +1372,7 @@ static int run_options(struct sockmap_options *options, int cg_fd, int test) + } else + fprintf(stderr, "unknown test\n"); + out: +- /* Detatch and zero all the maps */ ++ /* Detach and zero all the maps */ + bpf_prog_detach2(bpf_program__fd(progs[3]), cg_fd, BPF_CGROUP_SOCK_OPS); + + for (i = 0; i < ARRAY_SIZE(links); i++) { +diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c +index f3492efc88346..c8d640802cce4 100644 +--- a/tools/testing/selftests/bpf/verifier/calls.c ++++ b/tools/testing/selftests/bpf/verifier/calls.c +@@ -1375,7 +1375,7 @@ + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), + /* write into map value */ + BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), +- /* fetch secound map_value_ptr from the stack */ ++ /* fetch second map_value_ptr from the stack */ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16), + BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), + /* write into map value */ +@@ -1439,7 +1439,7 @@ + /* second time with fp-16 */ + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), +- /* fetch secound map_value_ptr from the stack */ ++ /* fetch second map_value_ptr from the stack */ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), + /* write into map value */ + BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), +@@ -1493,7 +1493,7 @@ + /* second time with fp-16 */ + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), +- /* fetch secound map_value_ptr from the stack */ ++ /* fetch second map_value_ptr from the stack */ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), + /* write into map value */ + BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), +@@ -2380,7 +2380,7 @@ + */ + BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 1), + BPF_MOV64_REG(BPF_REG_9, BPF_REG_8), +- /* r9 = *r9 ; verifier get's to this point via two paths: ++ /* r9 = *r9 ; verifier gets to this point via two paths: + * ; (I) one including r9 = r8, verified first; + * ; (II) one excluding r9 = r8, verified next. + * ; After load of *r9 to r9 the frame[0].fp[-24].id == r9.id. +diff --git a/tools/testing/selftests/bpf/xdping.c b/tools/testing/selftests/bpf/xdping.c +index 1503a1d2faa09..9ed8c796645d0 100644 +--- a/tools/testing/selftests/bpf/xdping.c ++++ b/tools/testing/selftests/bpf/xdping.c +@@ -155,7 +155,7 @@ int main(int argc, char **argv) + } + + if (!server) { +- /* Only supports IPv4; see hints initiailization above. */ ++ /* Only supports IPv4; see hints initialization above. */ + if (getaddrinfo(argv[optind], NULL, &hints, &a) || !a) { + fprintf(stderr, "Could not resolve %s\n", argv[optind]); + return 1; +diff --git a/tools/testing/selftests/bpf/xsk.h b/tools/testing/selftests/bpf/xsk.h +index 93c2cc413cfcd..48729da142c24 100644 +--- a/tools/testing/selftests/bpf/xsk.h ++++ b/tools/testing/selftests/bpf/xsk.h +@@ -93,8 +93,8 @@ static inline __u32 xsk_prod_nb_free(struct xsk_ring_prod *r, __u32 nb) + /* Refresh the local tail pointer. + * cached_cons is r->size bigger than the real consumer pointer so + * that this addition can be avoided in the more frequently +- * executed code that computs free_entries in the beginning of +- * this function. Without this optimization it whould have been ++ * executed code that computes free_entries in the beginning of ++ * this function. Without this optimization it would have been + * free_entries = r->cached_prod - r->cached_cons + r->size. + */ + r->cached_cons = __atomic_load_n(r->consumer, __ATOMIC_ACQUIRE); +-- +2.51.0 + diff --git a/queue-6.17/selftests-bpf-move-get_ksyms-and-get_addrs-to-trace_.patch b/queue-6.17/selftests-bpf-move-get_ksyms-and-get_addrs-to-trace_.patch new file mode 100644 index 0000000000..6b4aa84a43 --- /dev/null +++ b/queue-6.17/selftests-bpf-move-get_ksyms-and-get_addrs-to-trace_.patch @@ -0,0 +1,518 @@ +From 44d5d5cd98ed180ae19aa177ffab7c6e50643b22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 10:10:09 +0800 +Subject: selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c + +From: Menglong Dong + +[ Upstream commit 8bad31edf5490a38dc26163502cd7005a033ee05 ] + +We need to get all the kernel function that can be traced sometimes, so we +move the get_syms() and get_addrs() in kprobe_multi_test.c to +trace_helpers.c and rename it to bpf_get_ksyms() and bpf_get_addrs(). + +Signed-off-by: Menglong Dong +Link: https://lore.kernel.org/r/20250904021011.14069-2-dongml2@chinatelecom.cn +Signed-off-by: Alexei Starovoitov +Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs") +Signed-off-by: Sasha Levin +--- + .../bpf/prog_tests/kprobe_multi_test.c | 220 +----------------- + tools/testing/selftests/bpf/trace_helpers.c | 214 +++++++++++++++++ + tools/testing/selftests/bpf/trace_helpers.h | 3 + + 3 files changed, 220 insertions(+), 217 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c +index f377bea0b82d4..171706e78da88 100644 +--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c ++++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c +@@ -422,220 +422,6 @@ static void test_unique_match(void) + kprobe_multi__destroy(skel); + } + +-static size_t symbol_hash(long key, void *ctx __maybe_unused) +-{ +- return str_hash((const char *) key); +-} +- +-static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused) +-{ +- return strcmp((const char *) key1, (const char *) key2) == 0; +-} +- +-static bool is_invalid_entry(char *buf, bool kernel) +-{ +- if (kernel && strchr(buf, '[')) +- return true; +- if (!kernel && !strchr(buf, '[')) +- return true; +- return false; +-} +- +-static bool skip_entry(char *name) +-{ +- /* +- * We attach to almost all kernel functions and some of them +- * will cause 'suspicious RCU usage' when fprobe is attached +- * to them. Filter out the current culprits - arch_cpu_idle +- * default_idle and rcu_* functions. +- */ +- if (!strcmp(name, "arch_cpu_idle")) +- return true; +- if (!strcmp(name, "default_idle")) +- return true; +- if (!strncmp(name, "rcu_", 4)) +- return true; +- if (!strcmp(name, "bpf_dispatcher_xdp_func")) +- return true; +- if (!strncmp(name, "__ftrace_invalid_address__", +- sizeof("__ftrace_invalid_address__") - 1)) +- return true; +- return false; +-} +- +-/* Do comparison by ignoring '.llvm.' suffixes. */ +-static int compare_name(const char *name1, const char *name2) +-{ +- const char *res1, *res2; +- int len1, len2; +- +- res1 = strstr(name1, ".llvm."); +- res2 = strstr(name2, ".llvm."); +- len1 = res1 ? res1 - name1 : strlen(name1); +- len2 = res2 ? res2 - name2 : strlen(name2); +- +- if (len1 == len2) +- return strncmp(name1, name2, len1); +- if (len1 < len2) +- return strncmp(name1, name2, len1) <= 0 ? -1 : 1; +- return strncmp(name1, name2, len2) >= 0 ? 1 : -1; +-} +- +-static int load_kallsyms_compare(const void *p1, const void *p2) +-{ +- return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name); +-} +- +-static int search_kallsyms_compare(const void *p1, const struct ksym *p2) +-{ +- return compare_name(p1, p2->name); +-} +- +-static int get_syms(char ***symsp, size_t *cntp, bool kernel) +-{ +- size_t cap = 0, cnt = 0; +- char *name = NULL, *ksym_name, **syms = NULL; +- struct hashmap *map; +- struct ksyms *ksyms; +- struct ksym *ks; +- char buf[256]; +- FILE *f; +- int err = 0; +- +- ksyms = load_kallsyms_custom_local(load_kallsyms_compare); +- if (!ASSERT_OK_PTR(ksyms, "load_kallsyms_custom_local")) +- return -EINVAL; +- +- /* +- * The available_filter_functions contains many duplicates, +- * but other than that all symbols are usable in kprobe multi +- * interface. +- * Filtering out duplicates by using hashmap__add, which won't +- * add existing entry. +- */ +- +- if (access("/sys/kernel/tracing/trace", F_OK) == 0) +- f = fopen("/sys/kernel/tracing/available_filter_functions", "r"); +- else +- f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r"); +- +- if (!f) +- return -EINVAL; +- +- map = hashmap__new(symbol_hash, symbol_equal, NULL); +- if (IS_ERR(map)) { +- err = libbpf_get_error(map); +- goto error; +- } +- +- while (fgets(buf, sizeof(buf), f)) { +- if (is_invalid_entry(buf, kernel)) +- continue; +- +- free(name); +- if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1) +- continue; +- if (skip_entry(name)) +- continue; +- +- ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare); +- if (!ks) { +- err = -EINVAL; +- goto error; +- } +- +- ksym_name = ks->name; +- err = hashmap__add(map, ksym_name, 0); +- if (err == -EEXIST) { +- err = 0; +- continue; +- } +- if (err) +- goto error; +- +- err = libbpf_ensure_mem((void **) &syms, &cap, +- sizeof(*syms), cnt + 1); +- if (err) +- goto error; +- +- syms[cnt++] = ksym_name; +- } +- +- *symsp = syms; +- *cntp = cnt; +- +-error: +- free(name); +- fclose(f); +- hashmap__free(map); +- if (err) +- free(syms); +- return err; +-} +- +-static int get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel) +-{ +- unsigned long *addr, *addrs, *tmp_addrs; +- int err = 0, max_cnt, inc_cnt; +- char *name = NULL; +- size_t cnt = 0; +- char buf[256]; +- FILE *f; +- +- if (access("/sys/kernel/tracing/trace", F_OK) == 0) +- f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r"); +- else +- f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r"); +- +- if (!f) +- return -ENOENT; +- +- /* In my local setup, the number of entries is 50k+ so Let us initially +- * allocate space to hold 64k entries. If 64k is not enough, incrementally +- * increase 1k each time. +- */ +- max_cnt = 65536; +- inc_cnt = 1024; +- addrs = malloc(max_cnt * sizeof(long)); +- if (addrs == NULL) { +- err = -ENOMEM; +- goto error; +- } +- +- while (fgets(buf, sizeof(buf), f)) { +- if (is_invalid_entry(buf, kernel)) +- continue; +- +- free(name); +- if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2) +- continue; +- if (skip_entry(name)) +- continue; +- +- if (cnt == max_cnt) { +- max_cnt += inc_cnt; +- tmp_addrs = realloc(addrs, max_cnt); +- if (!tmp_addrs) { +- err = -ENOMEM; +- goto error; +- } +- addrs = tmp_addrs; +- } +- +- addrs[cnt++] = (unsigned long)addr; +- } +- +- *addrsp = addrs; +- *cntp = cnt; +- +-error: +- free(name); +- fclose(f); +- if (err) +- free(addrs); +- return err; +-} +- + static void do_bench_test(struct kprobe_multi_empty *skel, struct bpf_kprobe_multi_opts *opts) + { + long attach_start_ns, attach_end_ns; +@@ -670,7 +456,7 @@ static void test_kprobe_multi_bench_attach(bool kernel) + char **syms = NULL; + size_t cnt = 0; + +- if (!ASSERT_OK(get_syms(&syms, &cnt, kernel), "get_syms")) ++ if (!ASSERT_OK(bpf_get_ksyms(&syms, &cnt, kernel), "bpf_get_ksyms")) + return; + + skel = kprobe_multi_empty__open_and_load(); +@@ -696,13 +482,13 @@ static void test_kprobe_multi_bench_attach_addr(bool kernel) + size_t cnt = 0; + int err; + +- err = get_addrs(&addrs, &cnt, kernel); ++ err = bpf_get_addrs(&addrs, &cnt, kernel); + if (err == -ENOENT) { + test__skip(); + return; + } + +- if (!ASSERT_OK(err, "get_addrs")) ++ if (!ASSERT_OK(err, "bpf_get_addrs")) + return; + + skel = kprobe_multi_empty__open_and_load(); +diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c +index 81943c6254e6b..d24baf244d1f3 100644 +--- a/tools/testing/selftests/bpf/trace_helpers.c ++++ b/tools/testing/selftests/bpf/trace_helpers.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include "bpf/hashmap.h" + #include "bpf/libbpf_internal.h" + + #define TRACEFS_PIPE "/sys/kernel/tracing/trace_pipe" +@@ -519,3 +520,216 @@ void read_trace_pipe(void) + { + read_trace_pipe_iter(trace_pipe_cb, NULL, 0); + } ++ ++static size_t symbol_hash(long key, void *ctx __maybe_unused) ++{ ++ return str_hash((const char *) key); ++} ++ ++static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused) ++{ ++ return strcmp((const char *) key1, (const char *) key2) == 0; ++} ++ ++static bool is_invalid_entry(char *buf, bool kernel) ++{ ++ if (kernel && strchr(buf, '[')) ++ return true; ++ if (!kernel && !strchr(buf, '[')) ++ return true; ++ return false; ++} ++ ++static bool skip_entry(char *name) ++{ ++ /* ++ * We attach to almost all kernel functions and some of them ++ * will cause 'suspicious RCU usage' when fprobe is attached ++ * to them. Filter out the current culprits - arch_cpu_idle ++ * default_idle and rcu_* functions. ++ */ ++ if (!strcmp(name, "arch_cpu_idle")) ++ return true; ++ if (!strcmp(name, "default_idle")) ++ return true; ++ if (!strncmp(name, "rcu_", 4)) ++ return true; ++ if (!strcmp(name, "bpf_dispatcher_xdp_func")) ++ return true; ++ if (!strncmp(name, "__ftrace_invalid_address__", ++ sizeof("__ftrace_invalid_address__") - 1)) ++ return true; ++ return false; ++} ++ ++/* Do comparison by ignoring '.llvm.' suffixes. */ ++static int compare_name(const char *name1, const char *name2) ++{ ++ const char *res1, *res2; ++ int len1, len2; ++ ++ res1 = strstr(name1, ".llvm."); ++ res2 = strstr(name2, ".llvm."); ++ len1 = res1 ? res1 - name1 : strlen(name1); ++ len2 = res2 ? res2 - name2 : strlen(name2); ++ ++ if (len1 == len2) ++ return strncmp(name1, name2, len1); ++ if (len1 < len2) ++ return strncmp(name1, name2, len1) <= 0 ? -1 : 1; ++ return strncmp(name1, name2, len2) >= 0 ? 1 : -1; ++} ++ ++static int load_kallsyms_compare(const void *p1, const void *p2) ++{ ++ return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name); ++} ++ ++static int search_kallsyms_compare(const void *p1, const struct ksym *p2) ++{ ++ return compare_name(p1, p2->name); ++} ++ ++int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel) ++{ ++ size_t cap = 0, cnt = 0; ++ char *name = NULL, *ksym_name, **syms = NULL; ++ struct hashmap *map; ++ struct ksyms *ksyms; ++ struct ksym *ks; ++ char buf[256]; ++ FILE *f; ++ int err = 0; ++ ++ ksyms = load_kallsyms_custom_local(load_kallsyms_compare); ++ if (!ksyms) ++ return -EINVAL; ++ ++ /* ++ * The available_filter_functions contains many duplicates, ++ * but other than that all symbols are usable to trace. ++ * Filtering out duplicates by using hashmap__add, which won't ++ * add existing entry. ++ */ ++ ++ if (access("/sys/kernel/tracing/trace", F_OK) == 0) ++ f = fopen("/sys/kernel/tracing/available_filter_functions", "r"); ++ else ++ f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r"); ++ ++ if (!f) ++ return -EINVAL; ++ ++ map = hashmap__new(symbol_hash, symbol_equal, NULL); ++ if (IS_ERR(map)) { ++ err = libbpf_get_error(map); ++ goto error; ++ } ++ ++ while (fgets(buf, sizeof(buf), f)) { ++ if (is_invalid_entry(buf, kernel)) ++ continue; ++ ++ free(name); ++ if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1) ++ continue; ++ if (skip_entry(name)) ++ continue; ++ ++ ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare); ++ if (!ks) { ++ err = -EINVAL; ++ goto error; ++ } ++ ++ ksym_name = ks->name; ++ err = hashmap__add(map, ksym_name, 0); ++ if (err == -EEXIST) { ++ err = 0; ++ continue; ++ } ++ if (err) ++ goto error; ++ ++ err = libbpf_ensure_mem((void **) &syms, &cap, ++ sizeof(*syms), cnt + 1); ++ if (err) ++ goto error; ++ ++ syms[cnt++] = ksym_name; ++ } ++ ++ *symsp = syms; ++ *cntp = cnt; ++ ++error: ++ free(name); ++ fclose(f); ++ hashmap__free(map); ++ if (err) ++ free(syms); ++ return err; ++} ++ ++int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel) ++{ ++ unsigned long *addr, *addrs, *tmp_addrs; ++ int err = 0, max_cnt, inc_cnt; ++ char *name = NULL; ++ size_t cnt = 0; ++ char buf[256]; ++ FILE *f; ++ ++ if (access("/sys/kernel/tracing/trace", F_OK) == 0) ++ f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r"); ++ else ++ f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r"); ++ ++ if (!f) ++ return -ENOENT; ++ ++ /* In my local setup, the number of entries is 50k+ so Let us initially ++ * allocate space to hold 64k entries. If 64k is not enough, incrementally ++ * increase 1k each time. ++ */ ++ max_cnt = 65536; ++ inc_cnt = 1024; ++ addrs = malloc(max_cnt * sizeof(long)); ++ if (addrs == NULL) { ++ err = -ENOMEM; ++ goto error; ++ } ++ ++ while (fgets(buf, sizeof(buf), f)) { ++ if (is_invalid_entry(buf, kernel)) ++ continue; ++ ++ free(name); ++ if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2) ++ continue; ++ if (skip_entry(name)) ++ continue; ++ ++ if (cnt == max_cnt) { ++ max_cnt += inc_cnt; ++ tmp_addrs = realloc(addrs, max_cnt); ++ if (!tmp_addrs) { ++ err = -ENOMEM; ++ goto error; ++ } ++ addrs = tmp_addrs; ++ } ++ ++ addrs[cnt++] = (unsigned long)addr; ++ } ++ ++ *addrsp = addrs; ++ *cntp = cnt; ++ ++error: ++ free(name); ++ fclose(f); ++ if (err) ++ free(addrs); ++ return err; ++} +diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h +index 2ce873c9f9aad..9437bdd4afa50 100644 +--- a/tools/testing/selftests/bpf/trace_helpers.h ++++ b/tools/testing/selftests/bpf/trace_helpers.h +@@ -41,4 +41,7 @@ ssize_t get_rel_offset(uintptr_t addr); + + int read_build_id(const char *path, char *build_id, size_t size); + ++int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel); ++int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel); ++ + #endif +-- +2.51.0 + diff --git a/queue-6.17/selftests-cgroup-make-test_pids-backwards-compatible.patch b/queue-6.17/selftests-cgroup-make-test_pids-backwards-compatible.patch new file mode 100644 index 0000000000..799906f7fb --- /dev/null +++ b/queue-6.17/selftests-cgroup-make-test_pids-backwards-compatible.patch @@ -0,0 +1,82 @@ +From dbef66d2c18a83e280b4eeae86b0dcf90bfd7eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 17:53:00 +0200 +Subject: selftests: cgroup: Make test_pids backwards compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Koutný + +[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ] + +The predicates in test expect event counting from 73e75e6fc352b +("cgroup/pids: Separate semantics of pids.events related to pids.max") +and the test would fail on older kernels. We want to have one version of +tests for all, so detect the feature and skip the test on old kernels. +(The test could even switch to check v1 semantics based on the flag but +keep it simple for now.) + +Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller") +Signed-off-by: Michal Koutný +Tested-by: Sebastian Chlad +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/cgroup/lib/cgroup_util.c | 12 ++++++++++++ + .../selftests/cgroup/lib/include/cgroup_util.h | 1 + + tools/testing/selftests/cgroup/test_pids.c | 3 +++ + 3 files changed, 16 insertions(+) + +diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c +index 0e89fcff4d05d..44c52f620fda1 100644 +--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c +@@ -522,6 +522,18 @@ int proc_mount_contains(const char *option) + return strstr(buf, option) != NULL; + } + ++int cgroup_feature(const char *feature) ++{ ++ char buf[PAGE_SIZE]; ++ ssize_t read; ++ ++ read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf)); ++ if (read < 0) ++ return read; ++ ++ return strstr(buf, feature) != NULL; ++} ++ + ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size) + { + char path[PATH_MAX]; +diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h +index c69cab66254b4..9dc90a1b386d7 100644 +--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h ++++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h +@@ -60,6 +60,7 @@ extern int cg_run_nowait(const char *cgroup, + extern int cg_wait_for_proc_count(const char *cgroup, int count); + extern int cg_killall(const char *cgroup); + int proc_mount_contains(const char *option); ++int cgroup_feature(const char *feature); + extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size); + extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle); + extern pid_t clone_into_cgroup(int cgroup_fd); +diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c +index 9ecb83c6cc5cb..d8a1d1cd50072 100644 +--- a/tools/testing/selftests/cgroup/test_pids.c ++++ b/tools/testing/selftests/cgroup/test_pids.c +@@ -77,6 +77,9 @@ static int test_pids_events(const char *root) + char *cg_parent = NULL, *cg_child = NULL; + int pid; + ++ if (cgroup_feature("pids_localevents") <= 0) ++ return KSFT_SKIP; ++ + cg_parent = cg_name(root, "pids_parent"); + cg_child = cg_name(cg_parent, "pids_child"); + if (!cg_parent || !cg_child) +-- +2.51.0 + diff --git a/queue-6.17/selftests-futex-fix-futex_wait-for-32bit-arm.patch b/queue-6.17/selftests-futex-fix-futex_wait-for-32bit-arm.patch new file mode 100644 index 0000000000..b066cdaaab --- /dev/null +++ b/queue-6.17/selftests-futex-fix-futex_wait-for-32bit-arm.patch @@ -0,0 +1,78 @@ +From fc394bf06262d8add4a3e31701fc357ccf483270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:00:11 +0200 +Subject: selftests/futex: Fix futex_wait() for 32bit ARM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 237bfb76c90b184f57bb18fe35ff366c19393dc8 ] + +On 32bit ARM systems gcc-12 will use 32bit timestamps while gcc-13 and later +will use 64bit timestamps. The problem is that SYS_futex will continue +pointing at the 32bit system call. This makes the futex_wait test fail like +this: + + waiter failed errno 110 + not ok 1 futex_wake private returned: 0 Success + waiter failed errno 110 + not ok 2 futex_wake shared (page anon) returned: 0 Success + waiter failed errno 110 + not ok 3 futex_wake shared (file backed) returned: 0 Success + +Instead of compiling differently depending on the gcc version, use the +-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 options to ensure that 64bit timestamps +are used. Then use ifdefs to make SYS_futex point to the 64bit system call. + +Signed-off-by: Dan Carpenter +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: André Almeida +Tested-by: Anders Roxell +Link: https://lore.kernel.org/20250827130011.677600-6-bigeasy@linutronix.de +Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/futex/functional/Makefile | 2 +- + tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++ + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile +index 8cfb87f7f7c50..ddfa61d857b9b 100644 +--- a/tools/testing/selftests/futex/functional/Makefile ++++ b/tools/testing/selftests/futex/functional/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + INCLUDES := -I../include -I../../ $(KHDR_INCLUDES) +-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread $(INCLUDES) $(KHDR_INCLUDES) ++CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES) + LDLIBS := -lpthread -lrt -lnuma + + LOCAL_HDRS := \ +diff --git a/tools/testing/selftests/futex/include/futextest.h b/tools/testing/selftests/futex/include/futextest.h +index 7a5fd1d5355e7..3d48e9789d9fe 100644 +--- a/tools/testing/selftests/futex/include/futextest.h ++++ b/tools/testing/selftests/futex/include/futextest.h +@@ -58,6 +58,17 @@ typedef volatile u_int32_t futex_t; + #define SYS_futex SYS_futex_time64 + #endif + ++/* ++ * On 32bit systems if we use "-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" or if ++ * we are using a newer compiler then the size of the timestamps will be 64bit, ++ * however, the SYS_futex will still point to the 32bit futex system call. ++ */ ++#if __SIZEOF_POINTER__ == 4 && defined(SYS_futex_time64) && \ ++ defined(_TIME_BITS) && _TIME_BITS == 64 ++# undef SYS_futex ++# define SYS_futex SYS_futex_time64 ++#endif ++ + /** + * futex() - SYS_futex syscall wrapper + * @uaddr: address of first futex +-- +2.51.0 + diff --git a/queue-6.17/selftests-futex-fix-some-futex_numa_mpol-subtests.patch b/queue-6.17/selftests-futex-fix-some-futex_numa_mpol-subtests.patch new file mode 100644 index 0000000000..d301d29d35 --- /dev/null +++ b/queue-6.17/selftests-futex-fix-some-futex_numa_mpol-subtests.patch @@ -0,0 +1,70 @@ +From 3c12bdda42d6cdc9a661a9b7bbb0fd74e08eb8cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:00:08 +0200 +Subject: selftests/futex: Fix some futex_numa_mpol subtests + +From: Waiman Long + +[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ] + +The "Memory out of range" subtest of futex_numa_mpol assumes that memory +access outside of the mmap'ed area is invalid. That may not be the case +depending on the actual memory layout of the test application. When that +subtest was run on an x86-64 system with latest upstream kernel, the test +passed as an error was returned from futex_wake(). On another PowerPC system, +the same subtest failed because futex_wake() returned 0. + + Bail out! futex2_wake(64, 0x86) should fail, but didn't + +Looking further into the passed subtest on x86-64, it was found that an +-EINVAL was returned instead of -EFAULT. The -EINVAL error was returned +because the node value test with FLAGS_NUMA set failed with a node value +of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed +because the supposed node number wasn't valid. If that memory location +happens to have a very small value (e.g. 0), the test will pass and no +error will be returned. + +Since this subtest is non-deterministic, drop it unless a guard page beyond +the mmap region is explicitly set. + +The other problematic test is the "Memory too small" test. The futex_wake() +function returns the -EINVAL error code because the given futex address isn't +8-byte aligned, not because only 4 of the 8 bytes are valid and the other +4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to +reflect the reality. + + [ bp: Massage commit message. ] + +Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol") +Signed-off-by: Waiman Long +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +index a9ecfb2d3932a..802c15c821906 100644 +--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c ++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c +@@ -182,12 +182,10 @@ int main(int argc, char *argv[]) + if (futex_numa->numa == FUTEX_NO_NODE) + ksft_exit_fail_msg("NUMA node is left uninitialized\n"); + +- ksft_print_msg("Memory too small\n"); ++ /* FUTEX2_NUMA futex must be 8-byte aligned */ ++ ksft_print_msg("Mis-aligned futex\n"); + test_futex(futex_ptr + mem_size - 4, 1); + +- ksft_print_msg("Memory out of range\n"); +- test_futex(futex_ptr + mem_size, 1); +- + futex_numa->numa = FUTEX_NO_NODE; + mprotect(futex_ptr, mem_size, PROT_READ); + ksft_print_msg("Memory, RO\n"); +-- +2.51.0 + diff --git a/queue-6.17/selftests-futex-remove-the-g-parameter-from-futex_pr.patch b/queue-6.17/selftests-futex-remove-the-g-parameter-from-futex_pr.patch new file mode 100644 index 0000000000..465aea4627 --- /dev/null +++ b/queue-6.17/selftests-futex-remove-the-g-parameter-from-futex_pr.patch @@ -0,0 +1,56 @@ +From 0aa87fd1884ba8b994aba5a285b0b1b7891cdc1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:00:07 +0200 +Subject: selftests/futex: Remove the -g parameter from futex_priv_hash +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Andrzej Siewior + +[ Upstream commit 2e62688d583809e832433f461194334408b10817 ] + +The -g parameter was meant to the test the immutable global hash instead of the +private hash which has been made immutable. The global hash is tested as part +at the end of the regular test. The immutable private hash been removed. + +Remove last traces of the immutable private hash. + +Fixes: 16adc7f136dc1 ("selftests/futex: Remove support for IMMUTABLE") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: André Almeida +Link: https://lore.kernel.org/20250827130011.677600-2-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/futex/functional/futex_priv_hash.c | 1 - + tools/testing/selftests/futex/functional/run.sh | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/futex/functional/futex_priv_hash.c b/tools/testing/selftests/futex/functional/futex_priv_hash.c +index aea001ac49460..ec032faca6a91 100644 +--- a/tools/testing/selftests/futex/functional/futex_priv_hash.c ++++ b/tools/testing/selftests/futex/functional/futex_priv_hash.c +@@ -132,7 +132,6 @@ static void usage(char *prog) + { + printf("Usage: %s\n", prog); + printf(" -c Use color\n"); +- printf(" -g Test global hash instead intead local immutable \n"); + printf(" -h Display this help message\n"); + printf(" -v L Verbosity level: %d=QUIET %d=CRITICAL %d=INFO\n", + VQUIET, VCRITICAL, VINFO); +diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh +index 81739849f2994..5470088dc4dfb 100755 +--- a/tools/testing/selftests/futex/functional/run.sh ++++ b/tools/testing/selftests/futex/functional/run.sh +@@ -85,7 +85,6 @@ echo + + echo + ./futex_priv_hash $COLOR +-./futex_priv_hash -g $COLOR + + echo + ./futex_numa_mpol $COLOR +-- +2.51.0 + diff --git a/queue-6.17/selftests-kselftest_harness-add-harness-selftest.exp.patch b/queue-6.17/selftests-kselftest_harness-add-harness-selftest.exp.patch new file mode 100644 index 0000000000..92c378d169 --- /dev/null +++ b/queue-6.17/selftests-kselftest_harness-add-harness-selftest.exp.patch @@ -0,0 +1,46 @@ +From 41457d235b9e45f7fe3b528422800eadef9443b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 16:26:19 +0800 +Subject: selftests/kselftest_harness: Add harness-selftest.expected to + TEST_FILES +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yi Lai + +[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ] + +The harness-selftest.expected is not installed in INSTALL_PATH. +Attempting to execute harness-selftest.sh shows warning: + +diff: ./kselftest_harness/harness-selftest.expected: No such file or +directory + +Add harness-selftest.expected to TEST_FILES. + +Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com +Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest") +Signed-off-by: Yi Lai +Reviewed-by: Thomas Weißschuh +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile +index 0617535a6ce42..d2369c01701a0 100644 +--- a/tools/testing/selftests/kselftest_harness/Makefile ++++ b/tools/testing/selftests/kselftest_harness/Makefile +@@ -2,6 +2,7 @@ + + TEST_GEN_PROGS_EXTENDED := harness-selftest + TEST_PROGS := harness-selftest.sh ++TEST_FILES := harness-selftest.expected + EXTRA_CLEAN := harness-selftest.seen + + include ../lib.mk +-- +2.51.0 + diff --git a/queue-6.17/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch b/queue-6.17/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch new file mode 100644 index 0000000000..107ddca0c6 --- /dev/null +++ b/queue-6.17/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch @@ -0,0 +1,101 @@ +From b521b24975840bab924f18e4ffa39f79e292c67e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 09:37:11 +0800 +Subject: selftests/mm: fix va_high_addr_switch.sh failure on x86_64 + +From: Chunyu Hu + +[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ] + +The test will fail as below on x86_64 with cpu la57 support (will skip if +no la57 support). Note, the test requries nr_hugepages to be set first. + + # running bash ./va_high_addr_switch.sh + # ------------------------------------- + # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK + # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK + # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK + # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK + # mmap(NULL): 0x7f55b60f9000 - OK + # mmap(low_addr): 0x40000000 - OK + # mmap(high_addr): 0x1000000000000 - OK + # mmap(high_addr) again: 0xffff55b6136000 - OK + # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK + # mmap(-1): 0xffff55b6134000 - OK + # mmap(-1) again: 0xffff55b6132000 - OK + # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK + # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK + # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK + # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK + # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK + # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK + # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK + # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK + # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK + # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK + # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK + # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK + # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED + # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK + # [FAIL] + +addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for +x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit. + +Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} +functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch +code arch/x86/mm/hugetlbpage.c and addr is checked with +map_address_hint_valid() after align with 'addr &= huge_page_mask(h)' +which is a round down way, and it will fail the check because the addr is +within the DEFAULT_MAP_WINDOW but (addr + len) is above the +DFEFAULT_MAP_WINDOW. So it wil go through the +hugetlb_get_unmmaped_area_top_down() to find an area within the +DFEFAULT_MAP_WINDOW. + +After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} +functions"). The addr hint for hugetlb_get_unmmaped_area() will be +rounded up and aligned to hugepage size with ALIGN() for all arches. And +after the align, the addr will be above the default MAP_DEFAULT_WINDOW, +and the map_addresshint_valid() check will pass because both aligned addr +(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned +hint address (0x800000000000) is returned as an suitable gap is found +there, in arch_get_unmapped_area_topdown(). + +To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and +addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last +hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr, +and the addr + len (2 hugepages) will be one hugepage above the +DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page +round up or round down from kernel, so it's determistic. + +Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com +Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions") +Signed-off-by: Chunyu Hu +Suggested-by: David Hildenbrand +Acked-by: David Hildenbrand +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c +index 896b3f73fc53b..306eba8251077 100644 +--- a/tools/testing/selftests/mm/va_high_addr_switch.c ++++ b/tools/testing/selftests/mm/va_high_addr_switch.c +@@ -230,10 +230,10 @@ void testcases_init(void) + .msg = "mmap(-1, MAP_HUGETLB) again", + }, + { +- .addr = (void *)(addr_switch_hint - pagesize), ++ .addr = (void *)(addr_switch_hint - hugepagesize), + .size = 2 * hugepagesize, + .flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS, +- .msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)", ++ .msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)", + .low_addr_required = 1, + .keep_mapped = 1, + }, +-- +2.51.0 + diff --git a/queue-6.17/selftests-nolibc-fix-expect_nz-macro.patch b/queue-6.17/selftests-nolibc-fix-expect_nz-macro.patch new file mode 100644 index 0000000000..b4ad72d88b --- /dev/null +++ b/queue-6.17/selftests-nolibc-fix-expect_nz-macro.patch @@ -0,0 +1,42 @@ +From 4695c0af2556b2804a94db2b68b5bdd679255a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 22:12:22 +0200 +Subject: selftests/nolibc: fix EXPECT_NZ macro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benjamin Berg + +[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ] + +The expect non-zero macro was incorrect and never used. Fix its +definition. + +Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests") +Signed-off-by: Benjamin Berg +Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index cc4d730ac4656..d074878eb2341 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen) + } + + +-#define EXPECT_NZ(cond, expr, val) \ +- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) ++#define EXPECT_NZ(cond, expr) \ ++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) + + static __attribute__((unused)) + int expect_nz(int expr, int llen) +-- +2.51.0 + diff --git a/queue-6.17/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch b/queue-6.17/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch new file mode 100644 index 0000000000..6fa1dcff2b --- /dev/null +++ b/queue-6.17/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch @@ -0,0 +1,79 @@ +From 196a33a040f60f92b06b4d6a0e88481e9b64c5dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:02 +0200 +Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ] + +The _rval register variable is meant to be an output operand of the asm +statement but is instead used as input operand. +clang 20.1 notices this and triggers -Wuninitialized warnings: + +tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized] + 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL' + 59 | : "r" (_rval) \ + | ^~~~~ +tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here +tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL' + 47 | register long _rval asm ("r3"); \ + | ^ + +It seems the list of input and output operands have been switched around. +However as the argument registers are not always initialized they can not +be marked as pure inputs as that would trigger -Wuninitialized warnings. +Adding _rval as another input and output operand does also not work as it +would collide with the existing _r3 variable. + +Instead reuse _r3 for both the argument and the return value. + +Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc") +Reported-by: kernel test robot +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Reviewed-by: Christophe Leroy +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de +Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_call.h | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h +index bb237d771051b..e7205584cbdca 100644 +--- a/tools/testing/selftests/vDSO/vdso_call.h ++++ b/tools/testing/selftests/vDSO/vdso_call.h +@@ -44,7 +44,6 @@ + register long _r6 asm ("r6"); \ + register long _r7 asm ("r7"); \ + register long _r8 asm ("r8"); \ +- register long _rval asm ("r3"); \ + \ + LOADARGS_##nr(fn, args); \ + \ +@@ -54,13 +53,13 @@ + " bns+ 1f\n" \ + " neg 3, 3\n" \ + "1:" \ +- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \ ++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \ + "+r" (_r6), "+r" (_r7), "+r" (_r8) \ +- : "r" (_rval) \ ++ : \ + : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \ + "cr6", "cr7", "xer", "lr", "ctr", "memory" \ + ); \ +- _rval; \ ++ _r3; \ + }) + + #else +-- +2.51.0 + diff --git a/queue-6.17/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch b/queue-6.17/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch new file mode 100644 index 0000000000..ccbeff46fa --- /dev/null +++ b/queue-6.17/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch @@ -0,0 +1,62 @@ +From ec479d5d63b6f46ea5fff7137693073f7482a9d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 07:39:03 +0200 +Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with + missing vDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ] + +If AT_SYSINFO_EHDR is missing the whole test needs to be skipped. +Currently this results in the following output: + + TAP version 13 + 1..16 + # AT_SYSINFO_EHDR is not present! + +This output is incorrect, as "1..16" still requires the subtest lines to +be printed, which isn't done however. + +Switch to the correct skipping functions, so the output now correctly +indicates that no subtests are being run: + + TAP version 13 + 1..0 # SKIP AT_SYSINFO_EHDR is not present! + +Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c +index a54424e2336f4..67cbfc56e4e1b 100644 +--- a/tools/testing/selftests/vDSO/vdso_test_abi.c ++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c +@@ -182,12 +182,11 @@ int main(int argc, char **argv) + unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR); + + ksft_print_header(); +- ksft_set_plan(VDSO_TEST_PLAN); + +- if (!sysinfo_ehdr) { +- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n"); +- return KSFT_SKIP; +- } ++ if (!sysinfo_ehdr) ++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n"); ++ ++ ksft_set_plan(VDSO_TEST_PLAN); + + version = versions[VDSO_VERSION]; + name = (const char **)&names[VDSO_NAMES]; +-- +2.51.0 + diff --git a/queue-6.17/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.17/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..f3f52c4e2f --- /dev/null +++ b/queue-6.17/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From f5227f01053e3ea9e7e984926614a23e98b7dc67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index a1f506ba55786..4f09c5db0c7f3 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-6.17/serial-max310x-add-error-checking-in-probe.patch b/queue-6.17/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..3d0eb6eeba --- /dev/null +++ b/queue-6.17/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From 194b3c3dd7ac2b6580a4bebaf58a9ab5def5079a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index ce260e9949c3c..d9a0100b92d2b 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regcfg_i2c.name = max310x_regmap_name(i); + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series new file mode 100644 index 0000000000..ba5933daa7 --- /dev/null +++ b/queue-6.17/series @@ -0,0 +1,497 @@ +arch-copy_thread-pass-clone_flags-as-u64.patch +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +init-initramfs_preserve_mtime-should-depend-on-blk_d.patch +pid-use-ns_capable_noaudit-when-determining-net-sysc.patch +fix-cc_has_asm_goto_output-on-non-x86-architectures.patch +seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch +kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +selftests-arm64-fix-waddress-warning-in-tpidr2-test.patch +kselftest-arm64-gcs-correctly-check-return-value-whe.patch +hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch +gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch +gfs2-remove-space-before-newline.patch +gfs2-further-sanitize-lock_dlm.c.patch +gfs2-fix-lm_flag_try-logic-in-add_to_queue.patch +gfs2-remove-duplicate-check-in-do_xmote.patch +gfs2-get-rid-of-glf_invalidate_in_progress.patch +gfs2-do_xmote-cleanup.patch +gfs2-add-proper-lockspace-locking.patch +powerpc-8xx-remove-left-over-instruction-and-comment.patch +powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch +powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch +powerpc64-modules-correctly-iterate-over-stubs-in-se.patch +uprobes-uprobe_warn-should-use-passed-task.patch +raid6-riscv-clean-up-unused-header-file-inclusion.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +erofs-avoid-reading-more-for-fragment-maps.patch +smb-client-fix-sending-the-iwrap-custom-ird-ord-nego.patch +smb-server-fix-ird-ord-negotiation-with-the-client.patch +edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch +perf-x86-intel-use-early_initcall-to-hook-bts_init.patch +perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +selftests-cgroup-make-test_pids-backwards-compatible.patch +sched-fair-get-rid-of-sched_domains_curr_level-hack-.patch +lsm-config_lsm-can-depend-on-config_security.patch +cpuset-fix-failure-to-enable-isolated-partition-when.patch +btrfs-return-any-hit-error-from-extent_writepage_io.patch +btrfs-fix-symbolic-link-reading-when-bs-ps.patch +pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch +gpio-todo-remove-the-task-for-converting-to-the-new-.patch +arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch +bpf-tidy-verifier-bug-message.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +selftests-bpf-copy-test_kmods-when-installing-selfte.patch +rust-cpumask-mark-cpumaskvar-as-transparent.patch +bpf-selftests-fix-test_tcpnotify_user.patch +bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch +libbpf-fix-reuse-of-devmap.patch +tools-nolibc-fix-error-return-value-of-clock_nanosle.patch +arm-dts-renesas-porter-fix-can-pin-group.patch +leds-max77705-function-return-instead-of-variable-as.patch +leds-flash-leds-qcom-flash-update-torch-current-clam.patch +s390-bpf-do-not-write-tail-call-counter-into-helper-.patch +s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch +s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch +arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch +libbpf-export-bpf_object__prepare-symbol.patch +firmware-arm_scmi-mark-virtio-ready-before-registeri.patch +arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch +arm64-dts-imx93-kontron-fix-usb-port-assignment.patch +arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch +bpf-remove-preempt_disable-in-bpf_try_get_buffers.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +genirq-add-irq_chip_-startup-shutdown-_parent.patch +pci-msi-add-startup-shutdown-for-per-device-domains.patch +irqchip-sg2042-msi-fix-broken-affinity-setting.patch +scripts-misc-check-update-export-checks-for-export_s.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +selftests-futex-remove-the-g-parameter-from-futex_pr.patch +arm-at91-pm-fix-mckx-restore-routine.patch +arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +selftests-futex-fix-some-futex_numa_mpol-subtests.patch +tools-nolibc-avoid-error-in-dup2-if-old-fd-equals-ne.patch +selftests-nolibc-fix-expect_nz-macro.patch +leds-leds-lp55xx-use-correct-address-for-memory-prog.patch +pci-msi-check-msi_flag_pci_msi_mask_parent-in-cond_-.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch +dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch +genirq-test-fix-depth-tests-on-architectures-with-no.patch +genirq-test-select-irq_domain.patch +genirq-test-depend-on-sparse_irq.patch +genirq-test-drop-config_generic_irq_migration-assump.patch +genirq-test-ensure-cpu-1-is-online-for-hotplug-test.patch +selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch +vdso-datastore-gate-time-data-behind-config_generic_.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +blk-mq-fix-elevator-depth_updated-method.patch +vdso-add-struct-__kernel_old_timeval-forward-declara.patch +arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch +arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch +arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch +pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch +power-supply-cw2015-fix-a-alignment-coding-style-iss.patch +hwmon-asus-ec-sensors-narrow-lock-for-x870e-creator-.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +pinctrl-eswin-fix-regulator-error-check-and-kconfig-.patch +null_blk-fix-the-description-of-the-cache_size-modul.patch +blk-throttle-fix-access-race-during-throttle-policy-.patch +selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch +selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch +irqchip-gic-v5-fix-loop-in-gicv5_its_create_itt_two_.patch +irqchip-gic-v5-fix-error-handling-in-gicv5_its_irq_d.patch +tick-do-not-set-device-to-detached-state-in-tick_shu.patch +arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch +arm64-dts-mediatek-mt8183-fix-out-of-range-pull-valu.patch +nbd-restrict-sockets-to-tcp-and-udp.patch +pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +dts-arm-amlogic-fix-pwm-node-for-c3.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch +soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch +cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch +block-cleanup-bio_issue.patch +block-initialize-bio-issue-time-in-blk_mq_submit_bio.patch +block-factor-out-a-helper-bio_submit_split_bioset.patch +block-skip-unnecessary-checks-for-split-bio.patch +block-fix-ordering-of-recursive-split-io.patch +blk-mq-remove-useless-checkings-in-blk_mq_update_nr_.patch +blk-mq-check-invalid-nr_requests-in-queue_requests_s.patch +blk-mq-convert-to-serialize-updating-nr_requests-wit.patch +blk-mq-cleanup-shared-tags-case-in-blk_mq_update_nr_.patch +blk-mq-split-bitmap-grow-and-resize-case-in-blk_mq_u.patch +blk-mq-sched-add-new-parameter-nr_requests-in-blk_mq.patch +blk-mq-fix-potential-deadlock-while-nr_requests-grow.patch +arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch +arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch +arm64-dts-rockchip-add-rtc-on-rk3576-evb1-v10.patch +arm64-dts-rockchip-add-wifi-on-rk3576-evb1-v10.patch +arm64-dts-rockchip-fix-network-on-rk3576-evb1-board.patch +arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch +arm64-dts-ti-k3-rename-rproc-reserved-mem-nodes-to-m.patch +revert-arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-car.patch +revert-arm64-dts-ti-k3-j721e-beagleboneai64-fix-reve.patch +arm64-dts-mediatek-mt8188-change-efuse-fallback-comp.patch +arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch +arm64-dts-ti-k3-pinctrl-fix-the-bug-in-existing-macr.patch +arm64-dts-renesas-r9a09g047e57-smarc-fix-gpio-key-s-.patch +arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch +mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch +arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch +arm64-dts-mediatek-mt7986a-fix-pci-express-t-phy-nod.patch +arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +arm64-dts-allwinner-a527-cubie-a5e-add-leds.patch +arm64-dts-allwinner-a527-cubie-a5e-drop-external-32..patch +arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch +arm64-dts-allwinner-t527-orangepi-4a-hook-up-externa.patch +pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch +pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch +pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +acpica-apply-acpi_nonstring.patch +acpica-fix-largest-possible-resource-descriptor-inde.patch +riscv-bpf-sign-extend-struct-ops-return-values-prope.patch +nvme-auth-update-bi_directional-flag.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +nvmet-fcloop-call-done-callback-even-when-remote-por.patch +nvme-tcp-send-only-permitted-commands-for-secure-con.patch +i3c-master-svc-use-manual-response-for-ibi-events.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +block-update-validation-of-atomic-writes-boundary-fo.patch +block-fix-stacking-of-atomic-writes-when-atomics-are.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +selftests-kselftest_harness-add-harness-selftest.exp.patch +blk-throttle-fix-throtl_data-leak-during-disk-releas.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +mmc-select-regmap_mmio-with-mmc_loongson2.patch +selftests-futex-fix-futex_wait-for-32bit-arm.patch +selftest-futex-make-the-error-check-more-precise-for.patch +selftest-futex-compile-also-with-libnuma-2.0.16.patch +bpf-dont-report-verifier-bug-for-missing-bpf_scc_vis.patch +bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch +arm64-dts-apple-t600x-add-missing-wifi-properties.patch +arm64-dts-apple-t600x-add-bluetooth-device-nodes.patch +arm64-dts-apple-add-ethernet0-alias-for-j375-templat.patch +selftests-always-install-uapi-headers-to-the-correct.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +mfd-max77705-max77705_charger-move-active-discharge-.patch +power-supply-max77705_charger-refactoring-rename-cha.patch +power-supply-max77705_charger-use-regfields-for-conf.patch +power-supply-max77705_charger-rework-interrupts.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +spi-fix-return-code-when-spi-device-has-too-many-chi.patch +clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch +clocksource-drivers-tegra186-avoid-64-bit-division.patch +bpf-mark-kfuncs-as-__noclone.patch +once-fix-race-by-moving-do_once-to-separate-section.patch +hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch +tools-nolibc-add-stdbool.h-to-nolibc-includes.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch +i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch +i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch +i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch +i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch +i2c-designware-fix-clock-issue-when-pm-is-disabled.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch +bpf-enforce-expected_attach_type-for-tailcall-compat.patch +i3c-fix-big-endian-fifo-transfers.patch +mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch +drm-sched-fix-a-race-in-drm_gpu_sched_stat_no_hang-t.patch +drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch +drm-display-bridge-connector-correct-cec-bridge-poin.patch +drm-panel-edp-add-50ms-disable-delay-for-four-panels.patch +drm-vmwgfx-fix-missing-assignment-to-ts.patch +drm-amd-display-reduce-stack-usage-by-moving-audio_o.patch +drm-panel-novatek-nt35560-fix-invalid-return-value.patch +drm-amdgpu-fix-link-error-for-pm_sleep.patch +drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch +drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch +pci-endpoint-pci-ep-msi-fix-null-vs-is_err-check-in-.patch +pci-xgene-msi-return-negative-einval-in-xgene_msi_ha.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +f2fs-fix-condition-in-__allow_reserved_blocks.patch +f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch +f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch +drm-bridge-it6505-select-regmap_i2c.patch +wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch +hid-steelseries-refactor-probe-and-remove.patch +drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch +media-zoran-remove-zoran_fh-structure.patch +phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch +drm-bridge-cdns-dsi-fix-the-_atomic_check.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch +pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch +misc-pci_endpoint_test-fix-array-underflow-in-pci_en.patch +serial-max310x-add-error-checking-in-probe.patch +drm-amd-display-remove-redundant-semicolons.patch +drm-amd-display-add-null-pointer-checks-in-dc_stream.patch +crypto-keembay-add-missing-check-after-sg_nents_for_.patch +hwrng-nomadik-add-arm_amba-dependency.patch +docs-iio-ad3552r-fix-malformed-code-block-directive.patch +fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch +scsi-pm80xx-restore-support-for-expanders.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-libsas-add-dev_parent_is_expander-helper.patch +scsi-pm80xx-use-dev_parent_is_expander-helper.patch +scsi-pm80xx-add-helper-function-to-get-the-local-phy.patch +scsi-pm80xx-fix-pm8001_abort_task-for-chip_8006-when.patch +mptcp-fix-up-subflow-s-memcg-when-config_sock_cgroup.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +f2fs-fix-to-clear-unusable_cap-for-checkpoint-enable.patch +f2fs-fix-to-avoid-null-pointer-dereference-in-f2fs_c.patch +f2fs-fix-to-allow-removing-qf_name.patch +drm-dp-drm_edp_backlight_set_level-do-not-always-sen.patch +crypto-octeontx2-call-strscpy-with-correct-size-argu.patch +drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +media-staging-ipu7-convert-to-use-pci_alloc_irq_vect.patch +media-staging-ipu7-don-t-set-name-for-ipu7-pci-devic.patch +media-staging-ipu7-cleanup-the-mmu-correctly-in-ipu7.patch +media-i2c-vd55g1-fix-duster-register-address.patch +drm-panel-allow-powering-on-panel-follower-after-pan.patch +hid-i2c-hid-make-elan-touch-controllers-power-on-aft.patch +rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch +rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch +wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch +net-phy-introduce-phy_id_compare_vendor-phy-id-helpe.patch +net-phy-as21xxx-better-handle-phy-hw-reset-on-soft-r.patch +pci-rcar-host-pass-proper-irq-domain-to-generic_hand.patch +fuse-remove-unneeded-offset-assignment-when-filling-.patch +pci-qcom-restrict-port-parsing-only-to-pcie-bridge-c.patch +cdx-don-t-select-config_generic_msi_irq.patch +pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch +hid-i2c-hid-fix-test-in-i2c_hid_core_register_panel_.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +media-st-delta-avoid-excessive-stack-usage.patch +drm-amdgpu-vcn-add-regdump-helper-functions.patch +drm-amdgpu-vcn-hold-pg_lock-before-vcn-power-off.patch +drm-amdgpu-check-vcn-state-before-profile-switch.patch +accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch +efi-explain-ovmf-acronym-in-ovmf_debug_log-help-text.patch +net-dst-introduce-dst-dev_rcu.patch +ipv6-mcast-add-ip6_mc_find_idev-helper.patch +ipv6-start-using-dst_dev_rcu.patch +ipv6-use-rcu-in-ip6_xmit.patch +ipv6-use-rcu-in-ip6_output.patch +net-use-dst_dev_rcu-in-sk_setup_caps.patch +tcp_metrics-use-dst_dev_net_rcu.patch +ipv4-start-using-dst_dev_rcu.patch +crypto-hisilicon-zip-remove-unnecessary-validation-f.patch +crypto-hisilicon-re-enable-address-prefetch-after-de.patch +crypto-hisilicon-check-the-sva-module-status-while-e.patch +crypto-hisilicon-qm-check-whether-the-input-function.patch +crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch +inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch +dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch +coresight-trbe-add-isb-after-trblimitr-write.patch +coresight-fix-missing-include-for-field_get.patch +coresight-only-register-perf-symlink-for-sinks-with-.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch +drm-amd-pm-fix-si_upload_smc_data-v3.patch +drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch +drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch +drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch +drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch +wifi-mac80211-make-connection_monitor-optional-for-m.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-label.patch +drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +wifi-mac80211-consider-links-for-validating-scan_fla.patch +pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +fanotify-validate-the-return-value-of-mnt_ns_from_de.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +drm-msm-fix-obj-leak-in-vm_bind-error-path.patch +drm-msm-fix-missing-vm_bind-offset-range-validation.patch +wifi-iwlwifi-remove-redundant-header-files.patch +drm-msm-mdp4-stop-supporting-no-iommu-configuration.patch +drm-msm-stop-supporting-no-iommu-configuration.patch +idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +ipv6-snmp-do-not-use-snmp_mib_sentinel-anymore.patch +ipv6-snmp-do-not-track-per-idev-icmp6_mib_ratelimith.patch +drm-msm-fix-bootup-splat-with-separate_gpu_drm-modpa.patch +drm-msm-dpu-fix-incorrect-type-for-ret.patch +wifi-mac80211-fix-reporting-of-all-valid-links-in-st.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch +iio-consumers-fix-handling-of-negative-channel-scale.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch +tools-ynl-fix-undefined-variable-name.patch +rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-m.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +ipvs-use-read_once-write_once-for-ipvs-enable.patch +hid-steelseries-fix-steelseries_srws1-handling-in-st.patch +watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +pci-endpoint-pci-epf-test-fix-doorbell-test-support.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch +wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch +wifi-mt76-mt7996-check-phy-before-init-msta_link-in-.patch +wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch +wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch +wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch +wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch +wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch +asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch +srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch +drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch +f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch +f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch +f2fs-fix-to-avoid-migrating-empty-section.patch +f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch +risc-v-kvm-write-hgatp-register-with-valid-mode-bits.patch +alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +pci-fix-pdev_resources_assignable-disparity.patch +pci-use-pci_release_resource-instead-of-release_reso.patch +pci-preserve-bridge-window-resource-type-flags.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch +hid-hidraw-tighten-ioctl-command-parsing.patch +f2fs-fix-zero-sized-extent-for-precache-extents.patch +smc-fix-use-after-free-in-__pnet_find_base_ndev.patch +smc-use-__sk_dst_get-and-dst_dev_rcu-in-in-smc_clc_p.patch +smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_clc_prfx.patch +smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_vlan_by_.patch +tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_f.patch +mptcp-call-dst_release-in-mptcp_active_enable.patch +mptcp-use-__sk_dst_get-and-dst_dev_rcu-in-mptcp_acti.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +asoc-sof-ipc4-pcm-fix-incorrect-comparison-with-numb.patch +wifi-ath12k-initialize-eirp_power-before-use.patch +wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch +wifi-ath12k-fix-signal-in-radiotap-for-wcn7850.patch +wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch +wifi-ath12k-fix-the-fetching-of-combined-rssi.patch +wifi-ath12k-add-fallback-for-invalid-channel-number-.patch +wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch +wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch +asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-26037 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16989 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-29384 +vfio-pds-replace-bitmap_free-with-vfree.patch +crypto-comp-use-same-definition-of-context-alloc-and.patch +crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch +wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch +rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch +remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch +rdma-rxe-fix-race-in-do_task-when-draining.patch +selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch +wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch +wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch +pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch +wifi-ath12k-refactor-rx-tid-deletion-handling-into-h.patch +wifi-ath12k-fix-flush-cache-failure-during-rx-queue-.patch +wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch +dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch +coresight-fix-indentation-error-in-cscfg_remove_owne.patch +coresight-etm4x-conditionally-access-register-trcext.patch +coresight-tmc-support-atclk.patch +coresight-catu-support-atclk.patch +coresight-etm4x-support-atclk.patch +coresight-appropriately-disable-programming-clocks.patch +coresight-appropriately-disable-trace-bus-clocks.patch +coresight-avoid-enable-programming-clock-duplicately.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +coresight-tpda-fix-the-logic-to-setup-the-element-si.patch +coresight-fix-incorrect-handling-for-return-value-of.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +net-ethtool-tsconfig-set-command-must-provide-a-repl.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch +netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch +scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch +pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch +pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch +asoc-qcom-sc8280xp-use-sa8775p-subdir-for-qcs9100-qc.patch +iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch +iommu-selftest-prevent-use-of-uninitialized-variable.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-enetc-fix-probing-error-message-typo-for-the-ene.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +ptp-add-a-upper-bound-on-max_vclocks.patch +vhost-vringh-fix-copy_to_iter-return-value-check.patch +net-macb-remove-illusion-about-tbqph-rbqph-being-per.patch +net-macb-move-ring-size-computation-to-functions.patch +net-macb-single-dma_alloc_coherent-for-dma-descripto.patch +bluetooth-btintel_pcie-refactor-device-coredump.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch +bluetooth-iso-free-rx_skb-if-not-consumed.patch +bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch +bluetooth-hci_sync-fix-using-random-address-for-big-.patch +keys-x.509-fix-basic-constraints-ca-flag-parsing.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +cramfs-fix-incorrect-physical-page-address-calculati.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch +mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch +pci-j721e-fix-incorrect-error-message-in-probe.patch +idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch +tcp-use-skb-len-instead-of-skb-truesize-in-tcp_can_i.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +net-mlx5-stop-polling-for-command-response-if-interf.patch +net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch +net-mlx5-fw-reset-add-reset-timeout-work.patch +smb-client-fix-crypto-buffers-in-non-linear-memory.patch +bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch +net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch +iommufd-register-iommufd-mock-devices-with-fwspec.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch +nfsd-filecache-add-statx_dioalign-and-statx_dio_read.patch +nfs-localio-avoid-issuing-misaligned-io-using-o_dire.patch +octeontx2-vf-fix-bitmap-leak.patch +octeontx2-pf-fix-bitmap-leak.patch +vhost-vringh-modify-the-return-value-check.patch +selftests-bpf-fix-typos-and-grammar-in-test-sources.patch +selftests-bpf-move-get_ksyms-and-get_addrs-to-trace_.patch +selftests-bpf-fix-realloc-size-in-bpf_get_addrs.patch +bpf-skip-scalar-adjustment-for-bpf_neg-if-dst-is-a-p.patch +bpf-reject-negative-offsets-for-alu-ops.patch diff --git a/queue-6.17/smb-client-fix-crypto-buffers-in-non-linear-memory.patch b/queue-6.17/smb-client-fix-crypto-buffers-in-non-linear-memory.patch new file mode 100644 index 0000000000..d8ba0af567 --- /dev/null +++ b/queue-6.17/smb-client-fix-crypto-buffers-in-non-linear-memory.patch @@ -0,0 +1,169 @@ +From cce7c36f11e76c4e0abb0f2009d85d8be4870fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 12:10:33 -0300 +Subject: smb: client: fix crypto buffers in non-linear memory + +From: Enzo Matsumiya + +[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ] + +The crypto API, through the scatterlist API, expects input buffers to be +in linear memory. We handle this with the cifs_sg_set_buf() helper +that converts vmalloc'd memory to their corresponding pages. + +However, when we allocate our aead_request buffer (@creq in +smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly +puts aead_request->__ctx in vmalloc area. + +AEAD algorithm then uses ->__ctx for its private/internal data and +operations, and uses sg_set_buf() for such data on a few places. + +This works fine as long as @creq falls into kmalloc zone (small +requests) or vmalloc'd memory is still within linear range. + +Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too +many tasks will increment the base stacks' addresses to a point where +virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that +happens. + +In practice: too many parallel reads and writes on an encrypted mount +will trigger this bug. + +To fix this, always alloc @creq with kmalloc() instead. +Also drop the @sensitive_size variable/arguments since +kfree_sensitive() doesn't need it. + +Backtrace: + +[ 945.272081] ------------[ cut here ]------------ +[ 945.272774] kernel BUG at include/linux/scatterlist.h:209! +[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) +[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 +[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) +[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 +[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b +[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 +[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 +[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 +[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 +[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 +[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 +[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 +[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 +[ 945.286683] Call Trace: +[ 945.286952] +[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] +[ 945.287719] crypto_gcm_encrypt+0x36/0xe0 +[ 945.288152] crypt_message+0x54a/0xad0 [cifs] +[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] +[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] +[ 945.289944] cifs_call_async+0x178/0x340 [cifs] +[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] +[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] +[ 945.291759] ? find_held_lock+0x32/0x90 +[ 945.292212] ? netfs_advance_write+0xf2/0x310 +[ 945.292723] netfs_advance_write+0xf2/0x310 +[ 945.293210] netfs_write_folio+0x346/0xcc0 +[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 +[ 945.294250] netfs_writepages+0x117/0x460 +[ 945.294724] do_writepages+0xbe/0x170 +[ 945.295152] ? find_held_lock+0x32/0x90 +[ 945.295600] ? kvm_sched_clock_read+0x11/0x20 +[ 945.296103] __writeback_single_inode+0x56/0x4b0 +[ 945.296643] writeback_sb_inodes+0x229/0x550 +[ 945.297140] __writeback_inodes_wb+0x4c/0xe0 +[ 945.297642] wb_writeback+0x2f1/0x3f0 +[ 945.298069] wb_workfn+0x300/0x490 +[ 945.298472] process_one_work+0x1fe/0x590 +[ 945.298949] worker_thread+0x1ce/0x3c0 +[ 945.299397] ? __pfx_worker_thread+0x10/0x10 +[ 945.299900] kthread+0x119/0x210 +[ 945.300285] ? __pfx_kthread+0x10/0x10 +[ 945.300729] ret_from_fork+0x119/0x1b0 +[ 945.301163] ? __pfx_kthread+0x10/0x10 +[ 945.301601] ret_from_fork_asm+0x1a/0x30 +[ 945.302055] + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: Enzo Matsumiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index e586f3f4b5c93..68286673afc99 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct sg_table *sgt, +- unsigned int *num_sgs, size_t *sensitive_size) ++ unsigned int *num_sgs) + { + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); +@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += array_size(*num_sgs, sizeof(struct scatterlist)); +- *sensitive_size = len; + +- p = kvzalloc(len, GFP_NOFS); ++ p = kzalloc(len, GFP_NOFS); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + + static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, +- struct aead_request **req, struct scatterlist **sgl, +- size_t *sensitive_size) ++ struct aead_request **req, struct scatterlist **sgl) + { + struct sg_table sgtable = {}; + unsigned int skip, num_sgs, i, j; + ssize_t rc; + void *p; + +- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, +- &num_sgs, sensitive_size); ++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); + if (IS_ERR(p)) + return ERR_CAST(p); + +@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + DECLARE_CRYPTO_WAIT(wait); + unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; +- size_t sensitive_size; + + rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); + if (rc) { +@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + return rc; + } + +- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, +- &sensitive_size); ++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (IS_ERR(creq)) + return PTR_ERR(creq); + +@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + if (!rc && enc) + memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); + +- kvfree_sensitive(creq, sensitive_size); ++ kfree_sensitive(creq); + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.17/smb-client-fix-sending-the-iwrap-custom-ird-ord-nego.patch b/queue-6.17/smb-client-fix-sending-the-iwrap-custom-ird-ord-nego.patch new file mode 100644 index 0000000000..2069aaffc4 --- /dev/null +++ b/queue-6.17/smb-client-fix-sending-the-iwrap-custom-ird-ord-nego.patch @@ -0,0 +1,228 @@ +From cb03d3086e9f5bcfe48ea5532528a3958d9c1f41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 11:25:06 +0200 +Subject: smb: client: fix sending the iwrap custom IRD/ORD negotiation + messages + +From: Stefan Metzmacher + +[ Upstream commit ef71f1e046489c77a2f7d012edc762fba0a7aadc ] + +Do a real negotiation and check the servers initiator_depth and +responder_resources. + +This should use big endian in order to be useful. +I have captures of windows clients showing this. + +The fact that we used little endian up to now +means that we sent very large numbers and the +negotiation with the server truncated them to the +server limits. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +The inconsitency regarding the initiator_depth +and responder_resources values being reversed +for iwarp devices in RDMA_CM_EVENT_ESTABLISHED +should also be fixed later, but for now we should +fix it. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Acked-by: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 110 ++++++++++++++++++++++++++++++++++---- + fs/smb/client/smbdirect.h | 4 +- + 2 files changed, 103 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index e0fce5033004c..6480945c24592 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -179,6 +179,8 @@ static int smbd_conn_upcall( + struct smbd_connection *info = id->context; + struct smbdirect_socket *sc = &info->socket; + const char *event_name = rdma_event_msg(event->event); ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + + log_rdma_event(INFO, "event=%s status=%d\n", + event_name, event->status); +@@ -204,6 +206,85 @@ static int smbd_conn_upcall( + + case RDMA_CM_EVENT_ESTABLISHED: + log_rdma_event(INFO, "connected event=%s\n", event_name); ++ ++ /* ++ * Here we work around an inconsistency between ++ * iWarp and other devices (at least rxe and irdma using RoCEv2) ++ */ ++ if (rdma_protocol_iwarp(id->device, id->port_num)) { ++ /* ++ * iWarp devices report the peer's values ++ * with the perspective of the peer here. ++ * Tested with siw and irdma (in iwarp mode) ++ * We need to change to our perspective here, ++ * so we need to switch the values. ++ */ ++ peer_initiator_depth = event->param.conn.responder_resources; ++ peer_responder_resources = event->param.conn.initiator_depth; ++ } else { ++ /* ++ * Non iWarp devices report the peer's values ++ * already changed to our perspective here. ++ * Tested with rxe and irdma (in roce mode). ++ */ ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ } ++ if (rdma_protocol_iwarp(id->device, id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ info->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ info->initiator_depth = ++ min_t(u8, info->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ info->responder_resources = ++ min_t(u8, info->responder_resources, ++ peer_responder_resources); ++ + sc->status = SMBDIRECT_SOCKET_CONNECTED; + wake_up_interruptible(&info->status_wait); + break; +@@ -1551,7 +1632,7 @@ static struct smbd_connection *_smbd_get_connection( + struct ib_qp_init_attr qp_attr; + struct sockaddr_in *addr_in = (struct sockaddr_in *) dstaddr; + struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + + info = kzalloc(sizeof(struct smbd_connection), GFP_KERNEL); + if (!info) +@@ -1559,6 +1640,9 @@ static struct smbd_connection *_smbd_get_connection( + sc = &info->socket; + sp = &sc->parameters; + ++ info->initiator_depth = 1; ++ info->responder_resources = SMBD_CM_RESPONDER_RESOURCES; ++ + sc->status = SMBDIRECT_SOCKET_CONNECTING; + rc = smbd_ia_open(info, dstaddr, port); + if (rc) { +@@ -1639,22 +1723,22 @@ static struct smbd_connection *_smbd_get_connection( + } + sc->ib.qp = sc->rdma.cm_id->qp; + +- memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = 0; +- +- conn_param.responder_resources = +- min(sc->ib.dev->attrs.max_qp_rd_atom, +- SMBD_CM_RESPONDER_RESOURCES); +- info->responder_resources = conn_param.responder_resources; ++ info->responder_resources = ++ min_t(u8, info->responder_resources, ++ sc->ib.dev->attrs.max_qp_rd_atom); + log_rdma_mr(INFO, "responder_resources=%d\n", + info->responder_resources); + ++ memset(&conn_param, 0, sizeof(conn_param)); ++ conn_param.initiator_depth = info->initiator_depth; ++ conn_param.responder_resources = info->responder_resources; ++ + /* Need to send IRD/ORD in private data for iWARP */ + sc->ib.dev->ops.get_port_immutable( + sc->ib.dev, sc->rdma.cm_id->port_num, &port_immutable); + if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = info->responder_resources; +- ird_ord_hdr[1] = 1; ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2121,6 +2205,12 @@ static int allocate_mr_list(struct smbd_connection *info) + atomic_set(&info->mr_used_count, 0); + init_waitqueue_head(&info->wait_for_mr_cleanup); + INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); ++ ++ if (info->responder_resources == 0) { ++ log_rdma_mr(ERR, "responder_resources negotiated as 0\n"); ++ return -EINVAL; ++ } ++ + /* Allocate more MRs (2x) than hardware responder_resources */ + for (i = 0; i < info->responder_resources * 2; i++) { + smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); +diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h +index e45aa9ddd71da..4ca9b2b2c57f9 100644 +--- a/fs/smb/client/smbdirect.h ++++ b/fs/smb/client/smbdirect.h +@@ -67,7 +67,9 @@ struct smbd_connection { + + /* Memory registrations */ + /* Maximum number of RDMA read/write outstanding on this connection */ +- int responder_resources; ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + /* Maximum number of pages in a single RDMA write/read on this connection */ + int max_frmr_depth; + /* +-- +2.51.0 + diff --git a/queue-6.17/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.17/smb-server-fix-ird-ord-negotiation-with-the-client.patch new file mode 100644 index 0000000000..6e571eeaac --- /dev/null +++ b/queue-6.17/smb-server-fix-ird-ord-negotiation-with-the-client.patch @@ -0,0 +1,192 @@ +From 8028c7f6caa13fb541f8109b48d5f2ebcd31f1af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 15:34:58 +0200 +Subject: smb: server: fix IRD/ORD negotiation with the client + +From: Stefan Metzmacher + +[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ] + +Already do real negotiation in smb_direct_handle_connect_request() +where we see the requested initiator_depth and responder_resources +from the client. + +We should detect legacy iwarp clients using MPA v1 +with the custom IRD/ORD negotiation. + +We need to send the custom IRD/ORD in big endian, +but we need to try to let clients with broken requests +using little endian (older cifs.ko) to work. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +Acked-by: Namjae Jeon +Cc: Steve French +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++----- + 1 file changed, 85 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 74dfb6496095d..e1f659d3b4cf5 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -153,6 +153,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.17/smc-fix-use-after-free-in-__pnet_find_base_ndev.patch b/queue-6.17/smc-fix-use-after-free-in-__pnet_find_base_ndev.patch new file mode 100644 index 0000000000..87c352951c --- /dev/null +++ b/queue-6.17/smc-fix-use-after-free-in-__pnet_find_base_ndev.patch @@ -0,0 +1,212 @@ +From 256e8a49013c736f28db3100717b62d8782a65b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:19 +0000 +Subject: smc: Fix use-after-free in __pnet_find_base_ndev(). + +From: Kuniyuki Iwashima + +[ Upstream commit 3d3466878afd8d43ec0ca2facfbc7f03e40d0f79 ] + +syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), +which was called during connect(). [0] + +smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes +down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened +at __pnet_find_base_ndev() when the dev is first used. + +This means dev had already been freed before acquiring RTNL in +pnet_find_base_ndev(). + +While dev is going away, dst->dev could be swapped with blackhole_netdev, +and the dev's refcnt by dst will be released. + +We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). + +Also, smc_pnet_find_roce_resource() has the same problem. + +Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. + +[0]: +BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 +Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 + +CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 +Call Trace: + + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0xca/0x240 mm/kasan/report.c:482 + kasan_report+0x118/0x150 mm/kasan/report.c:595 + __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 + pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline] + smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline] + smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154 + smc_find_ism_device net/smc/af_smc.c:1030 [inline] + smc_find_proposal_devices net/smc/af_smc.c:1115 [inline] + __smc_connect+0x372/0x1890 net/smc/af_smc.c:1545 + smc_connect+0x877/0xd90 net/smc/af_smc.c:1715 + __sys_connect_file net/socket.c:2086 [inline] + __sys_connect+0x313/0x440 net/socket.c:2105 + __do_sys_connect net/socket.c:2111 [inline] + __se_sys_connect net/socket.c:2108 [inline] + __x64_sys_connect+0x7a/0x90 net/socket.c:2108 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7f47cbf8eba9 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a +RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9 +RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b +RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8 + + +The buggy address belongs to the physical page: +page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac +flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) +raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000 +raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as freed +page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466 + set_page_owner include/linux/page_owner.h:32 [inline] + post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 + prep_new_page mm/page_alloc.c:1859 [inline] + get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 + __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 + alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 + ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317 + __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348 + __do_kmalloc_node mm/slub.c:4364 [inline] + __kvmalloc_node_noprof+0x6d/0x5f0 mm/slub.c:5067 + alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11812 + tun_set_iff+0x532/0xef0 drivers/net/tun.c:2775 + __tun_chr_ioctl+0x788/0x1df0 drivers/net/tun.c:3085 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +page last free pid 18610 tgid 18608 stack trace: + reset_page_owner include/linux/page_owner.h:25 [inline] + free_pages_prepare mm/page_alloc.c:1395 [inline] + __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895 + free_large_kmalloc+0x13a/0x1f0 mm/slub.c:4820 + device_release+0x99/0x1c0 drivers/base/core.c:-1 + kobject_cleanup lib/kobject.c:689 [inline] + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0x22b/0x480 lib/kobject.c:737 + netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11513 + rtnl_unlock net/core/rtnetlink.c:157 [inline] + rtnl_net_unlock include/linux/rtnetlink.h:135 [inline] + rtnl_dellink+0x537/0x710 net/core/rtnetlink.c:3563 + rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6946 + netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 + netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] + netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 + netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 + sock_sendmsg_nosec net/socket.c:714 [inline] + __sock_sendmsg+0x219/0x270 net/socket.c:729 + ____sys_sendmsg+0x505/0x830 net/socket.c:2614 + ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 + __sys_sendmsg net/socket.c:2700 [inline] + __do_sys_sendmsg net/socket.c:2705 [inline] + __se_sys_sendmsg net/socket.c:2703 [inline] + __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Memory state around the buggy address: + ffff888036bac200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888036bac280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +>ffff888036bac300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ^ + ffff888036bac380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888036bac400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + +Fixes: 0afff91c6f5e ("net/smc: add pnetid support") +Fixes: 1619f770589a ("net/smc: add pnetid support for SMC-D and ISM") +Reported-by: syzbot+ea28e9d85be2f327b6c6@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-2-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/smc_pnet.c | 43 ++++++++++++++++++++++--------------------- + 1 file changed, 22 insertions(+), 21 deletions(-) + +diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c +index 76ad29e31d605..db3043b1e3fdb 100644 +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -1126,37 +1126,38 @@ static void smc_pnet_find_ism_by_pnetid(struct net_device *ndev, + */ + void smc_pnet_find_roce_resource(struct sock *sk, struct smc_init_info *ini) + { +- struct dst_entry *dst = sk_dst_get(sk); +- +- if (!dst) +- goto out; +- if (!dst->dev) +- goto out_rel; ++ struct net_device *dev; ++ struct dst_entry *dst; + +- smc_pnet_find_roce_by_pnetid(dst->dev, ini); ++ rcu_read_lock(); ++ dst = __sk_dst_get(sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ dev_hold(dev); ++ rcu_read_unlock(); + +-out_rel: +- dst_release(dst); +-out: +- return; ++ if (dev) { ++ smc_pnet_find_roce_by_pnetid(dev, ini); ++ dev_put(dev); ++ } + } + + void smc_pnet_find_ism_resource(struct sock *sk, struct smc_init_info *ini) + { +- struct dst_entry *dst = sk_dst_get(sk); ++ struct net_device *dev; ++ struct dst_entry *dst; + + ini->ism_dev[0] = NULL; +- if (!dst) +- goto out; +- if (!dst->dev) +- goto out_rel; + +- smc_pnet_find_ism_by_pnetid(dst->dev, ini); ++ rcu_read_lock(); ++ dst = __sk_dst_get(sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ dev_hold(dev); ++ rcu_read_unlock(); + +-out_rel: +- dst_release(dst); +-out: +- return; ++ if (dev) { ++ smc_pnet_find_ism_by_pnetid(dev, ini); ++ dev_put(dev); ++ } + } + + /* Lookup and apply a pnet table entry to the given ib device. +-- +2.51.0 + diff --git a/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-in-smc_clc_p.patch b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-in-smc_clc_p.patch new file mode 100644 index 0000000000..e6b4448308 --- /dev/null +++ b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-in-smc_clc_p.patch @@ -0,0 +1,128 @@ +From d00ea1c0bbe48b73a526eee44564e5aa975b6f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:20 +0000 +Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). + +From: Kuniyuki Iwashima + +[ Upstream commit 935d783e5de9b64587f3adb25641dd8385e64ddb ] + +smc_clc_prfx_set() is called during connect() and not under RCU +nor RTNL. + +Using sk_dst_get(sk)->dev could trigger UAF. + +Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() +after kernel_getsockname(). + +Note that the returned value of smc_clc_prfx_set() is not used +in the caller. + +While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() +not to touch dst there. + +Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/smc_clc.c | 41 ++++++++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 19 deletions(-) + +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 08be56dfb3f24..976b2102bdfcd 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -509,10 +509,10 @@ static bool smc_clc_msg_hdr_valid(struct smc_clc_msg_hdr *clcm, bool check_trl) + } + + /* find ipv4 addr on device and get the prefix len, fill CLC proposal msg */ +-static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, ++static int smc_clc_prfx_set4_rcu(struct net_device *dev, __be32 ipv4, + struct smc_clc_msg_proposal_prefix *prop) + { +- struct in_device *in_dev = __in_dev_get_rcu(dst->dev); ++ struct in_device *in_dev = __in_dev_get_rcu(dev); + const struct in_ifaddr *ifa; + + if (!in_dev) +@@ -530,12 +530,12 @@ static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, + } + + /* fill CLC proposal msg with ipv6 prefixes from device */ +-static int smc_clc_prfx_set6_rcu(struct dst_entry *dst, ++static int smc_clc_prfx_set6_rcu(struct net_device *dev, + struct smc_clc_msg_proposal_prefix *prop, + struct smc_clc_ipv6_prefix *ipv6_prfx) + { + #if IS_ENABLED(CONFIG_IPV6) +- struct inet6_dev *in6_dev = __in6_dev_get(dst->dev); ++ struct inet6_dev *in6_dev = __in6_dev_get(dev); + struct inet6_ifaddr *ifa; + int cnt = 0; + +@@ -564,41 +564,44 @@ static int smc_clc_prfx_set(struct socket *clcsock, + struct smc_clc_msg_proposal_prefix *prop, + struct smc_clc_ipv6_prefix *ipv6_prfx) + { +- struct dst_entry *dst = sk_dst_get(clcsock->sk); + struct sockaddr_storage addrs; + struct sockaddr_in6 *addr6; + struct sockaddr_in *addr; ++ struct net_device *dev; ++ struct dst_entry *dst; + int rc = -ENOENT; + +- if (!dst) { +- rc = -ENOTCONN; +- goto out; +- } +- if (!dst->dev) { +- rc = -ENODEV; +- goto out_rel; +- } + /* get address to which the internal TCP socket is bound */ + if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0) +- goto out_rel; ++ goto out; ++ + /* analyze IP specific data of net_device belonging to TCP socket */ + addr6 = (struct sockaddr_in6 *)&addrs; ++ + rcu_read_lock(); ++ ++ dst = __sk_dst_get(clcsock->sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ if (!dev) { ++ rc = -ENODEV; ++ goto out_unlock; ++ } ++ + if (addrs.ss_family == PF_INET) { + /* IPv4 */ + addr = (struct sockaddr_in *)&addrs; +- rc = smc_clc_prfx_set4_rcu(dst, addr->sin_addr.s_addr, prop); ++ rc = smc_clc_prfx_set4_rcu(dev, addr->sin_addr.s_addr, prop); + } else if (ipv6_addr_v4mapped(&addr6->sin6_addr)) { + /* mapped IPv4 address - peer is IPv4 only */ +- rc = smc_clc_prfx_set4_rcu(dst, addr6->sin6_addr.s6_addr32[3], ++ rc = smc_clc_prfx_set4_rcu(dev, addr6->sin6_addr.s6_addr32[3], + prop); + } else { + /* IPv6 */ +- rc = smc_clc_prfx_set6_rcu(dst, prop, ipv6_prfx); ++ rc = smc_clc_prfx_set6_rcu(dev, prop, ipv6_prfx); + } ++ ++out_unlock: + rcu_read_unlock(); +-out_rel: +- dst_release(dst); + out: + return rc; + } +-- +2.51.0 + diff --git a/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_clc_prfx.patch b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_clc_prfx.patch new file mode 100644 index 0000000000..79ca8ed376 --- /dev/null +++ b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_clc_prfx.patch @@ -0,0 +1,76 @@ +From 14e9a2049050993aa80154be9ca76593370eefc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:21 +0000 +Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). + +From: Kuniyuki Iwashima + +[ Upstream commit 235f81045c008169cc4e1955b4a64e118eebe61b ] + +smc_clc_prfx_match() is called from smc_listen_work() and +not under RCU nor RTNL. + +Using sk_dst_get(sk)->dev could trigger UAF. + +Let's use __sk_dst_get() and dst_dev_rcu(). + +Note that the returned value of smc_clc_prfx_match() is not +used in the caller. + +Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/smc_clc.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 976b2102bdfcd..09745baa10170 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -657,26 +657,26 @@ static int smc_clc_prfx_match6_rcu(struct net_device *dev, + int smc_clc_prfx_match(struct socket *clcsock, + struct smc_clc_msg_proposal_prefix *prop) + { +- struct dst_entry *dst = sk_dst_get(clcsock->sk); ++ struct net_device *dev; ++ struct dst_entry *dst; + int rc; + +- if (!dst) { +- rc = -ENOTCONN; +- goto out; +- } +- if (!dst->dev) { ++ rcu_read_lock(); ++ ++ dst = __sk_dst_get(clcsock->sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ if (!dev) { + rc = -ENODEV; +- goto out_rel; ++ goto out; + } +- rcu_read_lock(); ++ + if (!prop->ipv6_prefixes_cnt) +- rc = smc_clc_prfx_match4_rcu(dst->dev, prop); ++ rc = smc_clc_prfx_match4_rcu(dev, prop); + else +- rc = smc_clc_prfx_match6_rcu(dst->dev, prop); +- rcu_read_unlock(); +-out_rel: +- dst_release(dst); ++ rc = smc_clc_prfx_match6_rcu(dev, prop); + out: ++ rcu_read_unlock(); ++ + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_vlan_by_.patch b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_vlan_by_.patch new file mode 100644 index 0000000000..26a4edcc9d --- /dev/null +++ b/queue-6.17/smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_vlan_by_.patch @@ -0,0 +1,85 @@ +From 2dea499c0286d4383d91c9192cda7e4d634654c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:22 +0000 +Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). + +From: Kuniyuki Iwashima + +[ Upstream commit 0b0e4d51c6554e5ecc3f8cc73c2eaf12da21249a ] + +smc_vlan_by_tcpsk() fetches sk_dst_get(sk)->dev before RTNL and +passes it to netdev_walk_all_lower_dev(), which is illegal. + +Also, smc_vlan_by_tcpsk_walk() does not require RTNL at all. + +Let's use __sk_dst_get(), dst_dev_rcu(), and +netdev_walk_all_lower_dev_rcu(). + +Note that the returned value of smc_vlan_by_tcpsk() is not used +in the caller. + +Fixes: 0cfdd8f92cac ("smc: connection and link group creation") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250916214758.650211-5-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 262746e304dda..2a559a98541c7 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1883,35 +1883,32 @@ static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev, + /* Determine vlan of internal TCP socket. */ + int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini) + { +- struct dst_entry *dst = sk_dst_get(clcsock->sk); + struct netdev_nested_priv priv; + struct net_device *ndev; ++ struct dst_entry *dst; + int rc = 0; + + ini->vlan_id = 0; +- if (!dst) { +- rc = -ENOTCONN; +- goto out; +- } +- if (!dst->dev) { ++ ++ rcu_read_lock(); ++ ++ dst = __sk_dst_get(clcsock->sk); ++ ndev = dst ? dst_dev_rcu(dst) : NULL; ++ if (!ndev) { + rc = -ENODEV; +- goto out_rel; ++ goto out; + } + +- ndev = dst->dev; + if (is_vlan_dev(ndev)) { + ini->vlan_id = vlan_dev_vlan_id(ndev); +- goto out_rel; ++ goto out; + } + + priv.data = (void *)&ini->vlan_id; +- rtnl_lock(); +- netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv); +- rtnl_unlock(); +- +-out_rel: +- dst_release(dst); ++ netdev_walk_all_lower_dev_rcu(ndev, smc_vlan_by_tcpsk_walk, &priv); + out: ++ rcu_read_unlock(); ++ + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.17/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.17/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..34bc071436 --- /dev/null +++ b/queue-6.17/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From cd3db57a95ac21a183332538c3bf72dff24cacd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index 56f83aa58ec82..02f52291fae42 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -884,16 +884,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch b/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch new file mode 100644 index 0000000000..5670fc1847 --- /dev/null +++ b/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch @@ -0,0 +1,79 @@ +From 3874bae3ff6e8f7d70e00af46942c39cf55cfe49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:50 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure + +From: Johan Hovold + +[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index 7c349a94b45c0..48804e1e5a6c8 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp, + return dev; + } + ++static void svs_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; +@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + dev = svs_add_device_link(svsp, "thermal-sensor"); + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get thermal device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch b/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch new file mode 100644 index 0000000000..4ba557da35 --- /dev/null +++ b/queue-6.17/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch @@ -0,0 +1,67 @@ +From 7963762c3d0e4a2f42c805abf2ee377a5e70c8a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:56:51 +0200 +Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure + +From: Johan Hovold + +[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ] + +Make sure to drop the references taken by of_find_device_by_node() when +looking up the thermal sensor and opp devices during probe on probe +failure (e.g. probe deferral) and on driver unbind. + +Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver") +Cc: Roger Lu +Signed-off-by: Johan Hovold +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index 48804e1e5a6c8..f45537546553e 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + { + struct device *dev; + u32 idx; ++ int ret; + + svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst"); + if (IS_ERR(svsp->rst)) +@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + if (IS_ERR(dev)) + return dev_err_probe(svsp->dev, PTR_ERR(dev), + "failed to get lvts device\n"); ++ put_device(dev); + + for (idx = 0; idx < svsp->bank_max; idx++) { + struct svs_bank *svsb = &svsp->banks[idx]; +@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + case SVSB_SWID_CPU_LITTLE: + case SVSB_SWID_CPU_BIG: + svsb->opp_dev = get_cpu_device(bdata->cpu_id); ++ get_device(svsb->opp_dev); + break; + case SVSB_SWID_CCI: + svsb->opp_dev = svs_add_device_link(svsp, "cci"); +@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), + "failed to get OPP device for bank %d\n", + idx); ++ ++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device, ++ svsb->opp_dev); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.17/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.17/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..0ff78b2863 --- /dev/null +++ b/queue-6.17/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From 7fbb2a6ac1a48a4204ca393b372fe2c4591fd7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index fdab2b1067dbb..c6f7d5c9c493d 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); +-- +2.51.0 + diff --git a/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..1a4243e18d --- /dev/null +++ b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From 093b16bc2bec9449e5adb41bc52e22c9201f1f72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index 635398ec7540e..154fbd35400ca 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16989 b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16989 new file mode 100644 index 0000000000..c56576ef8b --- /dev/null +++ b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16989 @@ -0,0 +1,111 @@ +From ec62fb3f95f1a9617beb4dfafd375a173ef864bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894..bbd3ea0a64822 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-26037 b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-26037 new file mode 100644 index 0000000000..80d7ae25be --- /dev/null +++ b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-26037 @@ -0,0 +1,67 @@ +From fa020a7d5f6e3ea619bda1278aa6dd0a303af27e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-29384 b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-29384 new file mode 100644 index 0000000000..0c5b134920 --- /dev/null +++ b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-29384 @@ -0,0 +1,112 @@ +From 971a8db853603f933f02f3706b2cbe9179cbdc2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..414712ce91 --- /dev/null +++ b/queue-6.17/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From 1949bcd9e8c7314612bc876762a360bc4562262a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-6.17/spi-fix-return-code-when-spi-device-has-too-many-chi.patch b/queue-6.17/spi-fix-return-code-when-spi-device-has-too-many-chi.patch new file mode 100644 index 0000000000..12d2080580 --- /dev/null +++ b/queue-6.17/spi-fix-return-code-when-spi-device-has-too-many-chi.patch @@ -0,0 +1,36 @@ +From 908793043c71556ff26828277f099f02991d7ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 20:37:19 +0200 +Subject: spi: fix return code when spi device has too many chipselects + +From: Jonas Gorski + +[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ] + +Don't return a positive value when there are too many chipselects. + +Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core") +Signed-off-by: Jonas Gorski +Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index a388f372b27a7..19c2a6eb9922a 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2449,7 +2449,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + if (rc > ctlr->num_chipselect) { + dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n", + nc, rc); +- return rc; ++ return -EINVAL; + } + if ((of_property_present(nc, "parallel-memories")) && + (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) { +-- +2.51.0 + diff --git a/queue-6.17/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch b/queue-6.17/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch new file mode 100644 index 0000000000..f6270a09c6 --- /dev/null +++ b/queue-6.17/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch @@ -0,0 +1,52 @@ +From 2c9dec862be0ccfe3e327289c1f071ea286cbf38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 20:51:55 +0800 +Subject: srcu/tiny: Remove preempt_disable/enable() in + srcu_gp_start_if_needed() + +From: Zqiang + +[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ] + +Currently, the srcu_gp_start_if_needed() is always be invoked in +preempt disable's critical section, this commit therefore remove +redundant preempt_disable/enable() in srcu_gp_start_if_needed() +and adds a call to lockdep_assert_preemption_disabled() in order +to enable lockdep to diagnose mistaken invocations of this function +from preempts-enabled code. + +Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption") +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/srcutiny.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c +index 6e9fe2ce1075d..e3b64a5e0ec7e 100644 +--- a/kernel/rcu/srcutiny.c ++++ b/kernel/rcu/srcutiny.c +@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp) + { + unsigned long cookie; + +- preempt_disable(); // Needed for PREEMPT_LAZY ++ lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY + cookie = get_state_synchronize_srcu(ssp); + if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) { +- preempt_enable(); + return; + } + WRITE_ONCE(ssp->srcu_idx_max, cookie); +@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp) + else if (list_empty(&ssp->srcu_work.entry)) + list_add(&ssp->srcu_work.entry, &srcu_boot_list); + } +- preempt_enable(); + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.17/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..61c75af9a6 --- /dev/null +++ b/queue-6.17/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From 7d5e8326e603a7afc73efe1a1d1410019556767e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index ad76556800f2b..89040007c7b70 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3099,8 +3099,8 @@ bool tcp_check_oom(const struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -3119,11 +3119,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-6.17/tcp-use-skb-len-instead-of-skb-truesize-in-tcp_can_i.patch b/queue-6.17/tcp-use-skb-len-instead-of-skb-truesize-in-tcp_can_i.patch new file mode 100644 index 0000000000..107638ed89 --- /dev/null +++ b/queue-6.17/tcp-use-skb-len-instead-of-skb-truesize-in-tcp_can_i.patch @@ -0,0 +1,73 @@ +From bbd4b557f01463b3307346ef891aa6ae2c5ee988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Sep 2025 09:28:27 +0000 +Subject: tcp: use skb->len instead of skb->truesize in tcp_can_ingest() + +From: Eric Dumazet + +[ Upstream commit f017c1f768b670bced4464476655b27dfb937e67 ] + +Some applications are stuck to the 20th century and still use +small SO_RCVBUF values. + +After the blamed commit, we can drop packets especially +when using LRO/hw-gro enabled NIC and small MSS (1500) values. + +LRO/hw-gro NIC pack multiple segments into pages, allowing +tp->scaling_ratio to be set to a high value. + +Whenever the receive queue gets full, we can receive a small packet +filling RWIN, but with a high skb->truesize, because most NIC use 4K page +plus sk_buff metadata even when receiving less than 1500 bytes of payload. + +Even if we refine how tp->scaling_ratio is estimated, +we could have an issue at the start of the flow, because +the first round of packets (IW10) will be sent based on +the initial tp->scaling_ratio (1/2) + +Relax tcp_can_ingest() to use skb->len instead of skb->truesize, +allowing the peer to use final RWIN, assuming a 'perfect' +scaling_ratio of 1. + +Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250927092827.2707901-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 71b76e98371a6..64f93668a8452 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4890,12 +4890,23 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb); + + /* Check if this incoming skb can be added to socket receive queues + * while satisfying sk->sk_rcvbuf limit. ++ * ++ * In theory we should use skb->truesize, but this can cause problems ++ * when applications use too small SO_RCVBUF values. ++ * When LRO / hw gro is used, the socket might have a high tp->scaling_ratio, ++ * allowing RWIN to be close to available space. ++ * Whenever the receive queue gets full, we can receive a small packet ++ * filling RWIN, but with a high skb->truesize, because most NIC use 4K page ++ * plus sk_buff metadata even when receiving less than 1500 bytes of payload. ++ * ++ * Note that we use skb->len to decide to accept or drop this packet, ++ * but sk->sk_rmem_alloc is the sum of all skb->truesize. + */ + static bool tcp_can_ingest(const struct sock *sk, const struct sk_buff *skb) + { +- unsigned int new_mem = atomic_read(&sk->sk_rmem_alloc) + skb->truesize; ++ unsigned int rmem = atomic_read(&sk->sk_rmem_alloc); + +- return new_mem <= sk->sk_rcvbuf; ++ return rmem + skb->len <= sk->sk_rcvbuf; + } + + static int tcp_try_rmem_schedule(struct sock *sk, const struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.17/tcp_metrics-use-dst_dev_net_rcu.patch b/queue-6.17/tcp_metrics-use-dst_dev_net_rcu.patch new file mode 100644 index 0000000000..4b8eaa544f --- /dev/null +++ b/queue-6.17/tcp_metrics-use-dst_dev_net_rcu.patch @@ -0,0 +1,55 @@ +From 524d0cf4547e98f4ce0175645f640a6d71e6ac4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 19:58:21 +0000 +Subject: tcp_metrics: use dst_dev_net_rcu() + +From: Eric Dumazet + +[ Upstream commit 50c127a69cd6285300931853b352a1918cfa180f ] + +Replace three dst_dev() with a lockdep enabled helper. + +Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250828195823.3958522-7-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_metrics.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c +index 03c068ea27b6a..10e86f1008e9d 100644 +--- a/net/ipv4/tcp_metrics.c ++++ b/net/ipv4/tcp_metrics.c +@@ -170,7 +170,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst, + struct net *net; + + spin_lock_bh(&tcp_metrics_lock); +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + + /* While waiting for the spin-lock the cache might have been populated + * with this entry and so we have to check again. +@@ -273,7 +273,7 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req, + return NULL; + } + +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + hash ^= net_hash_mix(net); + hash = hash_32(hash, tcp_metrics_hash_log); + +@@ -318,7 +318,7 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk, + else + return NULL; + +- net = dev_net_rcu(dst_dev(dst)); ++ net = dst_dev_net_rcu(dst); + hash ^= net_hash_mix(net); + hash = hash_32(hash, tcp_metrics_hash_log); + +-- +2.51.0 + diff --git a/queue-6.17/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.17/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..48db88c17d --- /dev/null +++ b/queue-6.17/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From 51c0c8caf9cbf85c8d6f619ea8063a4eeb1c6f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index 75eaa9a68ab8a..c681a3c89ffa0 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.17/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.17/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..627874cc0c --- /dev/null +++ b/queue-6.17/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From ec9a52cdd39f640e5ca979244784d2b1071542bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebb..a6bb01082ec69 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-6.17/tick-do-not-set-device-to-detached-state-in-tick_shu.patch b/queue-6.17/tick-do-not-set-device-to-detached-state-in-tick_shu.patch new file mode 100644 index 0000000000..26d214969e --- /dev/null +++ b/queue-6.17/tick-do-not-set-device-to-detached-state-in-tick_shu.patch @@ -0,0 +1,105 @@ +From a069c3d5fc34980e83250cc1427ab4fc165fa056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 14:49:51 +0800 +Subject: tick: Do not set device to detached state in tick_shutdown() + +From: Bibo Mao + +[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ] + +tick_shutdown() sets the state of the clockevent device to detached +first and the invokes clockevents_exchange_device(), which in turn +invokes clockevents_switch_state(). + +But clockevents_switch_state() returns without invoking the device shutdown +callback as the device is already in detached state. As a consequence the +timer device is not shutdown when a CPU goes offline. + +tick_shutdown() does this because it was originally invoked on a online CPU +and not on the outgoing CPU. It therefore could not access the clockevent +device of the already offlined CPU and just set the state. + +Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so +the hardware device can be accessed. + +Remove the state set before calling clockevents_exchange_device(), so that +the subsequent clockevents_switch_state() handles the state transition and +invokes the shutdown callback of the clockevent device. + +[ tglx: Massaged change log ] + +Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING") +Signed-off-by: Bibo Mao +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn +Signed-off-by: Sasha Levin +--- + kernel/time/clockevents.c | 2 +- + kernel/time/tick-common.c | 16 +++++----------- + kernel/time/tick-internal.h | 2 +- + 3 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c +index f3e831f62906f..a59bc75ab7c5b 100644 +--- a/kernel/time/clockevents.c ++++ b/kernel/time/clockevents.c +@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu) + raw_spin_lock(&clockevents_lock); + + tick_broadcast_offline(cpu); +- tick_shutdown(cpu); ++ tick_shutdown(); + + /* + * Unregister the clock event devices which were +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 9a3859443c042..7e33d3f2e889b 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu) + } + + /* +- * Shutdown an event device on a given cpu: ++ * Shutdown an event device on the outgoing CPU: + * +- * This is called on a life CPU, when a CPU is dead. So we cannot +- * access the hardware device itself. +- * We just set the mode and remove it from the lists. ++ * Called by the dying CPU during teardown, with clockevents_lock held ++ * and interrupts disabled. + */ +-void tick_shutdown(unsigned int cpu) ++void tick_shutdown(void) + { +- struct tick_device *td = &per_cpu(tick_cpu_device, cpu); ++ struct tick_device *td = this_cpu_ptr(&tick_cpu_device); + struct clock_event_device *dev = td->evtdev; + + td->mode = TICKDEV_MODE_PERIODIC; + if (dev) { +- /* +- * Prevent that the clock events layer tries to call +- * the set mode function! +- */ +- clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED); + clockevents_exchange_device(dev, NULL); + dev->event_handler = clockevents_handle_noop; + td->evtdev = NULL; +diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h +index faac36de35b9e..4e4f7bbe2a64b 100644 +--- a/kernel/time/tick-internal.h ++++ b/kernel/time/tick-internal.h +@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast); + extern void tick_handle_periodic(struct clock_event_device *dev); + extern void tick_check_new_device(struct clock_event_device *dev); + extern void tick_offline_cpu(unsigned int cpu); +-extern void tick_shutdown(unsigned int cpu); ++extern void tick_shutdown(void); + extern void tick_suspend(void); + extern void tick_resume(void); + extern bool tick_check_replacement(struct clock_event_device *curdev, +-- +2.51.0 + diff --git a/queue-6.17/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_f.patch b/queue-6.17/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_f.patch new file mode 100644 index 0000000000..fa58b14525 --- /dev/null +++ b/queue-6.17/tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_f.patch @@ -0,0 +1,65 @@ +From b3f7ce8c872236ad34d88c73ac7a836551ced71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 21:47:23 +0000 +Subject: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). + +From: Kuniyuki Iwashima + +[ Upstream commit c65f27b9c3be2269918e1cbad6d8884741f835c5 ] + +get_netdev_for_sock() is called during setsockopt(), +so not under RCU. + +Using sk_dst_get(sk)->dev could trigger UAF. + +Let's use __sk_dst_get() and dst_dev_rcu(). + +Note that the only ->ndo_sk_get_lower_dev() user is +bond_sk_get_lower_dev(), which uses RCU. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_device.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index f672a62a9a52f..a82fdcf199690 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx) + /* We assume that the socket is already connected */ + static struct net_device *get_netdev_for_sock(struct sock *sk) + { +- struct dst_entry *dst = sk_dst_get(sk); +- struct net_device *netdev = NULL; ++ struct net_device *dev, *lowest_dev = NULL; ++ struct dst_entry *dst; + +- if (likely(dst)) { +- netdev = netdev_sk_get_lowest_dev(dst->dev, sk); +- dev_hold(netdev); ++ rcu_read_lock(); ++ dst = __sk_dst_get(sk); ++ dev = dst ? dst_dev_rcu(dst) : NULL; ++ if (likely(dev)) { ++ lowest_dev = netdev_sk_get_lowest_dev(dev, sk); ++ dev_hold(lowest_dev); + } ++ rcu_read_unlock(); + +- dst_release(dst); +- +- return netdev; ++ return lowest_dev; + } + + static void destroy_record(struct tls_record_info *record) +-- +2.51.0 + diff --git a/queue-6.17/tools-nolibc-add-stdbool.h-to-nolibc-includes.patch b/queue-6.17/tools-nolibc-add-stdbool.h-to-nolibc-includes.patch new file mode 100644 index 0000000000..15e6709ee2 --- /dev/null +++ b/queue-6.17/tools-nolibc-add-stdbool.h-to-nolibc-includes.patch @@ -0,0 +1,43 @@ +From e95295503c9888fc6600a31a4e0f93aaf0a84283 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 11:14:23 -0300 +Subject: tools/nolibc: add stdbool.h to nolibc includes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Almeida + +[ Upstream commit 2d965c1ae4135ed6f505661458f6dabd39488dac ] + +Otherwise tests compiled with only "-include nolibc.h" will fail with +"error: unknown type name 'bool'", even though a stdbool.h is available +from nolibc. + +Fixes: ae1f550efc11 ("tools/nolibc: add stdbool.h header") +Fixes: f2662ec26b26 ("selftests: kselftest: Create ksft_print_dbg_msg()") +Reported-by: Mark Brown +Closes: https://lore.kernel.org/lkml/833f5ae5-190e-47ec-9ad9-127ad166c80c@sirena.org.uk/ +Signed-off-by: André Almeida +[Thomas: add Fixes tags and massage commit message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/nolibc.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h +index c199ade200c24..d2f5aa085f8e3 100644 +--- a/tools/include/nolibc/nolibc.h ++++ b/tools/include/nolibc/nolibc.h +@@ -116,6 +116,7 @@ + #include "sched.h" + #include "signal.h" + #include "unistd.h" ++#include "stdbool.h" + #include "stdio.h" + #include "stdlib.h" + #include "string.h" +-- +2.51.0 + diff --git a/queue-6.17/tools-nolibc-avoid-error-in-dup2-if-old-fd-equals-ne.patch b/queue-6.17/tools-nolibc-avoid-error-in-dup2-if-old-fd-equals-ne.patch new file mode 100644 index 0000000000..23ce0e3532 --- /dev/null +++ b/queue-6.17/tools-nolibc-avoid-error-in-dup2-if-old-fd-equals-ne.patch @@ -0,0 +1,55 @@ +From 4171938995d28a46c84233909984e984c66d0dc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 10:29:27 +0200 +Subject: tools/nolibc: avoid error in dup2() if old fd equals new fd +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit d1ff0e2d13d6ac3a15be7870e15216726b0a809a ] + +dup2() allows both 'old' and 'new' to have the same value, which dup3() +does not. If libc dup2() is implemented through the dup3() system call, +then it would incorrectly fail in this case. + +Avoid the error by handling old == new explicitly. + +Fixes: 30ca20517ac1 ("tools headers: Move the nolibc header from rcutorture to tools/include/nolibc/") +Signed-off-by: Thomas Weißschuh +Acked-by: Willy Tarreau +Link: https://lore.kernel.org/r/20250820-nolibc-dup2-einval-v2-1-807185a45c56@linutronix.de +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/sys.h | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h +index 295e71d34abad..90aadad31f6cb 100644 +--- a/tools/include/nolibc/sys.h ++++ b/tools/include/nolibc/sys.h +@@ -238,6 +238,19 @@ static __attribute__((unused)) + int sys_dup2(int old, int new) + { + #if defined(__NR_dup3) ++ int ret, nr_fcntl; ++ ++#ifdef __NR_fcntl64 ++ nr_fcntl = __NR_fcntl64; ++#else ++ nr_fcntl = __NR_fcntl; ++#endif ++ ++ if (old == new) { ++ ret = my_syscall2(nr_fcntl, old, F_GETFD); ++ return ret < 0 ? ret : old; ++ } ++ + return my_syscall3(__NR_dup3, old, new, 0); + #elif defined(__NR_dup2) + return my_syscall2(__NR_dup2, old, new); +-- +2.51.0 + diff --git a/queue-6.17/tools-nolibc-fix-error-return-value-of-clock_nanosle.patch b/queue-6.17/tools-nolibc-fix-error-return-value-of-clock_nanosle.patch new file mode 100644 index 0000000000..dd92fdeb3f --- /dev/null +++ b/queue-6.17/tools-nolibc-fix-error-return-value-of-clock_nanosle.patch @@ -0,0 +1,66 @@ +From 8fae2bf039e9ecce9580491eac7200caa836fa5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 10:00:31 +0200 +Subject: tools/nolibc: fix error return value of clock_nanosleep() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1201f6fb5bfdbd10985ac3c8f49ef8f4f88b5c94 ] + +clock_nanosleep() returns a positive error value. Unlike other libc +functions it *does not* return -1 nor set errno. + +Fix the return value and also adapt nanosleep(). + +Fixes: 7c02bc4088af ("tools/nolibc: add support for clock_nanosleep() and nanosleep()") +Signed-off-by: Thomas Weißschuh +Acked-by: Willy Tarreau +Link: https://lore.kernel.org/r/20250731-nolibc-clock_nanosleep-ret-v1-1-9e4af7855e61@linutronix.de +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/time.h | 5 +++-- + tools/testing/selftests/nolibc/nolibc-test.c | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/include/nolibc/time.h b/tools/include/nolibc/time.h +index d02bc44d2643a..e9c1b976791a6 100644 +--- a/tools/include/nolibc/time.h ++++ b/tools/include/nolibc/time.h +@@ -133,7 +133,8 @@ static __attribute__((unused)) + int clock_nanosleep(clockid_t clockid, int flags, const struct timespec *rqtp, + struct timespec *rmtp) + { +- return __sysret(sys_clock_nanosleep(clockid, flags, rqtp, rmtp)); ++ /* Directly return a positive error number */ ++ return -sys_clock_nanosleep(clockid, flags, rqtp, rmtp); + } + + static __inline__ +@@ -145,7 +146,7 @@ double difftime(time_t time1, time_t time2) + static __inline__ + int nanosleep(const struct timespec *rqtp, struct timespec *rmtp) + { +- return clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp); ++ return __sysret(sys_clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp)); + } + + +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index a297ee0d6d075..cc4d730ac4656 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -1334,6 +1334,7 @@ int run_syscall(int min, int max) + CASE_TEST(chroot_root); EXPECT_SYSZR(euid0, chroot("/")); break; + CASE_TEST(chroot_blah); EXPECT_SYSER(1, chroot("/proc/self/blah"), -1, ENOENT); break; + CASE_TEST(chroot_exe); EXPECT_SYSER(1, chroot(argv0), -1, ENOTDIR); break; ++ CASE_TEST(clock_nanosleep); ts.tv_nsec = -1; EXPECT_EQ(1, EINVAL, clock_nanosleep(CLOCK_REALTIME, 0, &ts, NULL)); break; + CASE_TEST(close_m1); EXPECT_SYSER(1, close(-1), -1, EBADF); break; + CASE_TEST(close_dup); EXPECT_SYSZR(1, close(dup(0))); break; + CASE_TEST(dup_0); tmp = dup(0); EXPECT_SYSNE(1, tmp, -1); close(tmp); break; +-- +2.51.0 + diff --git a/queue-6.17/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.17/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..aedccc919a --- /dev/null +++ b/queue-6.17/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From 2740f5c752e12161bcaf1619ff7aa61d1aaa0882 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index ba950f0e73384..2c1ad23b9b5c1 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -29,6 +29,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-6.17/tools-ynl-fix-undefined-variable-name.patch b/queue-6.17/tools-ynl-fix-undefined-variable-name.patch new file mode 100644 index 0000000000..50ac4499fd --- /dev/null +++ b/queue-6.17/tools-ynl-fix-undefined-variable-name.patch @@ -0,0 +1,48 @@ +From 98c1e291c33149eb804bb3002f3210b4d4173d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 23:07:47 +0200 +Subject: tools: ynl: fix undefined variable name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthieu Baerts (NGI0) + +[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ] + +This variable used in the error path was not defined according to Ruff. +msg_format.attr_set is used instead, presumably the one that was +supposed to be used originally. + +This is linked to Ruff error F821 [1]: + + An undefined name is likely to raise NameError at runtime. + +Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl") +Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1] +Signed-off-by: Matthieu Baerts (NGI0) +Reviewed-by: Donald Hunter +Reviewed-by: Asbjørn Sloth Tønnesen +Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/net/ynl/pyynl/lib/ynl.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py +index 8244a5f440b2b..15ddb0b1adb63 100644 +--- a/tools/net/ynl/pyynl/lib/ynl.py ++++ b/tools/net/ynl/pyynl/lib/ynl.py +@@ -746,7 +746,7 @@ class YnlFamily(SpecFamily): + subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set) + decoded.update(subdict) + else: +- raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'") ++ raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'") + return decoded + + def _decode(self, attrs, space, outer_attrs = None): +-- +2.51.0 + diff --git a/queue-6.17/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch b/queue-6.17/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch new file mode 100644 index 0000000000..92627b3e37 --- /dev/null +++ b/queue-6.17/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch @@ -0,0 +1,82 @@ +From 615505296e9950d13e7642f451a9a13a4541a65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:26:56 +0300 +Subject: tty: n_gsm: Don't block input queue by waiting MSC + +From: Seppo Takalo + +[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ] + +Currently gsm_queue() processes incoming frames and when opening +a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). +If basic mode is used it calls gsm_modem_upd_via_msc() and it +cannot block the input queue by waiting the response to come +into the same input queue. + +Instead allow sending Modem Status Command without waiting for remote +end to respond. Define a new function gsm_modem_send_initial_msc() +for this purpose. As MSC is only valid for basic encoding, it does +not do anything for advanced or when convergence layer type 2 is used. + +Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") +Signed-off-by: Seppo Takalo +Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 7fc535452c0b3..553d8c70352b1 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); + static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); + static void gsmld_write_trigger(struct gsm_mux *gsm); + static void gsmld_write_task(struct work_struct *work); ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); + + /** + * gsm_fcs_add - update FCS +@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + pr_debug("DLCI %d goes open.\n", dlci->addr); + /* Send current modem state */ + if (dlci->addr) { +- gsm_modem_update(dlci, 0); ++ gsm_modem_send_initial_msc(dlci); + } else { + /* Start keep-alive control */ + gsm->ka_num = 0; +@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) + return gsm_control_wait(dlci->gsm, ctrl); + } + ++/** ++ * gsm_modem_send_initial_msc - Send initial modem status message ++ * ++ * @dlci channel ++ * ++ * Send an initial MSC message after DLCI open to set the initial ++ * modem status lines. This is only done for basic mode. ++ * Does not wait for a response as we cannot block the input queue ++ * processing. ++ */ ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) ++{ ++ u8 modembits[2]; ++ ++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) ++ return 0; ++ ++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ ++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; ++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); ++} ++ + /** + * gsm_modem_update - send modem status line state + * @dlci: channel +-- +2.51.0 + diff --git a/queue-6.17/uprobes-uprobe_warn-should-use-passed-task.patch b/queue-6.17/uprobes-uprobe_warn-should-use-passed-task.patch new file mode 100644 index 0000000000..3543657496 --- /dev/null +++ b/queue-6.17/uprobes-uprobe_warn-should-use-passed-task.patch @@ -0,0 +1,40 @@ +From b71a1be3f684fa6fd44846c1d0680990fcba50a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Aug 2025 22:34:21 -0500 +Subject: uprobes: uprobe_warn should use passed task + +From: Jeremy Linton + +[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ] + +uprobe_warn() is passed a task structure, yet its using current. For +the most part this shouldn't matter, but since a task structure is +provided, lets use it. + +Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances") +Signed-off-by: Jeremy Linton +Reviewed-by: Catalin Marinas +Acked-by: Oleg Nesterov +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index 7ca1940607bd8..4b97d16f731c1 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -121,7 +121,7 @@ struct xol_area { + + static void uprobe_warn(struct task_struct *t, const char *msg) + { +- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg); ++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg); + } + + /* +-- +2.51.0 + diff --git a/queue-6.17/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.17/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..b2f57240ed --- /dev/null +++ b/queue-6.17/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From 8c90b6a87a7977b0a3cf1b61170b07b7dbe7d4ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index f94ea196ce547..6bcac85c55501 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-6.17/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.17/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..7bf1f6a39c --- /dev/null +++ b/queue-6.17/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From f937b36f9e6ab6ba2454c61a3be7598caa6fe0b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index dcf31a592f5d1..4b5f03f683f77 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-6.17/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch b/queue-6.17/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch new file mode 100644 index 0000000000..26b04672d5 --- /dev/null +++ b/queue-6.17/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch @@ -0,0 +1,143 @@ +From 9c7c274b608730429fcff6a88171198d85c1038d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:31:32 +0530 +Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls + +From: Komal Bajaj + +[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ] + +EUD_MODE_MANAGER2 register is mapped to a memory region that is marked +as read-only for operating system running at EL1, enforcing access +restrictions that prohibit direct memory-mapped writes via writel(). + +Attempts to write to this region from HLOS can result in silent failures +or memory access violations, particularly when toggling EUD (Embedded +USB Debugger) state. To ensure secure register access, modify the driver +to use qcom_scm_io_writel(), which routes the write operation to Qualcomm +Secure Channel Monitor (SCM). SCM has the necessary permissions to access +protected memory regions, enabling reliable control over EUD state. + +SC7280, the only user of EUD is also affected, indicating that this could +never have worked on a properly fused device. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Signed-off-by: Melody Olvera +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Souradeep Chowdhury +Signed-off-by: Komal Bajaj +Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/Kconfig | 1 + + drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++--------- + 2 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig +index 6497c4e81e951..9bf8fc6247bac 100644 +--- a/drivers/usb/misc/Kconfig ++++ b/drivers/usb/misc/Kconfig +@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY + config USB_QCOM_EUD + tristate "QCOM Embedded USB Debugger(EUD) Driver" + depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + select USB_ROLE_SWITCH + help + This module enables support for Qualcomm Technologies, Inc. +diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c +index 83079c414b4f2..05c8bdc943a88 100644 +--- a/drivers/usb/misc/qcom_eud.c ++++ b/drivers/usb/misc/qcom_eud.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define EUD_REG_INT1_EN_MASK 0x0024 + #define EUD_REG_INT_STATUS_1 0x0044 +@@ -34,7 +35,7 @@ struct eud_chip { + struct device *dev; + struct usb_role_switch *role_sw; + void __iomem *base; +- void __iomem *mode_mgr; ++ phys_addr_t mode_mgr; + unsigned int int_status; + int irq; + bool enabled; +@@ -43,18 +44,29 @@ struct eud_chip { + + static int enable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); ++ if (ret) ++ return ret; ++ + writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); + writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, + priv->base + EUD_REG_INT1_EN_MASK); +- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); + + return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); + } + +-static void disable_eud(struct eud_chip *priv) ++static int disable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); ++ if (ret) ++ return ret; ++ + writel(0, priv->base + EUD_REG_CSR_EUD_EN); +- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); ++ return 0; + } + + static ssize_t enable_show(struct device *dev, +@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, + chip->enabled = enable; + else + disable_eud(chip); ++ + } else { +- disable_eud(chip); ++ ret = disable_eud(chip); + } + +- return count; ++ return ret < 0 ? ret : count; + } + + static DEVICE_ATTR_RW(enable); +@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) + static int eud_probe(struct platform_device *pdev) + { + struct eud_chip *chip; ++ struct resource *res; + int ret; + + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); +@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) + if (IS_ERR(chip->base)) + return PTR_ERR(chip->base); + +- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(chip->mode_mgr)) +- return PTR_ERR(chip->mode_mgr); ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -ENODEV; ++ chip->mode_mgr = res->start; + + chip->irq = platform_get_irq(pdev, 0); + if (chip->irq < 0) +-- +2.51.0 + diff --git a/queue-6.17/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.17/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..6afb95cf6e --- /dev/null +++ b/queue-6.17/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From 74ef4d653e3defdf367474bbe167120e67e0d0ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index 49d79c1257f3a..8c09db750bfd6 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-6.17/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.17/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..766f8fb88a --- /dev/null +++ b/queue-6.17/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From baca44372d07b1562643b4c19dd0cde43287e2e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index e70fba9f55d6a..0d6c10a8490c0 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-6.17/vdso-add-struct-__kernel_old_timeval-forward-declara.patch b/queue-6.17/vdso-add-struct-__kernel_old_timeval-forward-declara.patch new file mode 100644 index 0000000000..9a9762b3ea --- /dev/null +++ b/queue-6.17/vdso-add-struct-__kernel_old_timeval-forward-declara.patch @@ -0,0 +1,42 @@ +From 2a5b4bf663232e0ab91989bc13b6873476d92431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:41:10 +0200 +Subject: vdso: Add struct __kernel_old_timeval forward declaration to + gettime.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ] + +The prototype of __vdso_gettimeofday() uses this struct. However +gettime.h's own includes do not provide a definition for it. + +Add a forward declaration, similar to other used structs. + +Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de +Signed-off-by: Sasha Levin +--- + include/vdso/gettime.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h +index c50d152e7b3e0..9ac161866653a 100644 +--- a/include/vdso/gettime.h ++++ b/include/vdso/gettime.h +@@ -5,6 +5,7 @@ + #include + + struct __kernel_timespec; ++struct __kernel_old_timeval; + struct timezone; + + #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64) +-- +2.51.0 + diff --git a/queue-6.17/vdso-datastore-gate-time-data-behind-config_generic_.patch b/queue-6.17/vdso-datastore-gate-time-data-behind-config_generic_.patch new file mode 100644 index 0000000000..95fe155ad1 --- /dev/null +++ b/queue-6.17/vdso-datastore-gate-time-data-behind-config_generic_.patch @@ -0,0 +1,59 @@ +From 2e51e8e8d4416730aae65b4e767c4aa72e84e002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 08:17:04 +0200 +Subject: vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ] + +When the generic vDSO does not provide time functions, as for example on +riscv32, then the time data store is not necessary. + +Avoid allocating these time data pages when not used. + +Fixes: df7fcbefa710 ("vdso: Add generic time data storage") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de +Signed-off-by: Sasha Levin +--- + lib/vdso/datastore.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c +index 3693c6caf2c4d..a565c30c71a04 100644 +--- a/lib/vdso/datastore.c ++++ b/lib/vdso/datastore.c +@@ -11,14 +11,14 @@ + /* + * The vDSO data page. + */ +-#ifdef CONFIG_HAVE_GENERIC_VDSO ++#ifdef CONFIG_GENERIC_GETTIMEOFDAY + static union { + struct vdso_time_data data; + u8 page[PAGE_SIZE]; + } vdso_time_data_store __page_aligned_data; + struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data; + static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE); +-#endif /* CONFIG_HAVE_GENERIC_VDSO */ ++#endif /* CONFIG_GENERIC_GETTIMEOFDAY */ + + #ifdef CONFIG_VDSO_GETRANDOM + static union { +@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm, + + switch (vmf->pgoff) { + case VDSO_TIME_PAGE_OFFSET: +- if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO)) ++ if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY)) + return VM_FAULT_SIGBUS; + pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data)); + if (timens_page) { +-- +2.51.0 + diff --git a/queue-6.17/vfio-pds-replace-bitmap_free-with-vfree.patch b/queue-6.17/vfio-pds-replace-bitmap_free-with-vfree.patch new file mode 100644 index 0000000000..24141e94ad --- /dev/null +++ b/queue-6.17/vfio-pds-replace-bitmap_free-with-vfree.patch @@ -0,0 +1,43 @@ +From 0aba69f40748cfef03c123a1ef92516b7aa1b5f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 15:31:54 +0000 +Subject: vfio/pds: replace bitmap_free with vfree + +From: Zilin Guan + +[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ] + +host_seq_bmp is allocated with vzalloc but is currently freed with +bitmap_free, which uses kfree internally. This mismach prevents the +resource from being released properly and may result in memory leaks +or other issues. + +Fix this by freeing host_seq_bmp with vfree to match the vzalloc +allocation. + +Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") +Signed-off-by: Zilin Guan +Reviewed-by: Brett Creeley +Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/dirty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c +index c51f5e4c3dd6d..481992142f790 100644 +--- a/drivers/vfio/pci/pds/dirty.c ++++ b/drivers/vfio/pci/pds/dirty.c +@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region, + + host_ack_bmp = vzalloc(bytes); + if (!host_ack_bmp) { +- bitmap_free(host_seq_bmp); ++ vfree(host_seq_bmp); + return -ENOMEM; + } + +-- +2.51.0 + diff --git a/queue-6.17/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.17/vhost-vringh-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..9478a7ce12 --- /dev/null +++ b/queue-6.17/vhost-vringh-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,53 @@ +From 77df13f4cc9b3efe12f1888121766c690873d636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:04:08 -0400 +Subject: vhost: vringh: Fix copy_to_iter return value check + +From: Michael S. Tsirkin + +[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ] + +The return value of copy_to_iter can't be negative, check whether the +copied length is equal to the requested length instead of checking for +negative values. + +Cc: zhang jiao +Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Simon Horman +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 9f27c3f6091b8..1778eff7ab006 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1161,6 +1161,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1178,9 +1179,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.17/vhost-vringh-modify-the-return-value-check.patch b/queue-6.17/vhost-vringh-modify-the-return-value-check.patch new file mode 100644 index 0000000000..7b13388d1d --- /dev/null +++ b/queue-6.17/vhost-vringh-modify-the-return-value-check.patch @@ -0,0 +1,50 @@ +From 8407c82ca1915ce46bce47f9bc19781187c705f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:17:38 +0800 +Subject: vhost: vringh: Modify the return value check + +From: zhang jiao + +[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ] + +The return value of copy_from_iter and copy_to_iter can't be negative, +check whether the copied lengths are equal. + +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Cc: "Stefano Garzarella" +Signed-off-by: zhang jiao +Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 1778eff7ab006..925858cc60964 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1115,6 +1115,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1132,9 +1133,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.17/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch b/queue-6.17/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch new file mode 100644 index 0000000000..beca6e0430 --- /dev/null +++ b/queue-6.17/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch @@ -0,0 +1,80 @@ +From f0654bcd1e7ab9cbbb30b3fcb121702e10f7cbb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Aug 2025 07:48:17 -0700 +Subject: watchdog: intel_oc_wdt: Do not try to write into const memory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ] + +The code tries to update the intel_oc_wdt_info data structure if the +watchdog is locked. That data structure is marked as const and can not +be written into. Copy it into struct intel_oc_wdt and modify it there +to fix the problem. + +Reported-by: Petar Kulić +Cc: Diogo Ivo +Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT") +Signed-off-by: Guenter Roeck +Reviewed-by: Diogo Ivo +Tested-by: Diogo Ivo +Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/intel_oc_wdt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c +index 7c0551106981b..a39892c10770e 100644 +--- a/drivers/watchdog/intel_oc_wdt.c ++++ b/drivers/watchdog/intel_oc_wdt.c +@@ -41,6 +41,7 @@ + struct intel_oc_wdt { + struct watchdog_device wdd; + struct resource *ctrl_res; ++ struct watchdog_info info; + bool locked; + }; + +@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = { + + static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + { +- struct watchdog_info *info; + unsigned long val; + + val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt)); +@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status); + + if (oc_wdt->locked) { +- info = (struct watchdog_info *)&intel_oc_wdt_info; + /* + * Set nowayout unconditionally as we cannot stop + * the watchdog. +@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt) + * and inform the core we can't change it. + */ + oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1; +- info->options &= ~WDIOF_SETTIMEOUT; ++ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT; + + dev_info(oc_wdt->wdd.parent, + "Register access locked, heartbeat fixed at: %u s\n", +@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev) + wdd->min_timeout = INTEL_OC_WDT_MIN_TOV; + wdd->max_timeout = INTEL_OC_WDT_MAX_TOV; + wdd->timeout = INTEL_OC_WDT_DEF_TOV; +- wdd->info = &intel_oc_wdt_info; ++ oc_wdt->info = intel_oc_wdt_info; ++ wdd->info = &oc_wdt->info; + wdd->ops = &intel_oc_wdt_ops; + wdd->parent = dev; + +-- +2.51.0 + diff --git a/queue-6.17/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.17/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..6d587fc9e7 --- /dev/null +++ b/queue-6.17/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 22819cdb5733a23a819d56b828da6048bc96bab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 867f9f3113797..a4b497ecfa205 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.17/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..482389dae3 --- /dev/null +++ b/queue-6.17/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From 0d9ef5d994853286e8e11eeca8e62f9684ea948a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index cb8ae751eb312..e595b0979a56d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch b/queue-6.17/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch new file mode 100644 index 0000000000..2576e10db1 --- /dev/null +++ b/queue-6.17/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch @@ -0,0 +1,88 @@ +From ba0611c783161c608ebf8a1769d97f8c53fa98c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 00:36:51 +0530 +Subject: wifi: ath12k: Add fallback for invalid channel number in PHY metadata + +From: Sriram R + +[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ] + +Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency +based on the channel number and center frequency from the RX descriptor's +PHY metadata. However, in rare cases, it is observed that frequency +retrieved from the metadata may be invalid or unexpected especially for +6 GHz frames. +This can result in a NULL sband, which prevents proper frequency assignment +in rx_status and potentially leading to incorrect RX packet classification. + +To fix this potential issue, add a fallback mechanism that uses +ar->rx_channel to populate the band and frequency when the derived +sband is invalid or missing. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Sriram R +Co-developed-by: Vinith Kumar R +Signed-off-by: Vinith Kumar R +Signed-off-by: Aishwarya R +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 8ab91273592c8..adb0cfe109e67 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2533,6 +2533,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info) + channel_num = meta_data; + center_freq = meta_data >> 16; + ++ rx_status->band = NUM_NL80211_BANDS; ++ + if (center_freq >= ATH12K_MIN_6GHZ_FREQ && + center_freq <= ATH12K_MAX_6GHZ_FREQ) { + rx_status->band = NL80211_BAND_6GHZ; +@@ -2541,21 +2543,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info) + rx_status->band = NL80211_BAND_2GHZ; + } else if (channel_num >= 36 && channel_num <= 173) { + rx_status->band = NL80211_BAND_5GHZ; +- } else { ++ } ++ ++ if (unlikely(rx_status->band == NUM_NL80211_BANDS || ++ !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) { ++ ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n", ++ rx_status->band, channel_num, center_freq, ar->pdev_idx); ++ + spin_lock_bh(&ar->data_lock); + channel = ar->rx_channel; + if (channel) { + rx_status->band = channel->band; + channel_num = + ieee80211_frequency_to_channel(channel->center_freq); ++ rx_status->freq = ieee80211_channel_to_frequency(channel_num, ++ rx_status->band); ++ } else { ++ ath12k_err(ar->ab, "unable to determine channel, band for rx packet"); + } + spin_unlock_bh(&ar->data_lock); ++ goto h_rate; + } + + if (rx_status->band != NL80211_BAND_6GHZ) + rx_status->freq = ieee80211_channel_to_frequency(channel_num, + rx_status->band); + ++h_rate: + ath12k_dp_rx_h_rate(ar, rx_info); + } + +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-flush-cache-failure-during-rx-queue-.patch b/queue-6.17/wifi-ath12k-fix-flush-cache-failure-during-rx-queue-.patch new file mode 100644 index 0000000000..39cb6d2a47 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-flush-cache-failure-during-rx-queue-.patch @@ -0,0 +1,44 @@ +From cfa4efda944f8c07e0fc70673daf1fd63164ff60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 16:47:49 +0530 +Subject: wifi: ath12k: Fix flush cache failure during RX queue update + +From: Nithyanantham Paramasivam + +[ Upstream commit 5e32edc6942570429d9c64d0641fc2addbf92be1 ] + +Flush cache failures were observed after RX queue update for TID +delete. This occurred because the queue was invalid during flush. +Set the VLD bit in the RX queue update command for TID delete. +This ensures the queue remains valid during the flush cache process. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Nithyanantham Paramasivam +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250806111750.3214584-7-nithyanantham.paramasivam@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 8c61c7f3bbdc9..9048818984f19 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -781,6 +781,8 @@ static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab, + cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned); + cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned); + cmd.upd0 |= HAL_REO_CMD_UPD0_VLD; ++ /* Observed flush cache failure, to avoid that set vld bit during delete */ ++ cmd.upd1 |= HAL_REO_CMD_UPD1_VLD; + + return ath12k_dp_reo_cmd_send(ab, rx_tid, + HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd, +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch b/queue-6.17/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch new file mode 100644 index 0000000000..36175463b1 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch @@ -0,0 +1,103 @@ +From c90cd6d5213a6234769e6b829533d96830b5faad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 17:59:33 +0800 +Subject: wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode + +From: Kang Yang + +[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ] + +Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with +struct hal_phyrx_common_user_info. + +Obviously, they do not match. The original intention here was to parse +HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing +HAL_PHYRX_COMMON_USER_INFO instead. + +Also add LTF parsing and report to radiotap along with GI. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support") +Signed-off-by: Kang Yang +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++---- + drivers/net/wireless/ath/ath12k/hal_rx.h | 3 +- + 2 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index ec1587d0b917c..e93ede5e6197c 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap) + *errmap |= HAL_RX_MPDU_ERR_MPDU_LEN; + } + ++static void ++ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info, ++ struct hal_rx_mon_ppdu_info *ppdu_info) ++{ ++ struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht; ++ u32 known, data, cp_setting, ltf_size; ++ ++ known = __le32_to_cpu(eht->known); ++ known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI | ++ IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF; ++ eht->known = cpu_to_le32(known); ++ ++ cp_setting = le32_get_bits(cmn_usr_info->info0, ++ HAL_RX_CMN_USR_INFO0_CP_SETTING); ++ ltf_size = le32_get_bits(cmn_usr_info->info0, ++ HAL_RX_CMN_USR_INFO0_LTF_SIZE); ++ ++ data = __le32_to_cpu(eht->data[0]); ++ data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI); ++ data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF); ++ eht->data[0] = cpu_to_le32(data); ++ ++ if (!ppdu_info->ltf_size) ++ ppdu_info->ltf_size = ltf_size; ++ if (!ppdu_info->gi) ++ ppdu_info->gi = cp_setting; ++} ++ + static void + ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon, + const struct hal_rx_msdu_end *msdu_end) +@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar, + HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW); + break; + } +- case HAL_PHYRX_OTHER_RECEIVE_INFO: { +- const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data; +- +- ppdu_info->gi = le32_get_bits(cmn_usr_info->info0, +- HAL_RX_PHY_CMN_USER_INFO0_GI); ++ case HAL_PHYRX_COMMON_USER_INFO: { ++ ath12k_parse_cmn_usr_info(tlv_data, ppdu_info); + break; + } + case HAL_RX_PPDU_START_USER_INFO: +diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h +index a3ab588aae19d..801a5f6d3458b 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_rx.h ++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h +@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info { + #define HAL_RX_MPDU_ERR_MPDU_LEN BIT(6) + #define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME BIT(7) + +-#define HAL_RX_PHY_CMN_USER_INFO0_GI GENMASK(17, 16) ++#define HAL_RX_CMN_USR_INFO0_CP_SETTING GENMASK(17, 16) ++#define HAL_RX_CMN_USR_INFO0_LTF_SIZE GENMASK(19, 18) + + struct hal_phyrx_common_user_info { + __le32 rsvd[2]; +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch b/queue-6.17/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch new file mode 100644 index 0000000000..94d0cf5f94 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch @@ -0,0 +1,89 @@ +From 6d1ffb39e0480d55f68a1365cd3a48122f9c0608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 11:03:11 +0800 +Subject: wifi: ath12k: fix overflow warning on num_pwr_levels + +From: Baochen Qiang + +[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ] + +In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is +limited by ATH12K_NUM_PWR_LEVELS which is 16: + + if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) + tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; + +Then it is used to iterate entries in local_non_psd->power[] and +reg_non_psd->power[]: + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_non_psd->power[i], + reg_non_psd->power[i]) / 2; + +Since the two array are of size 5, Smatch warns: + +drivers/net/wireless/ath/ath12k/mac.c:9812 +ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15 +drivers/net/wireless/ath/ath12k/mac.c:9812 +ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15 + +This is a false positive as there is already implicit limitation: + + tpc_info->num_pwr_levels = max(local_non_psd->count, + reg_non_psd->count); + +meaning it won't exceed 5. + +However, to make robot happy, add explicit limit there. + +Also add the same to the PSD case, although no warning due to +ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 + +Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/ +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 93a9c2bc3c596..2644b5d4b0bc8 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -11447,8 +11447,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar, + + tpc_info->num_pwr_levels = max(local_psd->count, + reg_psd->count); +- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) +- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; ++ tpc_info->num_pwr_levels = ++ min3(tpc_info->num_pwr_levels, ++ IEEE80211_TPE_PSD_ENTRIES_320MHZ, ++ ATH12K_NUM_PWR_LEVELS); + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_psd->power[i], +@@ -11463,8 +11465,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar, + + tpc_info->num_pwr_levels = max(local_non_psd->count, + reg_non_psd->count); +- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS) +- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS; ++ tpc_info->num_pwr_levels = ++ min3(tpc_info->num_pwr_levels, ++ IEEE80211_TPE_EIRP_ENTRIES_320MHZ, ++ ATH12K_NUM_PWR_LEVELS); + + for (i = 0; i < tpc_info->num_pwr_levels; i++) { + tpc_info->tpe[i] = min(local_non_psd->power[i], +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch b/queue-6.17/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch new file mode 100644 index 0000000000..7259849907 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch @@ -0,0 +1,79 @@ +From d3c2ca64f94ef3f76255614fc199fa5a4ddcf061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 09:35:52 +0530 +Subject: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() + +From: Hari Chandrakanthan + +[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ] + +In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because +rxcb->peer_id is not updated with a valid value. This is expected +in monitor mode, where RX frames bypass the regular RX +descriptor path that typically sets rxcb->peer_id. +As a result, the peer is NULL, and link_id and link_valid fields +in the RX status are not populated. This leads to a WARN_ON in +mac80211 when it receives data frame from an associated station +with invalid link_id. + +Fix this potential issue by using ppduinfo->peer_id, which holds +the correct peer id for the received frame. This ensures that the +peer is correctly found and the associated link metadata is updated +accordingly. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info") +Signed-off-by: Hari Chandrakanthan +Signed-off-by: Aishwarya R +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index abd611ac37f06..009c495021489 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -2273,6 +2273,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar, + + static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi, + struct sk_buff *msdu, ++ const struct hal_rx_mon_ppdu_info *ppduinfo, + struct ieee80211_rx_status *status, + u8 decap) + { +@@ -2286,7 +2287,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct + struct ieee80211_sta *pubsta = NULL; + struct ath12k_peer *peer; + struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu); +- struct ath12k_dp_rx_info rx_info; + bool is_mcbc = rxcb->is_mcbc; + bool is_eapol_tkip = rxcb->is_eapol; + +@@ -2300,8 +2300,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct + } + + spin_lock_bh(&ar->ab->base_lock); +- rx_info.addr2_present = false; +- peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info); ++ peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id); + if (peer && peer->sta) { + pubsta = peer->sta; + if (pubsta->valid_links) { +@@ -2394,7 +2393,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar, + decap = mon_mpdu->decap_format; + + ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs); +- ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap); ++ ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap); + mon_skb = skb_next; + } while (mon_skb); + rxs->flag = 0; +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-signal-in-radiotap-for-wcn7850.patch b/queue-6.17/wifi-ath12k-fix-signal-in-radiotap-for-wcn7850.patch new file mode 100644 index 0000000000..6d70d68ee2 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-signal-in-radiotap-for-wcn7850.patch @@ -0,0 +1,53 @@ +From fa0dd31b48baecb7233e2211b3d95a641c3afed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 17:59:32 +0800 +Subject: wifi: ath12k: fix signal in radiotap for WCN7850 + +From: Kang Yang + +[ Upstream commit cf412ae7b7124e2b3bfe472616ec24b117b6008a ] + +Currently host will add ATH12K_DEFAULT_NOISE_FLOOR to rssi_comb to +convert RSSI from dB to dBm. + +For WCN7850, this conversion is unnecessary because the RSSI value is +already reported in dBm units. + +No longer convert for those firmware that already support dBM conversion. + +This patch won't affect QCN chips. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Kang Yang +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250722095934.67-2-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index 8189e52ed0071..ec1587d0b917c 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -2154,8 +2154,12 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar, + spin_unlock_bh(&ar->data_lock); + + rxs->flag |= RX_FLAG_MACTIME_START; +- rxs->signal = ppduinfo->rssi_comb + noise_floor; + rxs->nss = ppduinfo->nss + 1; ++ if (test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT, ++ ar->ab->wmi_ab.svc_map)) ++ rxs->signal = ppduinfo->rssi_comb; ++ else ++ rxs->signal = ppduinfo->rssi_comb + noise_floor; + + if (ppduinfo->userstats[ppduinfo->userid].ampdu_present) { + rxs->flag |= RX_FLAG_AMPDU_DETAILS; +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch b/queue-6.17/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch new file mode 100644 index 0000000000..8f60ddc973 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch @@ -0,0 +1,92 @@ +From 91979bcf44ce092f0d4097ef179b75a07b3a5fae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 17:59:34 +0800 +Subject: wifi: ath12k: fix the fetching of combined rssi + +From: Kang Yang + +[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ] + +Currently, host fetches combined rssi from rssi_comb in struct +hal_rx_phyrx_rssi_legacy_info. + +rssi_comb is 8th to 15th bits of the second to last variable. +rssi_comb_ppdu is the 0th to 7th of the last variable. + +When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth > +20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power +of primary 20 MHz while rssi_comb_ppdu includes power of active +RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu. + +Also related macro definitions are too long, rename them. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Kang Yang +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++---- + drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++---- + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index e93ede5e6197c..abd611ac37f06 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar, + const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data; + + info[0] = __le32_to_cpu(rssi->info0); +- info[1] = __le32_to_cpu(rssi->info1); ++ info[2] = __le32_to_cpu(rssi->info2); + + /* TODO: Please note that the combined rssi will not be accurate + * in MU case. Rssi in MU needs to be retrieved from + * PHYRX_OTHER_RECEIVE_INFO TLV. + */ + ppdu_info->rssi_comb = +- u32_get_bits(info[1], +- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB); ++ u32_get_bits(info[2], ++ HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU); + + ppdu_info->bw = u32_get_bits(info[0], +- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW); ++ HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW); + break; + } + case HAL_PHYRX_COMMON_USER_INFO: { +diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h +index 801a5f6d3458b..d1ad7747b82c4 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_rx.h ++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h +@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type { + HAL_RECEPTION_TYPE_FRAMELESS + }; + +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0) +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5) +-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8) ++#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU GENMASK(7, 0) + + struct hal_rx_phyrx_rssi_legacy_info { + __le32 info0; + __le32 rsvd0[39]; + __le32 info1; +- __le32 rsvd1; ++ __le32 info2; + } __packed; + + #define HAL_RX_MPDU_START_INFO0_PPDU_ID GENMASK(31, 16) +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch b/queue-6.17/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch new file mode 100644 index 0000000000..61a09d85d4 --- /dev/null +++ b/queue-6.17/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch @@ -0,0 +1,53 @@ +From 5a7b4641d751521e9e7d8ea02f0d713111986351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 09:44:57 +0800 +Subject: wifi: ath12k: fix wrong logging ID used for CE + +From: Baochen Qiang + +[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ] + +ATH12K_DBG_AHB is used for CE logging which is not proper. Add +ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it. + +Compile tested only. + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/ce.c | 2 +- + drivers/net/wireless/ath/ath12k/debug.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c +index f93a419abf65e..c5aadbc6367ce 100644 +--- a/drivers/net/wireless/ath/ath12k/ce.c ++++ b/drivers/net/wireless/ath/ath12k/ce.c +@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe) + } + + while ((skb = __skb_dequeue(&list))) { +- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n", ++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n", + pipe->pipe_num, skb->len); + pipe->recv_cb(ab, skb); + } +diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h +index 48916e4e1f601..bf254e43a68d0 100644 +--- a/drivers/net/wireless/ath/ath12k/debug.h ++++ b/drivers/net/wireless/ath/ath12k/debug.h +@@ -26,6 +26,7 @@ enum ath12k_debug_mask { + ATH12K_DBG_DP_TX = 0x00002000, + ATH12K_DBG_DP_RX = 0x00004000, + ATH12K_DBG_WOW = 0x00008000, ++ ATH12K_DBG_CE = 0x00010000, + ATH12K_DBG_ANY = 0xffffffff, + }; + +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-initialize-eirp_power-before-use.patch b/queue-6.17/wifi-ath12k-initialize-eirp_power-before-use.patch new file mode 100644 index 0000000000..56ca5e3e74 --- /dev/null +++ b/queue-6.17/wifi-ath12k-initialize-eirp_power-before-use.patch @@ -0,0 +1,58 @@ +From e14cd5905ccaf3ef1956c40c89a7e7158cde54d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 11:03:10 +0800 +Subject: wifi: ath12k: initialize eirp_power before use + +From: Baochen Qiang + +[ Upstream commit bba2f9faf41ee9607c78fcd669527b7654543cfe ] + +Currently, at the end of ath12k_mac_fill_reg_tpc_info(), the +reg_tpc_info struct is populated, including the following: +reg_tpc_info->is_psd_power = is_psd_power; +reg_tpc_info->eirp_power = eirp_power; + +Kernel test robot complains on uninitialized symbol: +drivers/net/wireless/ath/ath12k/mac.c:10069 +ath12k_mac_fill_reg_tpc_info() error: uninitialized symbol 'eirp_power' + +This is because there are some code paths that never set eirp_power, so +the assignment of reg_tpc_info->eirp_power can come from an +uninitialized variable. Functionally this is OK since the eirp_power +only has meaning when is_psd_power is true, and all code paths which set +is_psd_power to true also set eirp_power. However, to keep the robot +happy, always initialize eirp_power before use. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 + +Fixes: aeda163bb0c7 ("wifi: ath12k: fill parameters for vdev set TPC power WMI command") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202505180927.tbNWr3vE-lkp@intel.com/ +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-1-56f1e54152ab@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 3a3965b79942d..93a9c2bc3c596 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -11240,8 +11240,8 @@ void ath12k_mac_fill_reg_tpc_info(struct ath12k *ar, + struct ieee80211_channel *chan, *temp_chan; + u8 pwr_lvl_idx, num_pwr_levels, pwr_reduction; + bool is_psd_power = false, is_tpe_present = false; +- s8 max_tx_power[ATH12K_NUM_PWR_LEVELS], +- psd_power, tx_power, eirp_power; ++ s8 max_tx_power[ATH12K_NUM_PWR_LEVELS], psd_power, tx_power; ++ s8 eirp_power = 0; + struct ath12k_vif *ahvif = arvif->ahvif; + u16 start_freq, center_freq; + u8 reg_6ghz_power_mode; +-- +2.51.0 + diff --git a/queue-6.17/wifi-ath12k-refactor-rx-tid-deletion-handling-into-h.patch b/queue-6.17/wifi-ath12k-refactor-rx-tid-deletion-handling-into-h.patch new file mode 100644 index 0000000000..8249640248 --- /dev/null +++ b/queue-6.17/wifi-ath12k-refactor-rx-tid-deletion-handling-into-h.patch @@ -0,0 +1,92 @@ +From ecadbccde8d6c8b28e3b12e13461f5d8a8d0997b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 16:47:45 +0530 +Subject: wifi: ath12k: Refactor RX TID deletion handling into helper function + +From: Nithyanantham Paramasivam + +[ Upstream commit 7c32476253f11210ac24c7818ca07e19bc032521 ] + +Refactor RX TID deletion handling by moving the REO command +setup and send sequence into a new helper function: +ath12k_dp_rx_tid_delete_handler(). + +This improves code readability and modularity, and prepares +the codebase for potential reuse of the REO command logic in +other contexts where RX TID deletion is required. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Nithyanantham Paramasivam +Reviewed-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250806111750.3214584-3-nithyanantham.paramasivam@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Stable-dep-of: 5e32edc69425 ("wifi: ath12k: Fix flush cache failure during RX queue update") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 27 +++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index adb0cfe109e67..8c61c7f3bbdc9 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -21,6 +21,9 @@ + + #define ATH12K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ) + ++static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab, ++ struct ath12k_dp_rx_tid *rx_tid); ++ + static enum hal_encrypt_type ath12k_dp_rx_h_enctype(struct ath12k_base *ab, + struct hal_rx_desc *desc) + { +@@ -769,6 +772,21 @@ static void ath12k_dp_rx_tid_del_func(struct ath12k_dp *dp, void *ctx, + rx_tid->qbuf.vaddr = NULL; + } + ++static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab, ++ struct ath12k_dp_rx_tid *rx_tid) ++{ ++ struct ath12k_hal_reo_cmd cmd = {}; ++ ++ cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS; ++ cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned); ++ cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned); ++ cmd.upd0 |= HAL_REO_CMD_UPD0_VLD; ++ ++ return ath12k_dp_reo_cmd_send(ab, rx_tid, ++ HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd, ++ ath12k_dp_rx_tid_del_func); ++} ++ + static void ath12k_peer_rx_tid_qref_setup(struct ath12k_base *ab, u16 peer_id, u16 tid, + dma_addr_t paddr) + { +@@ -828,20 +846,13 @@ static void ath12k_peer_rx_tid_qref_reset(struct ath12k_base *ab, u16 peer_id, u + void ath12k_dp_rx_peer_tid_delete(struct ath12k *ar, + struct ath12k_peer *peer, u8 tid) + { +- struct ath12k_hal_reo_cmd cmd = {}; + struct ath12k_dp_rx_tid *rx_tid = &peer->rx_tid[tid]; + int ret; + + if (!rx_tid->active) + return; + +- cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS; +- cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned); +- cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned); +- cmd.upd0 = HAL_REO_CMD_UPD0_VLD; +- ret = ath12k_dp_reo_cmd_send(ar->ab, rx_tid, +- HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd, +- ath12k_dp_rx_tid_del_func); ++ ret = ath12k_dp_rx_tid_delete_handler(ar->ab, rx_tid); + if (ret) { + ath12k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n", + tid, ret); +-- +2.51.0 + diff --git a/queue-6.17/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-label.patch b/queue-6.17/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-label.patch new file mode 100644 index 0000000000..fa6f182d57 --- /dev/null +++ b/queue-6.17/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-label.patch @@ -0,0 +1,133 @@ +From 39f956e76bbf8b36b555bbf311cf7d0974f3d15f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 15:41:36 +0530 +Subject: wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress + (CYW) + +From: Gokul Sivakumar + +[ Upstream commit 74e2ef72bd4b25ce21c8f309d4f5b91b5df9ff5b ] + +Cypress(Infineon) is not the vendor for this 43752 SDIO WLAN chip, and so +has not officially released any firmware binary for it. It is incorrect to +maintain this WLAN chip with firmware vendor ID as "CYW". So relabel the +chip's firmware Vendor ID as "WCC" as suggested by the maintainer. + +Fixes: d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization") +Fixes: f74f1ec22dc2 ("wifi: brcmfmac: add support for Cypress firmware api") +Signed-off-by: Gokul Sivakumar +Acked-by: Arend van Spriel +Link: https://patch.msgid.link/20250724101136.6691-1-gokulkumar.sivakumar@infineon.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 ++-- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 ++++---- + .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 - + include/linux/mmc/sdio_ids.h | 2 +- + 5 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +index 8ab7d1e34a6e1..6a3f187320fc4 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -997,9 +997,9 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = { + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356, WCC), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4359, WCC), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43751, WCC), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43752, WCC), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373, CYW), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012, CYW), +- BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752, CYW), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_89359, CYW), + CYW_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439, CYW), + { /* end: all zeroes */ } +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +index 9074ab49e8068..4239f2b21e542 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -738,8 +738,8 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) + case BRCM_CC_4364_CHIP_ID: + case CY_CC_4373_CHIP_ID: + return 0x160000; +- case CY_CC_43752_CHIP_ID: + case BRCM_CC_43751_CHIP_ID: ++ case BRCM_CC_43752_CHIP_ID: + case BRCM_CC_4377_CHIP_ID: + return 0x170000; + case BRCM_CC_4378_CHIP_ID: +@@ -1452,7 +1452,7 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub) + return (reg & CC_SR_CTL0_ENABLE_MASK) != 0; + case BRCM_CC_4359_CHIP_ID: + case BRCM_CC_43751_CHIP_ID: +- case CY_CC_43752_CHIP_ID: ++ case BRCM_CC_43752_CHIP_ID: + case CY_CC_43012_CHIP_ID: + addr = CORE_CC_REG(pmu->base, retention_ctl); + reg = chip->ops->read32(chip->ctx, addr); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 8a0bad5119a0d..8cf9d7e7c3f70 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -655,10 +655,10 @@ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), + BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359), + BRCMF_FW_ENTRY(BRCM_CC_43751_CHIP_ID, 0xFFFFFFFF, 43752), ++ BRCMF_FW_ENTRY(BRCM_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752), + BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373), + BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012), + BRCMF_FW_ENTRY(CY_CC_43439_CHIP_ID, 0xFFFFFFFF, 43439), +- BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752) + }; + + #define TXCTL_CREDITS 2 +@@ -3426,8 +3426,8 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus, + static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus) + { + if (bus->ci->chip == BRCM_CC_43751_CHIP_ID || +- bus->ci->chip == CY_CC_43012_CHIP_ID || +- bus->ci->chip == CY_CC_43752_CHIP_ID) ++ bus->ci->chip == BRCM_CC_43752_CHIP_ID || ++ bus->ci->chip == CY_CC_43012_CHIP_ID) + return true; + else + return false; +@@ -4278,8 +4278,8 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err, + + switch (sdiod->func1->device) { + case SDIO_DEVICE_ID_BROADCOM_43751: ++ case SDIO_DEVICE_ID_BROADCOM_43752: + case SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373: +- case SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752: + brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n", + CY_4373_F2_WATERMARK); + brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, +diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +index b39c5c1ee18b6..df3b67ba4db29 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h ++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +@@ -60,7 +60,6 @@ + #define CY_CC_4373_CHIP_ID 0x4373 + #define CY_CC_43012_CHIP_ID 43012 + #define CY_CC_43439_CHIP_ID 43439 +-#define CY_CC_43752_CHIP_ID 43752 + + /* USB Device IDs */ + #define BRCM_USB_43143_DEVICE_ID 0xbd1e +diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h +index fe3d6d98f8da4..673cbdf434533 100644 +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -77,7 +77,7 @@ + #define SDIO_DEVICE_ID_BROADCOM_43439 0xa9af + #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf + #define SDIO_DEVICE_ID_BROADCOM_43751 0xaae7 +-#define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752 0xaae8 ++#define SDIO_DEVICE_ID_BROADCOM_43752 0xaae8 + + #define SDIO_VENDOR_ID_CYPRESS 0x04b4 + #define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439 0xbd3d +-- +2.51.0 + diff --git a/queue-6.17/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch b/queue-6.17/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch new file mode 100644 index 0000000000..ea47f76a15 --- /dev/null +++ b/queue-6.17/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch @@ -0,0 +1,37 @@ +From b4f13508f663a50ce1dfb198b4bb24b27ba4e8a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 22:19:08 +0000 +Subject: wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() + +From: Ryder Lee + +[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ] + +The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz. +However, the expected unit is KHz. + +Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio") +Signed-off-by: Ryder Lee +Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/ +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 240c68baa3d1f..341dbf642181b 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -2992,7 +2992,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio, + u32 freq, width; + + freq = ieee80211_chandef_to_khz(chandef); +- width = cfg80211_chandef_get_width(chandef); ++ width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef)); + if (!ieee80211_radio_freq_range_valid(radio, freq, width)) + return false; + +-- +2.51.0 + diff --git a/queue-6.17/wifi-iwlwifi-remove-redundant-header-files.patch b/queue-6.17/wifi-iwlwifi-remove-redundant-header-files.patch new file mode 100644 index 0000000000..eaf667e5f2 --- /dev/null +++ b/queue-6.17/wifi-iwlwifi-remove-redundant-header-files.patch @@ -0,0 +1,36 @@ +From d99de23938fc5dcedeeba47fc418da5682938c3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 20:11:51 +0800 +Subject: wifi: iwlwifi: Remove redundant header files + +From: Liao Yuanhong + +[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ] + +The header file "fw/img.h" is already included on line 9. Remove the +redundant include. + +Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") +Signed-off-by: Liao Yuanhong +Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com +Signed-off-by: Miri Korenblit +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +index a07c512b6ed43..735482e7adf56 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +@@ -12,7 +12,6 @@ + #include "fw/api/phy.h" + #include "fw/api/config.h" + #include "fw/api/nvm-reg.h" +-#include "fw/img.h" + #include "iwl-trans.h" + + #define BIOS_SAR_MAX_PROFILE_NUM 4 +-- +2.51.0 + diff --git a/queue-6.17/wifi-mac80211-consider-links-for-validating-scan_fla.patch b/queue-6.17/wifi-mac80211-consider-links-for-validating-scan_fla.patch new file mode 100644 index 0000000000..0fc89b35ae --- /dev/null +++ b/queue-6.17/wifi-mac80211-consider-links-for-validating-scan_fla.patch @@ -0,0 +1,77 @@ +From a53ee089764e616dd55c8f022e123b74e8353b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 12:53:30 +0530 +Subject: wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan + request during MLO + +From: Aditya Kumar Singh + +[ Upstream commit 36b75dcb1e25739a3a0975699208c98f4b55d012 ] + +Commit 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request +during MLO") introduced a check that rejects scan requests if any link is +already beaconing. This works fine when all links share the same radio, but +breaks down in multi-radio setups. + +Consider a scenario where a 2.4 GHz link is beaconing and a scan is +requested on a 5 GHz link, each backed by a different physical radio. The +current logic still blocks the scan, even though it should be allowed. As a +result, interface bring-up fails unnecessarily in valid configurations. + +Fix this by checking whether the scan is being requested on the same +underlying radio as the beaconing link. Only reject the scan if it targets +a link that is already beaconing and the NL80211_FEATURE_AP_SCAN is not +set. This ensures correct behavior in multi-radio environments and avoids +false rejections. + +Fixes: 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO") +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-3-383ffb6da213@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 2ed07fa121ab7..7609c7c31df74 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -3001,6 +3001,9 @@ static int ieee80211_scan(struct wiphy *wiphy, + struct cfg80211_scan_request *req) + { + struct ieee80211_sub_if_data *sdata; ++ struct ieee80211_link_data *link; ++ struct ieee80211_channel *chan; ++ int radio_idx; + + sdata = IEEE80211_WDEV_TO_SUB_IF(req->wdev); + +@@ -3028,10 +3031,20 @@ static int ieee80211_scan(struct wiphy *wiphy, + * the frames sent while scanning on other channel will be + * lost) + */ +- if (ieee80211_num_beaconing_links(sdata) && +- (!(wiphy->features & NL80211_FEATURE_AP_SCAN) || +- !(req->flags & NL80211_SCAN_FLAG_AP))) +- return -EOPNOTSUPP; ++ for_each_link_data(sdata, link) { ++ /* if the link is not beaconing, ignore it */ ++ if (!sdata_dereference(link->u.ap.beacon, sdata)) ++ continue; ++ ++ chan = link->conf->chanreq.oper.chan; ++ radio_idx = cfg80211_get_radio_idx_by_chan(wiphy, chan); ++ ++ if (ieee80211_is_radio_idx_in_scan_req(wiphy, req, ++ radio_idx) && ++ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) || ++ !(req->flags & NL80211_SCAN_FLAG_AP))) ++ return -EOPNOTSUPP; ++ } + break; + case NL80211_IFTYPE_NAN: + default: +-- +2.51.0 + diff --git a/queue-6.17/wifi-mac80211-fix-reporting-of-all-valid-links-in-st.patch b/queue-6.17/wifi-mac80211-fix-reporting-of-all-valid-links-in-st.patch new file mode 100644 index 0000000000..26a46fd1e2 --- /dev/null +++ b/queue-6.17/wifi-mac80211-fix-reporting-of-all-valid-links-in-st.patch @@ -0,0 +1,65 @@ +From c6e82de6495c396420c0599bbfb1d5bf856aa74b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 16:10:54 +0530 +Subject: wifi: mac80211: fix reporting of all valid links in sta_set_sinfo() + +From: Sarika Sharma + +[ Upstream commit eebccbfea4184feb758c104783b870ec4ddb6aec ] + +Currently, sta_set_sinfo() fails to populate link-level station info +when sinfo->valid_links is initially 0 and sta->sta.valid_links has +bits set for links other than link 0. This typically occurs when +association happens on a non-zero link or link 0 deleted dynamically. +In such cases, the for_each_valid_link(sinfo, link_id) loop only +executes for link 0 and terminates early, since sinfo->valid_links +remains 0. As a result, only MLD-level information is reported to +userspace. + +Hence to fix, initialize sinfo->valid_links with sta->sta.valid_links +before entering the loop to ensure loop executes for each valid link. +During iteration, mask out invalid links from sinfo->valid_links if +any of sta->link[link_id], sdata->link[link_id], or sinfo->links[link_id] +are not present, to report only valid link information. + +Fixes: 505991fba9ec ("wifi: mac80211: extend support to fill link level sinfo structure") +Signed-off-by: Sarika Sharma +Link: https://patch.msgid.link/20250904104054.790321-1-quic_sarishar@quicinc.com +[clarify comment] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 8c550aab9bdce..ebcec5241a944 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -3206,16 +3206,20 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo, + struct link_sta_info *link_sta; + + ether_addr_copy(sinfo->mld_addr, sta->addr); ++ ++ /* assign valid links first for iteration */ ++ sinfo->valid_links = sta->sta.valid_links; ++ + for_each_valid_link(sinfo, link_id) { + link_sta = wiphy_dereference(sta->local->hw.wiphy, + sta->link[link_id]); + link = wiphy_dereference(sdata->local->hw.wiphy, + sdata->link[link_id]); + +- if (!link_sta || !sinfo->links[link_id] || !link) ++ if (!link_sta || !sinfo->links[link_id] || !link) { ++ sinfo->valid_links &= ~BIT(link_id); + continue; +- +- sinfo->valid_links = sta->sta.valid_links; ++ } + sta_set_link_sinfo(sta, sinfo->links[link_id], + link, tidstats); + } +-- +2.51.0 + diff --git a/queue-6.17/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.17/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch new file mode 100644 index 0000000000..dd2912432e --- /dev/null +++ b/queue-6.17/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch @@ -0,0 +1,87 @@ +From 243bdb06e94d3a9299b021dc1981db224200723a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 12:42:03 +0530 +Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not + available + +From: Aditya Kumar Singh + +[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ] + +In ieee80211_rx_handle_packet(), if the caller does not provide pubsta +information, an attempt is made to find the station using the address 2 +(source address) field in the header. Since pubsta is missing, link +information such as link_valid and link_id is also unavailable. Now if such +a situation comes, and if a matching ML station entry is found based on +the source address, currently the packet is dropped due to missing link ID +in the status field which is not correct. + +Hence, to fix this issue, if link_valid is not set and the station is an +ML station, make an attempt to find a link station entry using the source +address. If a valid link station is found, derive the link ID and proceed +with packet processing. Otherwise, drop the packet as per the existing +flow. + +Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") +Suggested-by: Vasanthakumar Thiagarajan +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 4d4ff4d4917a2..59baca24aa6b9 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5230,12 +5230,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5243,10 +5251,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; ++ ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +-- +2.51.0 + diff --git a/queue-6.17/wifi-mac80211-make-connection_monitor-optional-for-m.patch b/queue-6.17/wifi-mac80211-make-connection_monitor-optional-for-m.patch new file mode 100644 index 0000000000..7ced28af1d --- /dev/null +++ b/queue-6.17/wifi-mac80211-make-connection_monitor-optional-for-m.patch @@ -0,0 +1,40 @@ +From 8658ca1e58c7adff042e2377fa4e920936a76e6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 13:54:31 +0200 +Subject: wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta + +From: Lorenzo Bianconi + +[ Upstream commit ac36daa83650c26fd55dee1a6ee5144769239911 ] + +Since commit '1bc892d76a6f ("wifi: mac80211: extend connection +monitoring for MLO")' mac80211 supports connection monitor for MLO +client interfaces. Remove the CONNECTION_MONITOR requirement in +ieee80211_register_hw routine. + +Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250826-remove-conn-mon-check-ieee80211_register_hw-v2-1-5a1e2f038245@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 3ae6104e5cb20..78f862f79aa82 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1164,9 +1164,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE))) + return -EINVAL; + +- if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR))) +- return -EINVAL; +- + if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC))) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.17/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..0b925f1cfe --- /dev/null +++ b/queue-6.17/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From f8e8bcf81304e10315c5e44a85db1ce9edddb866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index 08590aa68356f..1dd3723720480 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch b/queue-6.17/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch new file mode 100644 index 0000000000..ad71ff5aee --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch @@ -0,0 +1,132 @@ +From 92a98fa23d446430de51f08b60fa48115497237d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 14:48:24 +0800 +Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration + +From: Zhi-Jun You + +[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ] + +In vendor driver, size of group cal and dpd cal for mt7981 includes 6G +although the chip doesn't support it. + +mt76 doesn't take this into account which results in reading from the +incorrect offset. + +For devices with precal, this would lead to lower bitrate. + +Fix this by aligning groupcal size with vendor driver and switch to +freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset. + +Below are iwinfo of the test device with two clients connected +(iPhone 16, Intel AX210). +Before : + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 612.4 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +After: + Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80 + Center Channel 1: 42 2: unknown + Tx-Power: 23 dBm Link Quality: 43/70 + Signal: -67 dBm Noise: -92 dBm + Bit Rate: 900.6 MBit/s + Encryption: WPA3 SAE (CCMP) + Type: nl80211 HW Mode(s): 802.11ac/ax/n + Hardware: embedded [MediaTek MT7981] + +Tested-on: mt7981 20240823 + +Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration") +Signed-off-by: Zhi-Jun You +Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++-- + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++-------------- + 2 files changed, 10 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +index 31aec0f40232a..73611c9d26e15 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h +@@ -50,9 +50,9 @@ enum mt7915_eeprom_field { + #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16) ++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16) + #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT) + #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT) +-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */ + + #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0) + #define MT_EE_WIFI_CONF0_RX_PATH GENMASK(5, 3) +@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev) + val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val); + return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G : + MT_EE_CAL_GROUP_SIZE_7916; ++ } else if (is_mt7981(&dev->mt76)) { ++ return MT_EE_CAL_GROUP_SIZE_7981; + } else if (mt7915_check_adie(dev, false)) { + return MT_EE_CAL_GROUP_SIZE_7976; + } else { +@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev) + { + if (is_mt7915(&dev->mt76)) + return MT_EE_CAL_DPD_SIZE_V1; +- else if (is_mt7981(&dev->mt76)) +- return MT_EE_CAL_DPD_SIZE_V2_7981; + else + return MT_EE_CAL_DPD_SIZE_V2; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 2928e75b23976..c1fdd3c4f1ba6 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -3052,30 +3052,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw) + /* 5G BW160 */ + 5250, 5570, 5815 + }; +- static const u16 freq_list_v2_7981[] = { +- /* 5G BW20 */ +- 5180, 5200, 5220, 5240, +- 5260, 5280, 5300, 5320, +- 5500, 5520, 5540, 5560, +- 5580, 5600, 5620, 5640, +- 5660, 5680, 5700, 5720, +- 5745, 5765, 5785, 5805, +- 5825, 5845, 5865, 5885, +- /* 5G BW160 */ +- 5250, 5570, 5815 +- }; +- const u16 *freq_list = freq_list_v1; +- int n_freqs = ARRAY_SIZE(freq_list_v1); +- int idx; ++ const u16 *freq_list; ++ int idx, n_freqs; + + if (!is_mt7915(&dev->mt76)) { +- if (is_mt7981(&dev->mt76)) { +- freq_list = freq_list_v2_7981; +- n_freqs = ARRAY_SIZE(freq_list_v2_7981); +- } else { +- freq_list = freq_list_v2; +- n_freqs = ARRAY_SIZE(freq_list_v2); +- } ++ freq_list = freq_list_v2; ++ n_freqs = ARRAY_SIZE(freq_list_v2); ++ } else { ++ freq_list = freq_list_v1; ++ n_freqs = ARRAY_SIZE(freq_list_v1); + } + + if (freq < 4000) { +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-check-phy-before-init-msta_link-in-.patch b/queue-6.17/wifi-mt76-mt7996-check-phy-before-init-msta_link-in-.patch new file mode 100644 index 0000000000..233d8c1654 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-check-phy-before-init-msta_link-in-.patch @@ -0,0 +1,53 @@ +From 1acf47c480af2b84de74935aef6162091fe22898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 00:26:47 +0200 +Subject: wifi: mt76: mt7996: Check phy before init msta_link in + mt7996_mac_sta_add_links() + +From: Lorenzo Bianconi + +[ Upstream commit fe5fffadc6c77c56f122cf1042dc830f59e904bf ] + +In order to avoid a possible NULL pointer dereference in +mt7996_mac_sta_init_link routine, move the phy pointer check before +running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine. + +Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250830-mt7996_mac_sta_add_links-fix-v1-1-4219fb8755ee@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 81391db535866..d01b5778da20e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -1080,16 +1080,17 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif, + goto error_unlink; + } + +- err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link, +- link_id); +- if (err) +- goto error_unlink; +- + mphy = mt76_vif_link_phy(&link->mt76); + if (!mphy) { + err = -EINVAL; + goto error_unlink; + } ++ ++ err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link, ++ link_id); ++ if (err) ++ goto error_unlink; ++ + mphy->num_sta++; + } + +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch b/queue-6.17/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch new file mode 100644 index 0000000000..d4d5cd82d9 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch @@ -0,0 +1,95 @@ +From a0ddb8ae098640575e099aff597cbba99ec8a90b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:19 +0200 +Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE + +From: Lorenzo Bianconi + +[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ] + +Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not +break endianness + +Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++--- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------ + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index be729db5b75c1..84015ab24af62 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev) + static int mt7996_wed_rro_init(struct mt7996_dev *dev) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mtk_wed_device *wed = &dev->mt76.mmio.wed; + u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0; + struct mt7996_wed_rro_addr *addr; +@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + + addr = dev->wed_rro.addr_elem[i].ptr; + for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) + dev->wed_rro.session.ptr = ptr; + addr = dev->wed_rro.session.ptr; + for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) { +- addr->signature = 0xff; ++ addr->data = cpu_to_le32(val); + addr++; + } + +@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev) + static void mt7996_wed_rro_work(struct work_struct *work) + { + #ifdef CONFIG_NET_MEDIATEK_SOC_WED ++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff); + struct mt7996_dev *dev; + LIST_HEAD(list); + +@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work) + MT7996_RRO_WINDOW_MAX_LEN; + reset: + elem = ptr + elem_id * sizeof(*elem); +- elem->signature = 0xff; ++ elem->data |= cpu_to_le32(val); + } + mt7996_mcu_wed_rro_reset_sessions(dev, e->id); + out: +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index b98cfe6e5be8c..048d9a9898c6e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -277,13 +277,12 @@ struct mt7996_hif { + int irq; + }; + ++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24) ++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4) ++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0) + struct mt7996_wed_rro_addr { +- u32 head_low; +- u32 head_high : 4; +- u32 count: 11; +- u32 oor: 1; +- u32 rsv : 8; +- u32 signature : 8; ++ __le32 head_low; ++ __le32 data; + }; + + struct mt7996_wed_rro_session_id { +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch new file mode 100644 index 0000000000..fd2373aa28 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch @@ -0,0 +1,215 @@ +From 88a893e082220ada42c6d9c09c5972e781d75fe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 10:26:19 +0200 +Subject: wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine + +From: Lorenzo Bianconi + +[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ] + +Update mt7996_mcu_bss_mld_tlv routine to properly support MLO +configuring the BSS. + +Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/main.c | 46 ++++++++++++++++++- + .../net/wireless/mediatek/mt76/mt7996/mcu.c | 26 ++++++++--- + .../net/wireless/mediatek/mt76/mt7996/mcu.h | 3 +- + .../wireless/mediatek/mt76/mt7996/mt7996.h | 8 ++++ + 4 files changed, 75 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 8a8a478391646..3c34a4980afa0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask) + return -1; + } + ++static int get_own_mld_idx(u64 mask, bool group_mld) ++{ ++ u8 start = group_mld ? 0 : 16; ++ u8 end = group_mld ? 15 : 63; ++ int idx; ++ ++ idx = get_free_idx(mask, start, end); ++ if (idx) ++ return idx - 1; ++ ++ /* If the 16-63 range is not available, perform another lookup in the ++ * range 0-15 ++ */ ++ if (!group_mld) { ++ idx = get_free_idx(mask, 0, 15); ++ if (idx) ++ return idx - 1; ++ } ++ ++ return -EINVAL; ++} ++ + static void + mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink) + { +@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + struct mt7996_dev *dev = phy->dev; + u8 band_idx = phy->mt76->band_idx; + struct mt76_txq *mtxq; +- int idx, ret; ++ int mld_idx, idx, ret; + + mlink->idx = __ffs64(~dev->mt76.vif_mask); + if (mlink->idx >= mt7996_max_interface_num(dev)) +@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + if (idx < 0) + return -ENOSPC; + ++ if (!dev->mld_idx_mask) { /* first link in the group */ ++ mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true); ++ mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask, ++ 0, 15); ++ } ++ ++ mld_idx = get_own_mld_idx(dev->mld_idx_mask, false); ++ if (mld_idx < 0) ++ return -ENOSPC; ++ ++ link->mld_idx = mld_idx; + link->phy = phy; + mlink->omac_idx = idx; + mlink->band_idx = band_idx; +@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, + return ret; + + dev->mt76.vif_mask |= BIT_ULL(mlink->idx); ++ if (!dev->mld_idx_mask) { ++ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx); ++ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx); ++ } ++ dev->mld_idx_mask |= BIT_ULL(link->mld_idx); + phy->omac_mask |= BIT_ULL(mlink->omac_idx); + + idx = MT7996_WTBL_RESERVED - mlink->idx; +@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif, + } + + dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx); ++ dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx); + phy->omac_mask &= ~BIT_ULL(mlink->omac_idx); ++ if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) { ++ /* last link */ ++ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx); ++ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx); ++ } + + spin_lock_bh(&dev->mt76.sta_poll_lock); + if (!list_empty(&msta_link->wcid.poll_list)) +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index e6db3e0b2ffda..aad58f7831c7b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en) + } + + static void +-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink) ++mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, ++ struct ieee80211_bss_conf *link_conf, ++ struct mt7996_vif_link *link) + { ++ struct ieee80211_vif *vif = link_conf->vif; ++ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; + struct bss_mld_tlv *mld; + struct tlv *tlv; + + tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld)); +- + mld = (struct bss_mld_tlv *)tlv; +- mld->group_mld_id = 0xff; +- mld->own_mld_id = mlink->idx; +- mld->remap_idx = 0xff; ++ mld->own_mld_id = link->mld_idx; ++ mld->link_id = link_conf->link_id; ++ ++ if (ieee80211_vif_is_mld(vif)) { ++ mld->group_mld_id = mvif->mld_group_idx; ++ mld->remap_idx = mvif->mld_remap_idx; ++ memcpy(mld->mac_addr, vif->addr, ETH_ALEN); ++ } else { ++ mld->group_mld_id = 0xff; ++ mld->remap_idx = 0xff; ++ } + } + + static void +@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif, + goto out; + + if (enable) { ++ struct mt7996_vif_link *link; ++ + mt7996_mcu_bss_rfch_tlv(skb, phy); + mt7996_mcu_bss_bmc_tlv(skb, mlink, phy); + mt7996_mcu_bss_ra_tlv(skb, phy); +@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif, + mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy); + + /* this tag is necessary no matter if the vif is MLD */ +- mt7996_mcu_bss_mld_tlv(skb, mlink); ++ link = container_of(mlink, struct mt7996_vif_link, mt76); ++ mt7996_mcu_bss_mld_tlv(skb, link_conf, link); + } + + mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h +index 130ea95626d5b..7b21d6ae7e435 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h +@@ -481,7 +481,8 @@ struct bss_mld_tlv { + u8 own_mld_id; + u8 mac_addr[ETH_ALEN]; + u8 remap_idx; +- u8 __rsv[3]; ++ u8 link_id; ++ u8 __rsv[2]; + } __packed; + + struct sta_rec_ht_uni { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index bbd4679edc9d3..b98cfe6e5be8c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -248,11 +248,16 @@ struct mt7996_vif_link { + + struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS]; + struct cfg80211_bitrate_mask bitrate_mask; ++ ++ u8 mld_idx; + }; + + struct mt7996_vif { + struct mt7996_vif_link deflink; /* must be first */ + struct mt76_vif_data mt76; ++ ++ u8 mld_group_idx; ++ u8 mld_remap_idx; + }; + + /* crash-dump */ +@@ -337,6 +342,9 @@ struct mt7996_dev { + u32 q_int_mask[MT7996_MAX_QUEUE]; + u32 q_wfdma_mask; + ++ u64 mld_idx_mask; ++ u64 mld_remap_idx_mask; ++ + const struct mt76_bus_ops *bus_ops; + struct mt7996_phy phy; + +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch new file mode 100644 index 0000000000..5650bbd9a2 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch @@ -0,0 +1,96 @@ +From 64a930b156bedf2a03172ec0845fd5cf9e979b23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jul 2025 09:12:05 +0200 +Subject: wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration + +From: Lorenzo Bianconi + +[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ] + +Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly +support MLO scenario. + +Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++-- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 12 +++++++----- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 ++- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 84f731b387d20..8a8a478391646 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -1327,11 +1327,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + case IEEE80211_AMPDU_RX_START: + mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid, + ssn, params->buf_size); +- ret = mt7996_mcu_add_rx_ba(dev, params, link, true); ++ ret = mt7996_mcu_add_rx_ba(dev, params, link, ++ msta_link, true); + break; + case IEEE80211_AMPDU_RX_STOP: + mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid); +- ret = mt7996_mcu_add_rx_ba(dev, params, link, false); ++ ret = mt7996_mcu_add_rx_ba(dev, params, link, ++ msta_link, false); + break; + case IEEE80211_AMPDU_TX_OPERATIONAL: + mtxq->aggr = true; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index 0be03eb3cf461..e6db3e0b2ffda 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif, + static int + mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif, + struct ieee80211_ampdu_params *params, +- bool enable, bool tx) ++ struct mt76_wcid *wcid, bool enable, bool tx) + { +- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv; + struct sta_rec_ba_uni *ba; + struct sk_buff *skb; + struct tlv *tlv; +@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev, + if (enable && !params->amsdu) + msta_link->wcid.amsdu = false; + +- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true); ++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid, ++ enable, true); + } + + int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev, + struct ieee80211_ampdu_params *params, +- struct mt7996_vif_link *link, bool enable) ++ struct mt7996_vif_link *link, ++ struct mt7996_sta_link *msta_link, bool enable) + { +- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false); ++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid, ++ enable, false); + } + + static void +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index 8509d508e1e19..bbd4679edc9d3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev, + struct mt7996_sta_link *msta_link, bool enable); + int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev, + struct ieee80211_ampdu_params *params, +- struct mt7996_vif_link *link, bool enable); ++ struct mt7996_vif_link *link, ++ struct mt7996_sta_link *msta_link, bool enable); + int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, + struct mt76_vif_link *mlink, + struct cfg80211_he_bss_color *he_bss_color); +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch b/queue-6.17/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch new file mode 100644 index 0000000000..8bb5d64c63 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch @@ -0,0 +1,46 @@ +From 366f8b0e6ab3160ab3b6273d1c1e3f2560af104e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:17 +0200 +Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED + device + +From: Lorenzo Bianconi + +[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ] + +In order to properly set the number of rx packets for primary WED device +if hif device is available, move hif pointer initialization before +running mt7996_mmio_wed_init routine. + +Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +index 19e99bc1c6c41..f5ce50056ee94 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c +@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + mdev = &dev->mt76; + mt7996_wfsys_reset(dev); + hif2 = mt7996_pci_init_hif2(pdev); ++ dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, pdev, false, &irq); + if (ret < 0) +@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev, + + if (hif2) { + hif2_dev = container_of(hif2->dev, struct pci_dev, dev); +- dev->hif2 = hif2; + + ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq); + if (ret < 0) +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch b/queue-6.17/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch new file mode 100644 index 0000000000..5941dfc8ce --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch @@ -0,0 +1,63 @@ +From 5a6754b8b781c25fa8909015aa670be2a54e5e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:45:16 +0200 +Subject: wifi: mt76: mt7996: Fix tx-queues initialization for second phy on + mt7996 + +From: Lorenzo Bianconi + +[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ] + +Fix the second phy tx queue initialization if hif device is not +available for MT7990 chipset. + +Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support") +Co-developed-by: Sujuan Chen +Signed-off-by: Sujuan Chen +Co-developed-by: Benjamin Lin +Signed-off-by: Benjamin Lin +Co-developed-by: Rex Lu +Signed-off-by: Rex Lu +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/init.c | 21 ++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +index a9599c286328e..be729db5b75c1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c +@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band) + + /* init wiphy according to mphy and phy */ + mt7996_init_wiphy_band(mphy->hw, phy); +- ret = mt7996_init_tx_queues(mphy->priv, +- MT_TXQ_ID(band), +- MT7996_TX_RING_SIZE, +- MT_TXQ_RING_BASE(band) + hif1_ofs, +- wed); +- if (ret) +- goto error; ++ ++ if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) { ++ int i; ++ ++ for (i = 0; i <= MT_TXQ_PSD; i++) ++ mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0]; ++ } else { ++ ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band), ++ MT7996_TX_RING_SIZE, ++ MT_TXQ_RING_BASE(band) + hif1_ofs, ++ wed); ++ if (ret) ++ goto error; ++ } + + ret = mt76_register_phy(mphy, true, mt76_rates, + ARRAY_SIZE(mt76_rates)); +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch b/queue-6.17/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch new file mode 100644 index 0000000000..1f19ed3369 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch @@ -0,0 +1,275 @@ +From 88286cca064f163f3c0d35786c2473d9ff845134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:58:56 +0200 +Subject: wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during + restart + +From: Felix Fietkau + +[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ] + +There is only one wiphy, so extra calls must be removed. +For calls that need to remain per-wiphy, use mt7996_for_each_phy + +Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") +Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mac.c | 137 +++++------------- + 1 file changed, 35 insertions(+), 102 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index b3fcca9bbb958..28477702c18b3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev) + static int + mt7996_mac_restart(struct mt7996_dev *dev) + { +- struct mt7996_phy *phy2, *phy3; + struct mt76_dev *mdev = &dev->mt76; ++ struct mt7996_phy *phy; + int i, ret; + +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); +- + if (dev->hif2) { + mt76_wr(dev, MT_INT1_MASK_CSR, 0x0); + mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0); +@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev) + mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0); + } + +- set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); ++ mt7996_for_each_phy(dev, phy) ++ set_bit(MT76_RESET, &phy->mt76->state); + wake_up(&dev->mt76.mcu.wait); +- if (phy2) +- set_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- set_bit(MT76_RESET, &phy3->mt76->state); + + /* lock/unlock all queues to ensure that no tx is pending */ +- mt76_txq_schedule_all(&dev->mphy); +- if (phy2) +- mt76_txq_schedule_all(phy2->mt76); +- if (phy3) +- mt76_txq_schedule_all(phy3->mt76); ++ mt7996_for_each_phy(dev, phy) ++ mt76_txq_schedule_all(phy->mt76); + + /* disable all tx/rx napi */ + mt76_worker_disable(&dev->mt76.tx_worker); +@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev) + goto out; + + mt7996_mac_init(dev); +- mt7996_init_txpower(&dev->phy); +- mt7996_init_txpower(phy2); +- mt7996_init_txpower(phy3); ++ mt7996_for_each_phy(dev, phy) ++ mt7996_init_txpower(phy); + ret = mt7996_txbf_init(dev); ++ if (ret) ++ goto out; + +- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) { +- ret = mt7996_run(&dev->phy); +- if (ret) +- goto out; +- } +- +- if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) { +- ret = mt7996_run(phy2); +- if (ret) +- goto out; +- } ++ mt7996_for_each_phy(dev, phy) { ++ if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state)) ++ continue; + +- if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) { +- ret = mt7996_run(phy3); ++ ret = mt7996_run(&dev->phy); + if (ret) + goto out; + } + + out: + /* reset done */ +- clear_bit(MT76_RESET, &dev->mphy.state); +- if (phy2) +- clear_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- clear_bit(MT76_RESET, &phy3->mt76->state); ++ mt7996_for_each_phy(dev, phy) ++ clear_bit(MT76_RESET, &phy->mt76->state); + + napi_enable(&dev->mt76.tx_napi); + local_bh_disable(); +@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev) + static void + mt7996_mac_full_reset(struct mt7996_dev *dev) + { +- struct mt7996_phy *phy2, *phy3; ++ struct ieee80211_hw *hw = mt76_hw(dev); ++ struct mt7996_phy *phy; + int i; + +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); + dev->recovery.hw_full_reset = true; + + wake_up(&dev->mt76.mcu.wait); +- ieee80211_stop_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_stop_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_stop_queues(phy3->mt76->hw); ++ ieee80211_stop_queues(hw); + + cancel_work_sync(&dev->wed_rro.work); +- cancel_delayed_work_sync(&dev->mphy.mac_work); +- if (phy2) +- cancel_delayed_work_sync(&phy2->mt76->mac_work); +- if (phy3) +- cancel_delayed_work_sync(&phy3->mt76->mac_work); ++ mt7996_for_each_phy(dev, phy) ++ cancel_delayed_work_sync(&phy->mt76->mac_work); + + mutex_lock(&dev->mt76.mutex); + for (i = 0; i < 10; i++) { +@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev) + dev_err(dev->mt76.dev, "chip full reset failed\n"); + + ieee80211_restart_hw(mt76_hw(dev)); +- if (phy2) +- ieee80211_restart_hw(phy2->mt76->hw); +- if (phy3) +- ieee80211_restart_hw(phy3->mt76->hw); +- + ieee80211_wake_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_wake_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_wake_queues(phy3->mt76->hw); + + dev->recovery.hw_full_reset = false; +- ieee80211_queue_delayed_work(mt76_hw(dev), +- &dev->mphy.mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy2) +- ieee80211_queue_delayed_work(phy2->mt76->hw, +- &phy2->mt76->mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy3) +- ieee80211_queue_delayed_work(phy3->mt76->hw, +- &phy3->mt76->mac_work, ++ mt7996_for_each_phy(dev, phy) ++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, + MT7996_WATCHDOG_TIME); + } + + void mt7996_mac_reset_work(struct work_struct *work) + { +- struct mt7996_phy *phy2, *phy3; ++ struct ieee80211_hw *hw; + struct mt7996_dev *dev; ++ struct mt7996_phy *phy; + int i; + + dev = container_of(work, struct mt7996_dev, reset_work); +- phy2 = mt7996_phy2(dev); +- phy3 = mt7996_phy3(dev); ++ hw = mt76_hw(dev); + + /* chip full reset */ + if (dev->recovery.restart) { +@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work) + return; + + dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.", +- wiphy_name(dev->mt76.hw->wiphy)); ++ wiphy_name(hw->wiphy)); + + if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2)) + mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2); +@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work) + mtk_wed_device_stop(&dev->mt76.mmio.wed); + + ieee80211_stop_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_stop_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_stop_queues(phy3->mt76->hw); + + set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); + wake_up(&dev->mt76.mcu.wait); + + cancel_work_sync(&dev->wed_rro.work); +- cancel_delayed_work_sync(&dev->mphy.mac_work); +- if (phy2) { +- set_bit(MT76_RESET, &phy2->mt76->state); +- cancel_delayed_work_sync(&phy2->mt76->mac_work); +- } +- if (phy3) { +- set_bit(MT76_RESET, &phy3->mt76->state); +- cancel_delayed_work_sync(&phy3->mt76->mac_work); ++ mt7996_for_each_phy(dev, phy) { ++ set_bit(MT76_RESET, &phy->mt76->state); ++ cancel_delayed_work_sync(&phy->mt76->mac_work); + } ++ + mt76_worker_disable(&dev->mt76.tx_worker); + mt76_for_each_q_rx(&dev->mt76, i) { + if (mtk_wed_device_active(&dev->mt76.mmio.wed) && +@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work) + } + + clear_bit(MT76_MCU_RESET, &dev->mphy.state); +- clear_bit(MT76_RESET, &dev->mphy.state); +- if (phy2) +- clear_bit(MT76_RESET, &phy2->mt76->state); +- if (phy3) +- clear_bit(MT76_RESET, &phy3->mt76->state); ++ mt7996_for_each_phy(dev, phy) ++ clear_bit(MT76_RESET, &phy->mt76->state); + + mt76_for_each_q_rx(&dev->mt76, i) { + if (mtk_wed_device_active(&dev->mt76.mmio.wed) && +@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work) + napi_schedule(&dev->mt76.tx_napi); + local_bh_enable(); + +- ieee80211_wake_queues(mt76_hw(dev)); +- if (phy2) +- ieee80211_wake_queues(phy2->mt76->hw); +- if (phy3) +- ieee80211_wake_queues(phy3->mt76->hw); ++ ieee80211_wake_queues(hw); + + mutex_unlock(&dev->mt76.mutex); + + mt7996_update_beacons(dev); + +- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy2) +- ieee80211_queue_delayed_work(phy2->mt76->hw, +- &phy2->mt76->mac_work, +- MT7996_WATCHDOG_TIME); +- if (phy3) +- ieee80211_queue_delayed_work(phy3->mt76->hw, +- &phy3->mt76->mac_work, ++ mt7996_for_each_phy(dev, phy) ++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work, + MT7996_WATCHDOG_TIME); + dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.", + wiphy_name(dev->mt76.hw->wiphy)); +-- +2.51.0 + diff --git a/queue-6.17/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch b/queue-6.17/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch new file mode 100644 index 0000000000..fd1e477631 --- /dev/null +++ b/queue-6.17/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch @@ -0,0 +1,105 @@ +From e315276da867d46da2eac130eabe38b2c941f11e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 00:14:37 +0200 +Subject: wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback + +From: Lorenzo Bianconi + +[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ] + +Do not always use deflink_id in link_sta_rc_update mac80211 +callback but use the proper link_id provided by mac80211. + +Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO") +Signed-off-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/main.c | 43 ++++++++++++------- + 1 file changed, 28 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 3c34a4980afa0..81391db535866 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -1663,19 +1663,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw, + } + } + +-static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta) ++static void mt7996_link_rate_ctrl_update(void *data, ++ struct mt7996_sta_link *msta_link) + { +- struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta *msta = msta_link->sta; + struct mt7996_dev *dev = msta->vif->deflink.phy->dev; +- struct mt7996_sta_link *msta_link; + u32 *changed = data; + +- rcu_read_lock(); +- +- msta_link = rcu_dereference(msta->link[msta->deflink_id]); +- if (!msta_link) +- goto out; +- + spin_lock_bh(&dev->mt76.sta_poll_lock); + + msta_link->changed |= *changed; +@@ -1683,8 +1677,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta) + list_add_tail(&msta_link->rc_list, &dev->sta_rc_list); + + spin_unlock_bh(&dev->mt76.sta_poll_lock); +-out: +- rcu_read_unlock(); + } + + static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw, +@@ -1692,11 +1684,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw, + struct ieee80211_link_sta *link_sta, + u32 changed) + { +- struct mt7996_dev *dev = mt7996_hw_dev(hw); + struct ieee80211_sta *sta = link_sta->sta; ++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta_link *msta_link; + +- mt7996_link_rate_ctrl_update(&changed, sta); +- ieee80211_queue_work(hw, &dev->rc_work); ++ rcu_read_lock(); ++ ++ msta_link = rcu_dereference(msta->link[link_sta->link_id]); ++ if (msta_link) { ++ struct mt7996_dev *dev = mt7996_hw_dev(hw); ++ ++ mt7996_link_rate_ctrl_update(&changed, msta_link); ++ ieee80211_queue_work(hw, &dev->rc_work); ++ } ++ ++ rcu_read_unlock(); ++} ++ ++static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta) ++{ ++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; ++ struct mt7996_sta_link *msta_link; ++ u32 *changed = data; ++ ++ msta_link = rcu_dereference(msta->link[msta->deflink_id]); ++ if (msta_link) ++ mt7996_link_rate_ctrl_update(&changed, msta_link); + } + + static int +@@ -1717,7 +1730,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT + * then multiple MCS setting (MCS 4,5,6) is not supported. + */ +- ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update, ++ ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update, + &changed); + ieee80211_queue_work(hw, &dev->rc_work); + +-- +2.51.0 + diff --git a/queue-6.17/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.17/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..a6221a6d7c --- /dev/null +++ b/queue-6.17/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From 9c3e09526c0a14e1154c0a67417a1b8a9d52c35c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 4c8c7a5fdf23e..be23a29e7de09 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -686,10 +686,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-6.17/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch b/queue-6.17/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch new file mode 100644 index 0000000000..373976ecbf --- /dev/null +++ b/queue-6.17/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch @@ -0,0 +1,67 @@ +From 2b9bfc75321e7ba9464ee8498e3ffbdd2d24409e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 23:08:24 +0300 +Subject: wifi: rtw88: Lock rtwdev->mutex before setting the LED + +From: Bitterblue Smith + +[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ] + +Some users report that the LED blinking breaks AP mode somehow. Most +likely the LED code and the dynamic mechanism are trying to access the +hardware registers at the same time. Fix it by locking rtwdev->mutex +before setting the LED and unlocking it after. + +Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking") +Closes: https://github.com/lwfinger/rtw88/issues/305 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c +index 25aa6cbaa7286..7f9ace351a5b7 100644 +--- a/drivers/net/wireless/realtek/rtw88/led.c ++++ b/drivers/net/wireless/realtek/rtw88/led.c +@@ -6,13 +6,23 @@ + #include "debug.h" + #include "led.h" + +-static int rtw_led_set_blocking(struct led_classdev *led, +- enum led_brightness brightness) ++static void rtw_led_set(struct led_classdev *led, ++ enum led_brightness brightness) + { + struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev); + ++ mutex_lock(&rtwdev->mutex); ++ + rtwdev->chip->ops->led_set(led, brightness); + ++ mutex_unlock(&rtwdev->mutex); ++} ++ ++static int rtw_led_set_blocking(struct led_classdev *led, ++ enum led_brightness brightness) ++{ ++ rtw_led_set(led, brightness); ++ + return 0; + } + +@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev) + return; + + if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) +- led->brightness_set = rtwdev->chip->ops->led_set; ++ led->brightness_set = rtw_led_set; + else + led->brightness_set_blocking = rtw_led_set_blocking; + +-- +2.51.0 + diff --git a/queue-6.17/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch b/queue-6.17/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch new file mode 100644 index 0000000000..cf801d38b1 --- /dev/null +++ b/queue-6.17/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch @@ -0,0 +1,111 @@ +From cdd08e64b38f32c4b2f3d5a041b24217c52c5066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 21:46:02 +0300 +Subject: wifi: rtw88: Use led->brightness_set_blocking for PCI too + +From: Bitterblue Smith + +[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ] + +Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting +the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by +using the brightness_set_blocking member of struct led_classdev for +PCI devices too. This one is allowed to sleep. + +bad: scheduling from the idle thread! +nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary) +nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE +nix kernel: Hardware name: [REDACTED] +nix kernel: Call Trace: +nix kernel: +nix kernel: dump_stack_lvl+0x63/0x90 +nix kernel: dequeue_task_idle+0x2d/0x50 +nix kernel: __schedule+0x191/0x1310 +nix kernel: ? xas_load+0x11/0xd0 +nix kernel: schedule+0x2b/0xe0 +nix kernel: schedule_preempt_disabled+0x19/0x30 +nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0 +nix kernel: rtw_led_set+0x27/0x60 [rtw_core] +nix kernel: led_blink_set_nosleep+0x56/0xb0 +nix kernel: led_trigger_blink+0x49/0x80 +nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] +nix kernel: call_timer_fn+0x2f/0x140 +nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211] +nix kernel: __run_timers+0x21a/0x2b0 +nix kernel: run_timer_softirq+0x8e/0x100 +nix kernel: handle_softirqs+0xea/0x2c0 +nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5 +nix kernel: __irq_exit_rcu+0xdc/0x100 +nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90 +nix kernel: +nix kernel: +nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20 +nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450 +nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0> +nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246 +nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 +nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000 +nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400 +nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003 +nix kernel: ? cpuidle_enter_state+0xbc/0x450 +nix kernel: cpuidle_enter+0x32/0x50 +nix kernel: do_idle+0x1b1/0x210 +nix kernel: cpu_startup_entry+0x2d/0x30 +nix kernel: start_secondary+0x118/0x140 +nix kernel: common_startup_64+0x13e/0x141 +nix kernel: + +Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED") +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c +index 7f9ace351a5b7..4cc62e49d1679 100644 +--- a/drivers/net/wireless/realtek/rtw88/led.c ++++ b/drivers/net/wireless/realtek/rtw88/led.c +@@ -6,8 +6,8 @@ + #include "debug.h" + #include "led.h" + +-static void rtw_led_set(struct led_classdev *led, +- enum led_brightness brightness) ++static int rtw_led_set(struct led_classdev *led, ++ enum led_brightness brightness) + { + struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev); + +@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led, + rtwdev->chip->ops->led_set(led, brightness); + + mutex_unlock(&rtwdev->mutex); +-} +- +-static int rtw_led_set_blocking(struct led_classdev *led, +- enum led_brightness brightness) +-{ +- rtw_led_set(led, brightness); + + return 0; + } +@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev) + if (!rtwdev->chip->ops->led_set) + return; + +- if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) +- led->brightness_set = rtw_led_set; +- else +- led->brightness_set_blocking = rtw_led_set_blocking; ++ led->brightness_set_blocking = rtw_led_set; + + snprintf(rtwdev->led_name, sizeof(rtwdev->led_name), + "rtw88-%s", dev_name(rtwdev->dev)); +-- +2.51.0 + diff --git a/queue-6.17/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.17/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch new file mode 100644 index 0000000000..66f21bd852 --- /dev/null +++ b/queue-6.17/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch @@ -0,0 +1,149 @@ +From 39b2b2a4236958859f4112a49f1678594e8a0b8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:50 +0300 +Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run() + +From: Fedor Pchelkin + +[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ] + +Lockdep gives a splat [1] when ser_hdl_work item is executed. It is +scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a +wiphy lock inside. However, this workqueue can be flushed when e.g. +closing the interface and wiphy lock is already taken in that case. + +Choosing wiphy_work_queue() for SER is likely not suitable. Back on to +the global workqueue. + +[1]: + + WARNING: possible circular locking dependency detected + 6.17.0-rc2 #17 Not tainted + ------------------------------------------------------ + kworker/u32:1/61 is trying to acquire lock: + ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] + + but task is already holding lock: + ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: + process_one_work+0x7c6/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + -> #1 ((wq_completion)phy0){+.+.}-{0:0}: + touch_wq_lockdep_map+0x8e/0x180 + __flush_workqueue+0x129/0x10d0 + ieee80211_stop_device+0xa8/0x110 + ieee80211_do_stop+0x14ce/0x2880 + ieee80211_stop+0x13a/0x2c0 + __dev_close_many+0x18f/0x510 + __dev_change_flags+0x25f/0x670 + netif_change_flags+0x7b/0x160 + do_setlink.isra.0+0x1640/0x35d0 + rtnl_newlink+0xd8c/0x1d30 + rtnetlink_rcv_msg+0x700/0xb80 + netlink_rcv_skb+0x11d/0x350 + netlink_unicast+0x49a/0x7a0 + netlink_sendmsg+0x759/0xc20 + ____sys_sendmsg+0x812/0xa00 + ___sys_sendmsg+0xf7/0x180 + __sys_sendmsg+0x11f/0x1b0 + do_syscall_64+0xbb/0x360 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + other info that might help us debug this: + + Chain exists of: + &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&ser->ser_hdl_work)); + lock((wq_completion)phy0); + lock((work_completion)(&ser->ser_hdl_work)); + lock(&rdev->wiphy.mtx); + + *** DEADLOCK *** + + 2 locks held by kworker/u32:1/61: + #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 + #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + stack backtrace: + CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 + Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] + Call Trace: + + dump_stack_lvl+0x5d/0x80 + print_circular_bug.cold+0x178/0x1be + check_noncircular+0x14c/0x170 + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index fe7beff8c4246..f99e179f7ff9f 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.17/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch b/queue-6.17/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch new file mode 100644 index 0000000000..2a990f29b0 --- /dev/null +++ b/queue-6.17/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch @@ -0,0 +1,39 @@ +From be0c61f4be4543268b10ac7114d7f9bd5070a9e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:49 +0300 +Subject: wifi: rtw89: fix leak in rtw89_core_send_nullfunc() + +From: Fedor Pchelkin + +[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ] + +If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated +skb is leaked. Free it on the error handling path. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index b9c2224dde4a3..1837f17239ab6 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3456,6 +3456,7 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt + rtwsta_link = rtwsta->links[rtwvif_link->link_id]; + if (unlikely(!rtwsta_link)) { + ret = -ENOLINK; ++ dev_kfree_skb_any(skb); + goto out; + } + +-- +2.51.0 + diff --git a/queue-6.17/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.17/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..5be64cfd2b --- /dev/null +++ b/queue-6.17/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From 9d32ec22d88b7f9aeb1419a55c25ff7bf9c476a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 77d8f49b92bdd..f59ae7186940a 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 + diff --git a/queue-6.6/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.6/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch new file mode 100644 index 0000000000..f6dda5dbf6 --- /dev/null +++ b/queue-6.6/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch @@ -0,0 +1,38 @@ +From 07496fd25be260df517a179056e52145813dee16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:45:18 +0100 +Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message + +From: Colin Ian King + +[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ] + +There appears to be a cut-n-paste error with the incorrect field +ndr_desc->numa_node being reported for the target node. Fix this by +using ndr_desc->target_node instead. + +Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index a466ad6e5d93a..5a1ced5bf7f6f 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +-- +2.51.0 + diff --git a/queue-6.6/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.6/acpi-processor-idle-fix-memory-leak-when-register-cp.patch new file mode 100644 index 0000000000..fc19030d84 --- /dev/null +++ b/queue-6.6/acpi-processor-idle-fix-memory-leak-when-register-cp.patch @@ -0,0 +1,41 @@ +From b2cf675d80aa194a0ae96ee85a812d9310b87a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:06:11 +0800 +Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device + failed + +From: Huisong Li + +[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ] + +The cpuidle device's memory is leaked when cpuidle device registration +fails in acpi_processor_power_init(). Free it as appropriate. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Huisong Li +Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com +[ rjw: Changed the order of the new statements, added empty line after if () ] +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 0888e4d618d53..b524cf27213d4 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +-- +2.51.0 + diff --git a/queue-6.6/acpica-fix-largest-possible-resource-descriptor-inde.patch b/queue-6.6/acpica-fix-largest-possible-resource-descriptor-inde.patch new file mode 100644 index 0000000000..882b3659db --- /dev/null +++ b/queue-6.6/acpica-fix-largest-possible-resource-descriptor-inde.patch @@ -0,0 +1,42 @@ +From 44f82f5c82a4d5021bbc72b5dce4ed14f484788d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 22:03:16 +0200 +Subject: ACPICA: Fix largest possible resource descriptor index + +From: Dmitry Antipov + +[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ] + +ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually +used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). + +Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be +clamped incorrectly and resulting value may issue an out-of-bounds +access for 'acpi_gbl_resource_types' array. Compile tested only. + +Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") +Link: https://github.com/acpica/acpica/commit/cf00116c +Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 +Signed-off-by: Dmitry Antipov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/aclocal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 82563b44af351..261dc8f87556d 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -1139,7 +1139,7 @@ struct acpi_port_info { + #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 + #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 + #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 +-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 ++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 + + /***************************************************************************** + * +-- +2.51.0 + diff --git a/queue-6.6/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.6/alsa-lx_core-use-int-type-to-store-negative-error-co.patch new file mode 100644 index 0000000000..611647578a --- /dev/null +++ b/queue-6.6/alsa-lx_core-use-int-type-to-store-negative-error-co.patch @@ -0,0 +1,56 @@ +From 20030d1095310427f39e45697c02d27adfa895fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 16:13:10 +0800 +Subject: ALSA: lx_core: use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ] + +Change the 'ret' variable from u16 to int to store negative error codes or +zero returned by lx_message_send_atomic(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Signed-off-by: Qianfeng Rong +Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index b5b0d43bb8dcd..c3f2717aebf25 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +-- +2.51.0 + diff --git a/queue-6.6/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.6/arm-at91-pm-fix-mckx-restore-routine.patch new file mode 100644 index 0000000000..3074742b61 --- /dev/null +++ b/queue-6.6/arm-at91-pm-fix-mckx-restore-routine.patch @@ -0,0 +1,56 @@ +From 7f3dd781cacd589388316aa33ca94648ecdf2b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 16:54:26 +0200 +Subject: ARM: at91: pm: fix MCKx restore routine + +From: Nicolas Ferre + +[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ] + +The at91_mckx_ps_restore() assembly function is responsible for setting +back MCKx system bus clocks after exiting low power modes. + +Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx +to previously saved state. +Tmp2 was used without the needed changes in CSS and DIV. Moreover the +required bit 7, telling that MCR register's content is to be changed +(CMD/write), was not set. + +Fix function comment to match tmp variables actually used. + +Signed-off-by: Nicolas Ferre +Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes") +Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com +Reviewed-by: Alexandre Belloni +[claudiu.beznea: s/sate/state in commit description] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e5869cca5e791..94dece1839af3 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -872,7 +872,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCK1..4 settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -916,7 +916,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +-- +2.51.0 + diff --git a/queue-6.6/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch b/queue-6.6/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch new file mode 100644 index 0000000000..495d560095 --- /dev/null +++ b/queue-6.6/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch @@ -0,0 +1,43 @@ +From fcbc4f43c224e3410b220b47fcbb06c573cc9305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 23:59:57 +0200 +Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer + property + +From: Jihed Chaibi + +[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ] + +The dtbs_check validation for am335x-cm-t335.dtb flags an error +for an unevaluated 'num-serializer' property in the mcasp0 node. + +This property is obsolete; it is not defined in the davinci-mcasp-audio +schema and is not used by the corresponding (or any) driver. + +Remove this unused property to fix the schema validation warning. + +Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +index 72990e7ffe10e..44718a4cec474 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +@@ -483,8 +483,6 @@ &mcasp1 { + + op-mode = <0>; /* MCASP_IIS_MODE */ + tdm-slots = <2>; +- /* 16 serializers */ +- num-serializer = <16>; + serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ + 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 + >; +-- +2.51.0 + diff --git a/queue-6.6/arm-dts-renesas-porter-fix-can-pin-group.patch b/queue-6.6/arm-dts-renesas-porter-fix-can-pin-group.patch new file mode 100644 index 0000000000..ef8cd7801e --- /dev/null +++ b/queue-6.6/arm-dts-renesas-porter-fix-can-pin-group.patch @@ -0,0 +1,36 @@ +From 5173d28751bda112e480529732d7aabebee6380e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 15:49:48 +0200 +Subject: ARM: dts: renesas: porter: Fix CAN pin group + +From: Geert Uytterhoeven + +[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ] + +According to the schematics, the CAN transceiver is connected to pins +GP7_3 and GP7_4, which correspond to CAN0 data group B. + +Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index fcc9a2313e1df..0cd08f7b8d8e0 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -266,7 +266,7 @@ vin0_pins: vin0 { + }; + + can0_pins: can0 { +- groups = "can0_data"; ++ groups = "can0_data_b"; + function = "can0"; + }; + +-- +2.51.0 + diff --git a/queue-6.6/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch b/queue-6.6/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch new file mode 100644 index 0000000000..d552b5b699 --- /dev/null +++ b/queue-6.6/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch @@ -0,0 +1,42 @@ +From 3209316181ff7f080233e43a4141e5e51afcd1e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:25:30 +0200 +Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in + DTS to use correct boolean syntax + +From: Jihed Chaibi + +[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ] + +The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree +schema, was incorrectly assigned a value (<1>) in the DTS file, causing +a validation error: "size (4) error for type flag". The driver uses +of_property_read_bool(), expecting a boolean. Remove the value to fix +the dtbs_check error. + +Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/ +Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +index c14d5b70c72f6..56f704082f94a 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +@@ -270,7 +270,7 @@ &tps { + vcc7-supply = <&vbat>; + vccio-supply = <&vbat>; + +- ti,en-ck32k-xtal = <1>; ++ ti,en-ck32k-xtal; + + regulators { + vrtc_reg: regulator@0 { +-- +2.51.0 + diff --git a/queue-6.6/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch b/queue-6.6/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch new file mode 100644 index 0000000000..dac8ba74ef --- /dev/null +++ b/queue-6.6/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch @@ -0,0 +1,41 @@ +From ce481415cfb6eea5f4eabb374b46c766eede7287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 00:50:52 +0200 +Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on + property to use correct boolean syntax in DTS + +From: Jihed Chaibi + +[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ] + +The ti,keep-vref-on property, defined as a boolean flag in the Device +Tree schema, was incorrectly assigned a value (<1>) in the DTS file, +causing a validation error: "size (4) error for type flag". Remove +the value to match the schema and ensure compatibility with the driver +using device_property_read_bool(). This fixes the dtbs_check error. + +Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support") +Signed-off-by: Jihed Chaibi +Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +index a7f99ae0c1fe9..78c657429f641 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +@@ -65,7 +65,7 @@ ads7846@0 { + ti,debounce-max = /bits/ 16 <10>; + ti,debounce-tol = /bits/ 16 <5>; + ti,debounce-rep = /bits/ 16 <1>; +- ti,keep-vref-on = <1>; ++ ti,keep-vref-on; + ti,settle-delay-usec = /bits/ 16 <150>; + + wakeup-source; +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch b/queue-6.6/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch new file mode 100644 index 0000000000..d449f3723c --- /dev/null +++ b/queue-6.6/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch @@ -0,0 +1,65 @@ +From bfcfca5a1c3c51a8e2f7335c4c7484de136822ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 11:49:44 +0200 +Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map + +From: Janne Grunau + +[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ] + +PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused +and disabled. Linux' PCI subsystem assigns the ethernet nic from +`port02` to bus 02. This results into assigning `pcie0_dart_1` from the +disabled port as iommu. The `pcie0_dart_1` instance is disabled and +probably fused off (it is on the M2 Pro Mac mini which has a disabled +PCIe port as well). +Without iommu the ethernet nic is not expected work. +Adjusts the "bus-range" and the PCIe devices "reg" property to PCI +subsystem's bus number. + +Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Janne Grunau +Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net +Signed-off-by: Sven Peter +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 152f95fd49a21..7089ccf3ce556 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -21,6 +21,14 @@ aliases { + }; + }; + ++/* ++ * Adjust pcie0's iommu-map to account for the disabled port01. ++ */ ++&pcie0 { ++ iommu-map = <0x100 &pcie0_dart_0 1 1>, ++ <0x200 &pcie0_dart_2 1 1>; ++}; ++ + &bluetooth0 { + brcm,board-type = "apple,santorini"; + }; +@@ -36,10 +44,10 @@ &wifi0 { + */ + + &port02 { +- bus-range = <3 3>; ++ bus-range = <2 2>; + status = "okay"; + ethernet0: ethernet@0,0 { +- reg = <0x30000 0x0 0x0 0x0 0x0>; ++ reg = <0x20000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch b/queue-6.6/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch new file mode 100644 index 0000000000..87615adca0 --- /dev/null +++ b/queue-6.6/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch @@ -0,0 +1,68 @@ +From baebd80110e8251ce0f37125bba3ab5902d852c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:52 +0200 +Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node + names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ] + +The node names for "pmic", "regulators", "rtc", and "keys" are +dictated by the PMIC MFD binding: change those to adhere to it. + +Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +index d89858c73ab1b..243afbffa21fd 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +@@ -6,12 +6,12 @@ + #include + + &pwrap { +- pmic: mt6331 { ++ pmic: pmic { + compatible = "mediatek,mt6331"; + interrupt-controller; + #interrupt-cells = <2>; + +- mt6331regulator: mt6331regulator { ++ mt6331regulator: regulators { + compatible = "mediatek,mt6331-regulator"; + + mt6331_vdvfs11_reg: buck-vdvfs11 { +@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { + }; + + mt6331_vdig18_reg: ldo-vdig18 { +- regulator-name = "dvdd18_dig"; ++ regulator-name = "vdig18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-ramp-delay = <0>; +@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { + }; + }; + +- mt6331rtc: mt6331rtc { ++ mt6331rtc: rtc { + compatible = "mediatek,mt6331-rtc"; + }; + +- mt6331keys: mt6331keys { ++ mt6331keys: keys { + compatible = "mediatek,mt6331-keys"; + power { + linux,keycodes = ; +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch b/queue-6.6/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch new file mode 100644 index 0000000000..65ada60b9e --- /dev/null +++ b/queue-6.6/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch @@ -0,0 +1,40 @@ +From 07958f94507367e7611631498b206848456b7673 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:38:56 +0200 +Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value + +From: AngeloGioacchino Del Regno + +[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ] + +Change the latch-ck value from 0x14 to 4: as only bits [0-3] are +actually used, the final value that gets written to the register +field for DAT_LATCH_CK_SEL is just 0x4. + +This also fixes dtbs_check warnings. + +Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +index b5746e6d0b15a..110fae4ec11c9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts ++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +@@ -136,7 +136,7 @@ proximity@48 { + + &mmc0 { + /* eMMC controller */ +- mediatek,latch-ck = <0x14>; /* hs400 */ ++ mediatek,latch-ck = <4>; /* hs400 */ + mediatek,hs200-cmd-int-delay = <1>; + mediatek,hs400-cmd-int-delay = <1>; + mediatek,hs400-ds-dly3 = <0x1a>; +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.6/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch new file mode 100644 index 0000000000..3197532cd1 --- /dev/null +++ b/queue-6.6/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch @@ -0,0 +1,50 @@ +From 7454a85e254a1aa50a9d02003d4c6d1b68776d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jul 2025 17:59:59 +0800 +Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from + pcie0 + +From: Guoqing Jiang + +[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ] + +When test suspend resume with 6.8 based kernel, system can't resume +and I got below error which can be also reproduced with 6.16 rc6+ +kernel. + +mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0) +mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110 +mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110 + +After investigation, looks pcie0 has the same problem as pcie1 as +decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195: +Remove suspend-breaking reset from pcie1"). + +Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes") +Signed-off-by: Guoqing Jiang +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Macpaul Lin +Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 22604d3abde3b..4b701afe995e2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1524,9 +1524,6 @@ pcie0: pcie@112f0000 { + + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc0 0>, +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.6/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch new file mode 100644 index 0000000000..a63be43e69 --- /dev/null +++ b/queue-6.6/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch @@ -0,0 +1,39 @@ +From ee849fa2ed57bb2cac7b5d62d2e6ccb8b1d18642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 10:39:14 +0200 +Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ] + +This devicetree contained only the SoC compatible but lacked the +machine specific one: add a "mediatek,mt8516-pumpkin" compatible +to the list to fix dtbs_check warnings. + +Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c538128..3d3db33a64dc6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.6/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch new file mode 100644 index 0000000000..ceae0d9757 --- /dev/null +++ b/queue-6.6/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch @@ -0,0 +1,43 @@ +From 72e3e8c9a4d93cd6fd1f25c1583a4ab4e83e369d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Aug 2025 13:19:53 +0100 +Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 + +From: Biju Das + +[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ] + +On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we +are deleting a wrong and nonexistent node. Fixing the wrong node would +invoke a dtb warning message, as channel0 is a required property. +Disable CAN-FD channel0 instead of deleting the node. + +Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 83fce96a25752..0234dbe95413c 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -38,7 +38,10 @@ hdmi_con_out: endpoint { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +-- +2.51.0 + diff --git a/queue-6.6/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.6/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch new file mode 100644 index 0000000000..39963b1517 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch @@ -0,0 +1,68 @@ +From a8eed12753460686acbfc30901655d1ae0e8dc02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:19 +0200 +Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ] + +When an invalid value is passed via quirk option, currently +bytcht_es8316 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-2-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 7a30d2d36f199..fbd7e1f0783fd 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +-- +2.51.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.6/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..bf15b9ed81 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,53 @@ +From c533c6ee484769656b2ed0f5a166332372b09186 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:20 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver only shows an error message but leaves as is. +This may lead to unepxected results like OOB access. + +This patch corrects the input mapping to the certain default value if +an invalid value is passed. + +Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-3-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 6a85e8fdcae64..beca466dd468e 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +-- +2.51.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.6/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch new file mode 100644 index 0000000000..4a10bf4631 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch @@ -0,0 +1,76 @@ +From 86f75c8e7d175665523b1ce37f9c95d46d79c6eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 19:18:21 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping + +From: Takashi Iwai + +[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ] + +When an invalid value is passed via quirk option, currently +bytcr_rt5640 driver just ignores and leaves as is, which may lead to +unepxected results like OOB access. + +This patch adds the sanity check and corrects the input mapping to the +certain default value if an invalid value is passed. + +Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") +Signed-off-by: Takashi Iwai +Message-ID: <20250902171826.27329-4-tiwai@suse.de> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 805afaf47b290..2abe47303ecdb 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +-- +2.51.0 + diff --git a/queue-6.6/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.6/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch new file mode 100644 index 0000000000..62c947887c --- /dev/null +++ b/queue-6.6/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch @@ -0,0 +1,63 @@ +From cb3841bc323780e9b6eb3f9922ea925dca55b969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 16:48:54 +0800 +Subject: blk-mq: check kobject state_in_sysfs before deleting in + blk_mq_unregister_hctx + +From: Li Nan + +[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ] + +In __blk_mq_update_nr_hw_queues() the return value of +blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx +fails, later changing the number of hw_queues or removing disk will +trigger the following warning: + + kernfs: can not remove 'nr_tags', no directory + WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 + Call Trace: + remove_files.isra.1+0x38/0xb0 + sysfs_remove_group+0x4d/0x100 + sysfs_remove_groups+0x31/0x60 + __kobject_del+0x23/0xf0 + kobject_del+0x17/0x40 + blk_mq_unregister_hctx+0x5d/0x80 + blk_mq_sysfs_unregister_hctxs+0x94/0xd0 + blk_mq_update_nr_hw_queues+0x124/0x760 + nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] + nullb_device_submit_queues_store+0x92/0x120 [null_blk] + +kobjct_del() was called unconditionally even if sysfs creation failed. +Fix it by checkig the kobject creation statusbefore deleting it. + +Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 156e9bb07abf1..2fb234ab467b1 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +-- +2.51.0 + diff --git a/queue-6.6/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.6/block-use-int-to-store-blk_stack_limits-return-value.patch new file mode 100644 index 0000000000..a74f08a500 --- /dev/null +++ b/queue-6.6/block-use-int-to-store-blk_stack_limits-return-value.patch @@ -0,0 +1,48 @@ +From 264ba4db500b050db8d873adf35c5eb36f6ea8f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 21:09:30 +0800 +Subject: block: use int to store blk_stack_limits() return value + +From: Qianfeng Rong + +[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ] + +Change the 'ret' variable in blk_stack_limits() from unsigned int to int, +as it needs to store negative value -1. + +Storing the negative error codes in unsigned type, or performing equality +comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but +can be confusing. Additionally, assigning negative error codes to unsigned +type may trigger a GCC warning when the -Wsign-conversion flag is enabled. + +No effect on runtime. + +Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1 +Signed-off-by: Qianfeng Rong +Reviewed-by: John Garry +Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment") +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 021994f6d2d82..a891f27ff834d 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -553,7 +553,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.6/bluetooth-hci_sync-fix-using-random-address-for-big-.patch new file mode 100644 index 0000000000..f13dd97760 --- /dev/null +++ b/queue-6.6/bluetooth-hci_sync-fix-using-random-address-for-big-.patch @@ -0,0 +1,57 @@ +From 6c98042846b463a753cc7a1d5559559bef808152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 12:30:05 -0400 +Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA + advertisements + +From: Luiz Augusto von Dentz + +[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ] + +When creating an advertisement for BIG the address shall not be +non-resolvable since in case of acting as BASS/Broadcast Assistant the +address must be the same as the connection in order to use the PAST +method and even when PAST/BASS are not in the picture a Periodic +Advertisement can still be synchronized thus the same argument as to +connectable advertisements still stand. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Luiz Augusto von Dentz +Reviewed-by: Paul Menzel +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index dc9209f9f1a6a..a128e5709fa15 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1347,7 +1347,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1385,10 +1385,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.6/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch new file mode 100644 index 0000000000..4f9a8278de --- /dev/null +++ b/queue-6.6/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch @@ -0,0 +1,38 @@ +From 822e8947b1486c37e4b64bfb4d0d29fce7fbe3b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 21:11:22 +0300 +Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX + +From: Pauli Virtanen + +[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ] + +For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the +skb is leaked. + +Free skb after copying its data. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index be71082d9eafa..69529a3049e74 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -2091,7 +2091,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.6/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch new file mode 100644 index 0000000000..f327654f33 --- /dev/null +++ b/queue-6.6/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch @@ -0,0 +1,40 @@ +From 67ba4c7b3001f8ce314f13ce6b153dfe9d4477b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 16:27:51 -0400 +Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free + +From: Luiz Augusto von Dentz + +[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] + +This attempt to fix similar issue to sco_conn_free where if the +conn->sk is not set to NULL may lead to UAF on iso_conn_free. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index b94d202bf3745..be71082d9eafa 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.6/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch new file mode 100644 index 0000000000..041cfdf7b5 --- /dev/null +++ b/queue-6.6/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch @@ -0,0 +1,48 @@ +From a690feaa77785e4358f547a4b8668341479b412f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 08:50:12 -0400 +Subject: Bluetooth: MGMT: Fix not exposing debug UUID on + MGMT_OP_READ_EXP_FEATURES_INFO + +From: Luiz Augusto von Dentz + +[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ] + +The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO +was not called with a specific index which breaks the likes of +bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an +adapter is plugged, so instead of depending hdev not to be set just +enable the UUID on any index like it was done with iso_sock_uuid. + +Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 9b01eaaa0eb2d..54ddbb2635e2f 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4405,13 +4405,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +-- +2.51.0 + diff --git a/queue-6.6/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.6/bpf-enforce-expected_attach_type-for-tailcall-compat.patch new file mode 100644 index 0000000000..161f399af7 --- /dev/null +++ b/queue-6.6/bpf-enforce-expected_attach_type-for-tailcall-compat.patch @@ -0,0 +1,93 @@ +From 070f507097cd57e8172cdfa39d73501d10fff8c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 19:12:00 +0200 +Subject: bpf: Enforce expected_attach_type for tailcall compatibility + +From: Daniel Borkmann + +[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ] + +Yinhao et al. recently reported: + + Our fuzzer tool discovered an uninitialized pointer issue in the + bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. + This leads to a NULL pointer dereference when a BPF program attempts to + deference the txq member of struct xdp_buff object. + +The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the +entry point for bpf_prog_test_run_xdp() and its expected_attach_type can +neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot +of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP +to pass xdp_is_valid_access() validation. The program returns struct xdp_md's +egress_ifindex, and the latter is only allowed to be accessed under mentioned +expected_attach_type. progB is then inserted into the tailcall which progA +calls. + +The underlying issue goes beyond XDP though. Another example are programs +of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well +as sock_addr_func_proto() have different logic depending on the programs' +expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME +should not be allowed doing a tailcall into a program which calls bpf_bind() +out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. + +In short, specifying expected_attach_type allows to open up additional +functionality or restrictions beyond what the basic bpf_prog_type enables. +The use of tailcalls must not violate these constraints. Fix it by enforcing +expected_attach_type in __bpf_prog_map_compatible(). + +Note that we only enforce this for tailcall maps, but not for BPF devmaps or +cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and +cpu_map_bpf_prog_run*() which set up a new environment / context and therefore +these situations are not prone to this issue. + +Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") +Reported-by: Yinhao Hu +Reported-by: Kaiyan Mei +Reviewed-by: Dongliang Mu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 + + kernel/bpf/core.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 83da9c81fa86a..0af6b2a5273ad 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -269,6 +269,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 3618be05fc352..a343248c35ded 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2279,6 +2279,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2290,6 +2291,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +-- +2.51.0 + diff --git a/queue-6.6/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.6/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch new file mode 100644 index 0000000000..bbc8f70fc9 --- /dev/null +++ b/queue-6.6/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch @@ -0,0 +1,75 @@ +From 06bfc87357cf9536edc43e2b7456602f274a6a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:08:00 +0200 +Subject: bpf: Explicitly check accesses to bpf_sock_addr + +From: Paul Chaignon + +[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ] + +Syzkaller found a kernel warning on the following sock_addr program: + + 0: r0 = 0 + 1: r2 = *(u32 *)(r1 +60) + 2: exit + +which triggers: + + verifier bug: error during ctx access conversion (0) + +This is happening because offset 60 in bpf_sock_addr corresponds to an +implicit padding of 4 bytes, right after msg_src_ip4. Access to this +padding isn't rejected in sock_addr_is_valid_access and it thus later +fails to convert the access. + +This patch fixes it by explicitly checking the various fields of +bpf_sock_addr in sock_addr_is_valid_access. + +I checked the other ctx structures and is_valid_access functions and +didn't find any other similar cases. Other cases of (properly handled) +padding are covered in new tests in a subsequent patch. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com +Signed-off-by: Paul Chaignon +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Acked-by: Daniel Borkmann +Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7 +Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 7afb7658c3883..b6dbcef649654 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9156,13 +9156,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +-- +2.51.0 + diff --git a/queue-6.6/bpf-reject-negative-offsets-for-alu-ops.patch b/queue-6.6/bpf-reject-negative-offsets-for-alu-ops.patch new file mode 100644 index 0000000000..860a3a6ef5 --- /dev/null +++ b/queue-6.6/bpf-reject-negative-offsets-for-alu-ops.patch @@ -0,0 +1,61 @@ +From 9b66c83b554e25911b1b4f755bdea195ac8dc4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 23:04:33 +0800 +Subject: bpf: Reject negative offsets for ALU ops + +From: Yazhou Tang + +[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] + +When verifying BPF programs, the check_alu_op() function validates +instructions with ALU operations. The 'offset' field in these +instructions is a signed 16-bit integer. + +The existing check 'insn->off > 1' was intended to ensure the offset is +either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is +signed, this check incorrectly accepts all negative values (e.g., -1). + +This commit tightens the validation by changing the condition to +'(insn->off != 0 && insn->off != 1)'. This ensures that any value +other than the explicitly permitted 0 and 1 is rejected, hardening the +verifier against malformed BPF programs. + +Co-developed-by: Shenghao Yuan +Signed-off-by: Shenghao Yuan +Co-developed-by: Tianci Cao +Signed-off-by: Tianci Cao +Signed-off-by: Yazhou Tang +Acked-by: Yonghong Song +Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") +Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index a6f825b7fbe6c..5e644b1b12aaa 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13727,7 +13727,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } else { /* all other ALU ops: and, sub, xor, add, ... */ + + if (BPF_SRC(insn->code) == BPF_X) { +- if (insn->imm != 0 || insn->off > 1 || ++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +@@ -13737,7 +13737,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + if (err) + return err; + } else { +- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || ++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.6/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch new file mode 100644 index 0000000000..71d3e33d9c --- /dev/null +++ b/queue-6.6/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch @@ -0,0 +1,57 @@ +From 469aaa85b6e86629fdd6b189be7c34dea92dd63d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:14:29 +0800 +Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run + +From: Tao Chen + +[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ] + +Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run +called all the way from graph tracer, which disables preemption in +function_graph_enter_regs, as Jiri and Yonghong suggested, there is no +need to use migrate_disable. As a result, some overhead may will be reduced. +And add cant_sleep check for __this_cpu_inc_return. + +Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") +Signed-off-by: Tao Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 8903db0b59602..a896b80252ae1 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2726,18 +2726,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct bpf_run_ctx *old_run_ctx; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + err = 0; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.51.0 + diff --git a/queue-6.6/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.6/bpf-selftests-fix-test_tcpnotify_user.patch new file mode 100644 index 0000000000..7680f90c34 --- /dev/null +++ b/queue-6.6/bpf-selftests-fix-test_tcpnotify_user.patch @@ -0,0 +1,139 @@ +From 13fe738b3e9e8ebb86a904630a5d183ba79cf19a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 12:12:14 +0000 +Subject: bpf/selftests: Fix test_tcpnotify_user + +From: Matt Bobrowski + +[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ] + +Based on a bisect, it appears that commit 7ee988770326 ("timers: +Implement the hierarchical pull model") has somehow inadvertently +broken BPF selftest test_tcpnotify_user. The error that is being +generated by this test is as follows: + + FAILED: Wrong stats Expected 10 calls, got 8 + +It looks like the change allows timer functions to be run on CPUs +different from the one they are armed on. The test had pinned itself +to CPU 0, and in the past the retransmit attempts also occurred on CPU +0. The test had set the max_entries attribute for +BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling +bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was +likely to be in range. With the change to allow timers to run on other +CPUs, the current CPU tasked with performing the retransmit might be +bumped and in turn fall out of range, as the event will be filtered +out via __bpf_perf_event_output() using: + + if (unlikely(index >= array->map.max_entries)) + return -E2BIG; + +A possible change would be to explicitly set the max_entries attribute +for perf_event_map in test_tcpnotify_kern.c to a value that's at least +as large as the number of CPUs. As it turns out however, if the field +is left unset, then the libbpf will determine the number of CPUs available +on the underlying system and update the max_entries attribute accordingly +in map_set_def_max_entries(). + +A further problem with the test is that it has a thread that continues +running up until the program exits. The main thread cleans up some +LIBBPF data structures, while the other thread continues to use them, +which inevitably will trigger a SIGSEGV. This can be dealt with by +telling the thread to run for as long as necessary and doing a +pthread_join on it before exiting the program. + +Finally, I don't think binding the process to CPU 0 is meaningful for +this test any more, so get rid of that. + +Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") +Signed-off-by: Matt Bobrowski +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 - + .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++---------- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85..ef00d38b0a8d2 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f..35b4893ccdf8a 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +-- +2.51.0 + diff --git a/queue-6.6/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.6/coresight-etm4x-conditionally-access-register-trcext.patch new file mode 100644 index 0000000000..2f86345a09 --- /dev/null +++ b/queue-6.6/coresight-etm4x-conditionally-access-register-trcext.patch @@ -0,0 +1,91 @@ +From fb3059c5676d112c037eb9f1f1d7d003717a20c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 01:24:45 -0700 +Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR + +From: Yuanfang Zhang + +[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ] + +The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. +To avoid invalid accesses, introduce a check on numextinsel +(derived from TRCIDR5[11:9]) before reading or writing to this register. + +Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") +Signed-off-by: Yuanfang Zhang +Reviewed-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++--- + drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++ + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 05d9f87e35333..625582f7dc34c 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1323,6 +1324,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1750,7 +1752,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1882,7 +1886,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 6b6760e49ed35..d72f742b41054 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -999,6 +1000,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +-- +2.51.0 + diff --git a/queue-6.6/coresight-etm4x-support-atclk.patch b/queue-6.6/coresight-etm4x-support-atclk.patch new file mode 100644 index 0000000000..e8bbaaa6e9 --- /dev/null +++ b/queue-6.6/coresight-etm4x-support-atclk.patch @@ -0,0 +1,106 @@ +From 1b7abfd47af029b771eb72a5d6e25a348241490e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 13:23:39 +0100 +Subject: coresight: etm4x: Support atclk + +From: Leo Yan + +[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ] + +The atclk is an optional clock for the CoreSight ETMv4, but the driver +misses to initialize it. + +This change enables atclk in probe of the ETMv4 driver, and dynamically +control the clock during suspend and resume. + +No need to check the driver data and clock pointer in the runtime +suspend and resume, so remove checks. And add error handling in the +resume function. + +Add a minor fix to the comment format when adding the atclk field. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Reviewed-by: Anshuman Khandual +Reviewed-by: Yeoreum Yun +Tested-by: James Clark +Signed-off-by: Leo Yan +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com +Signed-off-by: Sasha Levin +--- + .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++----- + drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++- + 2 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 625582f7dc34c..e4d8d446ea4d3 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -2118,6 +2118,10 @@ static int etm4_probe(struct device *dev) + if (WARN_ON(!drvdata)) + return -ENOMEM; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) + pm_save_enable = coresight_loses_context_with_cpu(dev) ? + PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; +@@ -2369,8 +2373,8 @@ static int etm4_runtime_suspend(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); + + return 0; + } +@@ -2378,11 +2382,17 @@ static int etm4_runtime_suspend(struct device *dev) + static int etm4_runtime_resume(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); + +- return 0; ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index d72f742b41054..d8b8102d790cc 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -920,7 +920,8 @@ struct etmv4_save_state { + + /** + * struct etm4_drvdata - specifics associated to an ETM component +- * @pclk APB clock if present, otherwise NULL ++ * @pclk: APB clock if present, otherwise NULL ++ * @atclk: Optional clock for the core parts of the ETMv4. + * @base: Memory mapped base address for this component. + * @csdev: Component vitals needed by the framework. + * @spinlock: Only one at a time pls. +@@ -988,6 +989,7 @@ struct etmv4_save_state { + */ + struct etmv4_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + spinlock_t spinlock; +-- +2.51.0 + diff --git a/queue-6.6/coresight-only-register-perf-symlink-for-sinks-with-.patch b/queue-6.6/coresight-only-register-perf-symlink-for-sinks-with-.patch new file mode 100644 index 0000000000..0986091db4 --- /dev/null +++ b/queue-6.6/coresight-only-register-perf-symlink-for-sinks-with-.patch @@ -0,0 +1,45 @@ +From bcd745a63660feddaa43bf5b9213a231fe782cda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jun 2025 18:26:19 +0800 +Subject: coresight: Only register perf symlink for sinks with alloc_buffer + +From: Yuanfang Zhang + +[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ] + +Ensure that etm_perf_add_symlink_sink() is only called for devices +that implement the alloc_buffer operation. This prevents invalid +symlink creation for dummy sinks that do not implement alloc_buffer. + +Without this check, perf may attempt to use a dummy sink that lacks +alloc_buffer operationsu to initialise perf's ring buffer, leading +to runtime failures. + +Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver") +Signed-off-by: Yuanfang Zhang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 3b57851869eaa..a836952737209 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1638,8 +1638,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) + goto out_unlock; + } + +- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { ++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || ++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && ++ sink_ops(csdev)->alloc_buffer) { + ret = etm_perf_add_symlink_sink(csdev); + + if (ret) { +-- +2.51.0 + diff --git a/queue-6.6/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.6/coresight-trbe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..e356b75b5f --- /dev/null +++ b/queue-6.6/coresight-trbe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 0edf12eb5cc97bc3725da739e5490071669d681d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:38 +0100 +Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index e20c1c6acc731..7f91b1ffe66a5 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -21,7 +21,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +-- +2.51.0 + diff --git a/queue-6.6/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.6/coresight-trbe-return-null-pointer-for-allocation-fa.patch new file mode 100644 index 0000000000..2708129309 --- /dev/null +++ b/queue-6.6/coresight-trbe-return-null-pointer-for-allocation-fa.patch @@ -0,0 +1,60 @@ +From de23c8dbf710e2850c53cd71ceb823492277e91f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:13:52 +0100 +Subject: coresight: trbe: Return NULL pointer for allocation failures + +From: Leo Yan + +[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ] + +When the TRBE driver fails to allocate a buffer, it currently returns +the error code "-ENOMEM". However, the caller etm_setup_aux() only +checks for a NULL pointer, so it misses the error. As a result, the +driver continues and eventually causes a kernel panic. + +Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on +allocation failures. This allows that the callers can properly handle +the failure. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Reported-by: Tamas Zsoldos +Signed-off-by: Leo Yan +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 7f91b1ffe66a5..a564bd5c8b62d 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -744,12 +744,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -759,7 +759,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +-- +2.51.0 + diff --git a/queue-6.6/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.6/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch new file mode 100644 index 0000000000..e9e406c498 --- /dev/null +++ b/queue-6.6/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch @@ -0,0 +1,61 @@ +From 07a80d42b745b91f921a7750279de4ec67f5d058 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 08:50:48 -0700 +Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() + +From: Florian Fainelli + +[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ] + +Broadcom STB platforms were early adopters (2017) of the SCMI framework and as +a result, not all deployed systems have a Device Tree entry where SCMI +protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the +CPU Device Tree node(s) referencing protocol 0x13 as their clock +provider. This was clarified in commit e11c480b6df1 ("dt-bindings: +firmware: arm,scmi: Extend bindings for protocol@13") in 2023. + +For those platforms, we allow the checks done by scmi_dev_used_by_cpus() +to continue, and in the event of not having done an early return, we key +off the documented compatible string and give them a pass to continue to +use scmi-cpufreq. + +Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs") +Signed-off-by: Florian Fainelli +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 6ff77003a96ea..68325ebd56fe3 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +-- +2.51.0 + diff --git a/queue-6.6/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.6/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch new file mode 100644 index 0000000000..f5419e4d3e --- /dev/null +++ b/queue-6.6/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch @@ -0,0 +1,58 @@ +From 9ce47c3f149c1424d3eeaa375fdaa5a6b20adae7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 17:22:12 +0200 +Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe + +From: Johan Hovold + +[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ] + +Make sure to drop the reference to the saw device taken by +of_find_device_by_node() after retrieving its driver data during +probe(). + +Also drop the reference to the CPU node sooner to avoid leaking it in +case there is no saw node or device. + +Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index 1fc9968eae199..b6b06a510fd86 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +-- +2.51.0 + diff --git a/queue-6.6/crypto-hisilicon-qm-check-whether-the-input-function.patch b/queue-6.6/crypto-hisilicon-qm-check-whether-the-input-function.patch new file mode 100644 index 0000000000..6ea0899c7a --- /dev/null +++ b/queue-6.6/crypto-hisilicon-qm-check-whether-the-input-function.patch @@ -0,0 +1,42 @@ +From 9ead01f467379bb0300b01e617dbcbf459c7cf3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:07 +0800 +Subject: crypto: hisilicon/qm - check whether the input function and PF are on + the same device + +From: Zhushuai Yin + +[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ] + +Function rate limiting is set through physical function driver. +Users configure by providing function information and rate limit values. +Before configuration, it is necessary to check whether the +provided function and PF belong to the same device. + +Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") +Signed-off-by: Zhushuai Yin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/qm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 183885619eb8b..203240e78f6ad 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -3748,6 +3748,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, + } + + pdev = container_of(dev, struct pci_dev, dev); ++ if (pci_physfn(pdev) != qm->pdev) { ++ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); ++ return -EINVAL; ++ } + + *fun_index = pdev->devfn; + +-- +2.51.0 + diff --git a/queue-6.6/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.6/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch new file mode 100644 index 0000000000..da8ad8f6b2 --- /dev/null +++ b/queue-6.6/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch @@ -0,0 +1,38 @@ +From e2bb482433b5afd0d91e7ca1edcf498cd22369ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 18:57:54 +0800 +Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs + +From: Chenghai Huang + +[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ] + +When the initialization of qm->debug.acc_diff_reg fails, +the probe process does not exit. However, after qm->debug.qm_diff_regs is +freed, it is not set to NULL. This can lead to a double free when the +remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs +should be set to NULL after it is freed. + +Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index bd205f1f2279e..573c0033a5afe 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -865,6 +865,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.6/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.6/crypto-hisilicon-re-enable-address-prefetch-after-de.patch new file mode 100644 index 0000000000..e3dbdbeea6 --- /dev/null +++ b/queue-6.6/crypto-hisilicon-re-enable-address-prefetch-after-de.patch @@ -0,0 +1,200 @@ +From f4add90ba9f5566f7a8badc865541e0abd234078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:05 +0800 +Subject: crypto: hisilicon - re-enable address prefetch after device resuming + +From: Chenghai Huang + +[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ] + +When the device resumes from a suspended state, it will revert to its +initial state and requires re-enabling. Currently, the address prefetch +function is not re-enabled after device resuming. Move the address prefetch +enable to the initialization process. In this way, the address prefetch +can be enabled when the device resumes by calling the initialization +process. + +Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +- + drivers/crypto/hisilicon/qm.c | 3 - + drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------ + drivers/crypto/hisilicon/zip/zip_main.c | 5 +- + 4 files changed, 43 insertions(+), 48 deletions(-) + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index 762a2a54ca821..e3d113334d4e4 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -689,6 +689,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 7921409791fb0..183885619eb8b 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -4363,9 +4363,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 6aaaaf784ddc0..064fbc8db16fc 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -436,6 +436,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -469,45 +508,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1090,7 +1091,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 6e419c5165cb4..b70aa6032874e 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -577,6 +577,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; +@@ -588,6 +589,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return 0; +@@ -1172,9 +1174,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- hisi_zip_set_high_perf(qm); +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +-- +2.51.0 + diff --git a/queue-6.6/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.6/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch new file mode 100644 index 0000000000..6eacd40bf3 --- /dev/null +++ b/queue-6.6/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch @@ -0,0 +1,67 @@ +From b00084ba75980192319b6872347843b38d72875a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:38:04 +0800 +Subject: crypto: hisilicon/zip - remove unnecessary validation for + high-performance mode configurations + +From: Chenghai Huang + +[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ] + +When configuring the high-performance mode register, there is no +need to verify whether the register has been successfully +enabled, as there is no possibility of a write failure for this +register. + +Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration") +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 66e553115adfd..6e419c5165cb4 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -469,10 +469,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -482,13 +481,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -1180,9 +1172,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; ++ hisi_zip_set_high_perf(qm); + + hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); +-- +2.51.0 + diff --git a/queue-6.6/crypto-keembay-add-missing-check-after-sg_nents_for_.patch b/queue-6.6/crypto-keembay-add-missing-check-after-sg_nents_for_.patch new file mode 100644 index 0000000000..a2b404892f --- /dev/null +++ b/queue-6.6/crypto-keembay-add-missing-check-after-sg_nents_for_.patch @@ -0,0 +1,45 @@ +From 86538abc8344ae3f3bd4adfc097f11cfbdad9900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 14:03:30 +0200 +Subject: crypto: keembay - Add missing check after sg_nents_for_len() + +From: Thomas Fourier + +[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ] + +sg_nents_for_len() returns an int which is negative in case of error. + +Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +index b732223035399..3b5d5b64e1414 100644 +--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c ++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + struct device *dev = rctx->hcu_dev->dev; + unsigned int remainder = 0; + unsigned int total; +- size_t nents; ++ int nents; + size_t count; + int rc; + int i; +@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + /* Determine the number of scatter gather list entries to process. */ + nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); + ++ if (nents < 0) ++ return nents; ++ + /* If there are entries to process, map them. */ + if (nents) { + rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, +-- +2.51.0 + diff --git a/queue-6.6/documentation-trace-historgram-design-separate-sched.patch b/queue-6.6/documentation-trace-historgram-design-separate-sched.patch new file mode 100644 index 0000000000..0ae24d1171 --- /dev/null +++ b/queue-6.6/documentation-trace-historgram-design-separate-sched.patch @@ -0,0 +1,44 @@ +From 7fa4537ea740f0a4da86ea8af040a8f923e6f24e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 12:42:01 +0700 +Subject: Documentation: trace: historgram-design: Separate sched_waking + histogram section heading and the following diagram + +From: Bagas Sanjaya + +[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ] + +Section heading for sched_waking histogram is shown as normal paragraph +instead due to codeblock marker for the following diagram being in the +same line as the section underline. Separate them. + +Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst") +Reviewed-by: Tom Zanussi +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Bagas Sanjaya +Acked-by: Steven Rostedt (Google) +Signed-off-by: Jonathan Corbet +Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com> +Signed-off-by: Sasha Levin +--- + Documentation/trace/histogram-design.rst | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 5765eb3e9efa7..a30f4bed11b4e 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +-- +2.51.0 + diff --git a/queue-6.6/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.6/drivers-base-node-fix-double-free-in-register_one_no.patch new file mode 100644 index 0000000000..d8ec6b5e85 --- /dev/null +++ b/queue-6.6/drivers-base-node-fix-double-free-in-register_one_no.patch @@ -0,0 +1,56 @@ +From 30899974d3da15845699a345d89ac38be5ac515e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 11:11:44 +0530 +Subject: drivers/base/node: fix double free in register_one_node() + +From: Donet Tom + +[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ] + +When device_register() fails in register_node(), it calls +put_device(&node->dev). This triggers node_device_release(), which calls +kfree(to_node(dev)), thereby freeing the entire node structure. + +As a result, when register_node() returns an error, the node memory has +already been freed. Calling kfree(node) again in register_one_node() +leads to a double free. + +This patch removes the redundant kfree(node) from register_one_node() to +prevent the double free. + +Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com +Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Acked-by: Oscar Salvador +Cc: Alison Schofield +Cc: Chris Mason +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 7b2ff66c119ae..47960a34305d3 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -880,7 +880,6 @@ int __register_one_node(int nid) + error = register_node(node_devices[nid], nid); + if (error) { + node_devices[nid] = NULL; +- kfree(node); + return error; + } + +-- +2.51.0 + diff --git a/queue-6.6/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.6/drivers-base-node-handle-error-properly-in-register_.patch new file mode 100644 index 0000000000..cfec2e10a5 --- /dev/null +++ b/queue-6.6/drivers-base-node-handle-error-properly-in-register_.patch @@ -0,0 +1,56 @@ +From 619e2040ca1db4e53844c3a8afd549453dadb233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 14:18:45 +0530 +Subject: drivers/base/node: handle error properly in register_one_node() + +From: Donet Tom + +[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ] + +If register_node() returns an error, it is not handled correctly. +The function will proceed further and try to register CPUs under the +node, which is not correct. + +So, in this patch, if register_node() returns an error, we return +immediately from the function. + +Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com +Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct") +Signed-off-by: Donet Tom +Acked-by: David Hildenbrand +Cc: Alison Schofield +Cc: Danilo Krummrich +Cc: Dave Jiang +Cc: Donet Tom +Cc: Greg Kroah-Hartman +Cc: Hiroyouki Kamezawa +Cc: Joanthan Cameron +Cc: Oscar Salvador +Cc: "Ritesh Harjani (IBM)" +Cc: Yury Norov (NVIDIA) +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 4d588f4658c85..7b2ff66c119ae 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -878,6 +878,11 @@ int __register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ kfree(node); ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.6/drm-amd-display-remove-redundant-semicolons.patch new file mode 100644 index 0000000000..3d0809f58c --- /dev/null +++ b/queue-6.6/drm-amd-display-remove-redundant-semicolons.patch @@ -0,0 +1,34 @@ +From 685f86081f28df5d1a56028e26ee322287a52ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 15:50:14 +0800 +Subject: drm/amd/display: Remove redundant semicolons + +From: Liao Yuanhong + +[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ] + +Remove unnecessary semicolons. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Liao Yuanhong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4..6c75aa82327ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.6/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch new file mode 100644 index 0000000000..7690cf6b0f --- /dev/null +++ b/queue-6.6/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch @@ -0,0 +1,57 @@ +From a917c77bdbfa99eb37e9b48519b5808ffa44ad5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:07 +0200 +Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ] + +Based on some comments in dm_pp_display_configuration +above the crtc_index and line_time fields, these values +are programmed to the SMC to work around an SMC hang +when it switches MCLK. + +According to Alex, the Windows driver programs them to: +mclk_change_block_cp_min = 200 / line_time +mclk_change_block_cp_max = 100 / line_time +Let's use the same for the sake of consistency. + +Previously we used the watermark values, but it seemed buggy +as the code was mixing up low/high and A/B watermarks, and +was not saving a low watermark value on DCE 6, so +mclk_change_block_cp_max would be always zero previously. + +Split this change off from the previous si_upload_smc_data +to make it easier to bisect, in case it causes any issues. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index cff55daa68ab8..3ce9396900f7f 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + crtc_index = amdgpu_crtc->crtc_id; + + if (amdgpu_crtc->line_time) { +- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; +- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; + } + } + +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.6/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch new file mode 100644 index 0000000000..8416d64192 --- /dev/null +++ b/queue-6.6/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch @@ -0,0 +1,48 @@ +From 2fa29d85081f5e2c1c58f5883b01927860773a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:09 +0200 +Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ] + +According to pp_pm_compute_clocks the non-DC display code +has "issues with mclk switching with refresh rates over 120 hz". +The workaround is to disable MCLK switching in this case. + +Do the same for legacy DPM. + +Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c..2d2d2d5e67634 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.6/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch new file mode 100644 index 0000000000..da14f9ad8f --- /dev/null +++ b/queue-6.6/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch @@ -0,0 +1,99 @@ +From bc80cda95da1d10f477f3b7fd88dc52fedac21dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:10 +0200 +Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks + (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ] + +Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk +switching on Oland when two 4K 60Hz monitors are connected") + +This is an ad-hoc DPM fix, necessary because we don't have +proper bandwidth calculation for DCE 6. + +We define "high pixelclock" for SI as higher than necessary +for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into +this category. + +When two high pixel clock displays are connected to Oland, +additionally disable shader clock switching, which results in +a higher voltage, thereby addressing some visible flickering. + +v2: +Add more comments. +v3: +Split into two commits for easier review. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 075d183bb1bb9..2863dc65ffc6f 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.6/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch new file mode 100644 index 0000000000..671c95c4a9 --- /dev/null +++ b/queue-6.6/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch @@ -0,0 +1,53 @@ +From 0d1ee908213709b59cf1e55cb849efef652e88d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:04 +0200 +Subject: drm/amd/pm: Disable ULV even if unsupported (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ] + +Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode +is unsupported, to make sure it is properly turned off. + +v3: +Simplify si_disable_ulv further. +Always check the return value of amdgpu_si_send_msg_to_smc. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index e7b1fa2feb928..8be367c49367d 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; ++ PPSMC_Result r; + +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; +- +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.6/drm-amd-pm-fix-si_upload_smc_data-v3.patch new file mode 100644 index 0000000000..020b6318c1 --- /dev/null +++ b/queue-6.6/drm-amd-pm-fix-si_upload_smc_data-v3.patch @@ -0,0 +1,106 @@ +From aaa02e8e5818b7b51330a9cde5fc7f3d1e1a2d46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:06 +0200 +Subject: drm/amd/pm: Fix si_upload_smc_data (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ] + +The si_upload_smc_data function uses si_write_smc_soft_register +to set some register values in the SMC, and expects the result +to be PPSMC_Result_OK which is 1. + +The PPSMC_Result_OK / PPSMC_Result_Failed values are used for +checking the result of a command sent to the SMC. +However, the si_write_smc_soft_register actually doesn't send +any commands to the SMC and returns zero on success, +so this check was incorrect. + +Fix that by not checking the return value, just like other +calls to si_write_smc_soft_register. + +v3: +Additionally, when no display is plugged in, there is no need +to restrict MCLK switching, so program the registers to zero. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++---------- + 1 file changed, 24 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 8be367c49367d..cff55daa68ab8 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -5793,9 +5793,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5804,26 +5804,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.6/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch new file mode 100644 index 0000000000..bfeca0f366 --- /dev/null +++ b/queue-6.6/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch @@ -0,0 +1,53 @@ +From 40a3292d747b72c6d4ad8f5e82dd3b6bcedc0aa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:08 +0200 +Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ] + +Some parts of the code base expect that MCLK switching is turned +off when the vblank time is set to zero. + +According to pp_pm_compute_clocks the non-DC code has issues +with MCLK switching with refresh rates over 120 Hz. + +v3: +Add code comment to explain this better. +Add an if statement instead of changing the switch_limit. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 3ce9396900f7f..075d183bb1bb9 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.6/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch new file mode 100644 index 0000000000..1c94055bd0 --- /dev/null +++ b/queue-6.6/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch @@ -0,0 +1,89 @@ +From f01891b13a64141a0bc9ab319e5bf8552ad8c28a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 17:11:03 +0200 +Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ] + +Unlike later versions, UVD 3 has firmware validation. +For this to work, the UVD should be powered up correctly. + +When DPM is enabled and the display clock is off, +the SMU may choose a power state which doesn't power +the UVD, which can result in failure to initialize UVD. + +v2: +Add code comments to explain about the UVD power state +and how UVD clock is turned on/off. + +Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)") +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 5534c769b6550..1e0189f90fd6a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @handle: handle used to pass amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +-- +2.51.0 + diff --git a/queue-6.6/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.6/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch new file mode 100644 index 0000000000..e925445293 --- /dev/null +++ b/queue-6.6/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch @@ -0,0 +1,36 @@ +From ee10ab69bf77c71c9ebdf8b90ca0daae5e4788a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 20:36:46 +0800 +Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() + +From: Qianfeng Rong + +[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ] + +Use negative error code -EINVAL instead of positive EINVAL in the default +case of svm_ioctl() to conform to Linux kernel error code conventions. + +Fixes: 42de677f7999 ("drm/amdkfd: register svm range") +Signed-off-by: Qianfeng Rong +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index b77b472332316..3168d6fb11e76 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4142,7 +4142,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +-- +2.51.0 + diff --git a/queue-6.6/drm-bridge-it6505-select-regmap_i2c.patch b/queue-6.6/drm-bridge-it6505-select-regmap_i2c.patch new file mode 100644 index 0000000000..3c45d6cfda --- /dev/null +++ b/queue-6.6/drm-bridge-it6505-select-regmap_i2c.patch @@ -0,0 +1,39 @@ +From b9da0026316a6a3102a88529275cec446cd08a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 16:58:25 -0700 +Subject: drm/bridge: it6505: select REGMAP_I2C + +From: Chia-I Wu + +[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ] + +Fix + + aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe': + ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c' + +Signed-off-by: Chia-I Wu +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reviewed-by: Chen-Yu Tsai +Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index 3e6a4e2044c0e..5a4d574b37b89 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -85,6 +85,7 @@ config DRM_ITE_IT6505 + select EXTCON + select CRYPTO + select CRYPTO_HASH ++ select REGMAP_I2C + help + ITE IT6505 DisplayPort bridge chip driver. + +-- +2.51.0 + diff --git a/queue-6.6/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.6/drm-msm-dpu-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..5ba147fe75 --- /dev/null +++ b/queue-6.6/drm-msm-dpu-fix-incorrect-type-for-ret.patch @@ -0,0 +1,40 @@ +From 9b74ec3d0553309d244e3000922bcd72c1bf01cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 17:20:45 +0800 +Subject: drm/msm/dpu: fix incorrect type for ret + +From: Qianfeng Rong + +[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ] + +Change 'ret' from unsigned long to int, as storing negative error codes +in an unsigned long makes it never equal to -ETIMEDOUT, causing logical +errors. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Qianfeng Rong +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/671100/ +Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 0a45c546b03f2..a5cd41c9224d7 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -433,7 +433,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +-- +2.51.0 + diff --git a/queue-6.6/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.6/drm-panel-novatek-nt35560-fix-invalid-return-value.patch new file mode 100644 index 0000000000..067b7cddc6 --- /dev/null +++ b/queue-6.6/drm-panel-novatek-nt35560-fix-invalid-return-value.patch @@ -0,0 +1,42 @@ +From 73ec6be83a4a03616d40c379171aa0f85a8e63f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 21:23:41 -0600 +Subject: drm/panel: novatek-nt35560: Fix invalid return value + +From: Brigham Campbell + +[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ] + +Fix bug in nt35560_set_brightness() which causes the function to +erroneously report an error. mipi_dsi_dcs_write() returns either a +negative value when an error occurred or a positive number of bytes +written when no error occurred. The buggy code reports an error under +either condition. + +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Reviewed-by: Douglas Anderson +Reviewed-by: Neil Armstrong +Signed-off-by: Brigham Campbell +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index 5bbea734123bc..ee04c55175bb8 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +-- +2.51.0 + diff --git a/queue-6.6/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.6/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch new file mode 100644 index 0000000000..df95ae7c63 --- /dev/null +++ b/queue-6.6/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch @@ -0,0 +1,60 @@ +From 78c12b7a7e3dd3f3d416c0aa9b8834932d8cd0f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 14:51:25 +0530 +Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ] + +GCC 16 enables -Werror=unused-but-set-variable= which results in build +error with the following message. + +drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’: +drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=] + 1411 | unsigned offset, i, level; + | ^~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1 + +level although is set, but in never used in the function +r600_texture_size. Thus resulting in dead code and this error getting +triggered. + +Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)") +Acked-by: Christian König +Signed-off-by: Brahmajit Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index ac77d1246b945..811265648a582 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +-- +2.51.0 + diff --git a/queue-6.6/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch b/queue-6.6/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch new file mode 100644 index 0000000000..58378eb80e --- /dev/null +++ b/queue-6.6/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch @@ -0,0 +1,78 @@ +From 0fb95991d67416105f0dd5785d943e7459f5bec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 14:57:07 +0800 +Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller + +From: Qiuxu Zhuo + +[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ] + +When loading the i10nm_edac driver on some Intel Granite Rapids servers, +a call trace may appear as follows: + + UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 + shift exponent -66 is negative + ... + __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 + skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] + i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] + skx_register_mci+0x159/0x220 [skx_edac_common] + i10nm_init+0xcb0/0x1ff0 [i10nm_edac] + ... + +This occurs because some BIOS may disable a memory controller if there +aren't any memory DIMMs populated on this memory controller. The DIMMMTR +register of this disabled memory controller contains the invalid value +~0, resulting in the call trace above. + +Fix this call trace by skipping DIMM enumeration on a disabled memory +controller. + +Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support") +Reported-by: Jose Jesus Ambriz Meza +Reported-by: Chia-Lin Kao (AceLan) +Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/ +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Tested-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index 068597e8fce95..3c70d86074975 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -970,6 +970,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) + return !!GET_BITFIELD(mcmtr, 2, 2); + } + ++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) ++{ ++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); ++ ++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); ++ ++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); ++} ++ + static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + struct res_config *cfg) + { +@@ -983,6 +992,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + if (!imc->mbase) + continue; + ++ if (i10nm_channel_disabled(imc, i)) { ++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); ++ continue; ++ } ++ + ndimms = 0; + amap = I10NM_GET_AMAP(imc, i); + +-- +2.51.0 + diff --git a/queue-6.6/f2fs-fix-condition-in-__allow_reserved_blocks.patch b/queue-6.6/f2fs-fix-condition-in-__allow_reserved_blocks.patch new file mode 100644 index 0000000000..71ce85838a --- /dev/null +++ b/queue-6.6/f2fs-fix-condition-in-__allow_reserved_blocks.patch @@ -0,0 +1,45 @@ +From 7d90d626a97bbc4a6d56508157a6bcf4bd39e23b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:03:38 +0800 +Subject: f2fs: fix condition in __allow_reserved_blocks() + +From: Chao Yu + +[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ] + +If reserve_root mount option is not assigned, __allow_reserved_blocks() +will return false, it's not correct, fix it. + +Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 7329f706da83c..ab2ddd09d8131 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2296,8 +2296,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, + { + if (!inode) + return true; +- if (!test_opt(sbi, RESERVE_ROOT)) +- return false; + if (IS_NOQUOTA(inode)) + return true; + if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) +@@ -2318,7 +2316,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode, cap)) ++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { +-- +2.51.0 + diff --git a/queue-6.6/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch b/queue-6.6/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch new file mode 100644 index 0000000000..1018a1931e --- /dev/null +++ b/queue-6.6/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch @@ -0,0 +1,138 @@ +From 89c74c5709493c187cc65f3c34c164a86cc5631a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 10:47:09 +0800 +Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() + +From: Chao Yu + +[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ] + +f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock +and page lookup, change as below to mitigate its overhead: +- check new_size before grabbing invalidate_lock +- lookup and invalidate pages only in range of [old_size, new_size] + +Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 39 +++++++++++++++++++-------------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 20d102009f715..6267ba6ef1083 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -36,15 +36,23 @@ + #include + #include + +-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) ++static void f2fs_zero_post_eof_page(struct inode *inode, ++ loff_t new_size, bool lock) + { + loff_t old_size = i_size_read(inode); + + if (old_size >= new_size) + return; + ++ if (mapping_empty(inode->i_mapping)) ++ return; ++ ++ if (lock) ++ filemap_invalidate_lock(inode->i_mapping); + /* zero or drop pages only in range of [old_size, new_size] */ +- truncate_pagecache(inode, old_size); ++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); ++ if (lock) ++ filemap_invalidate_unlock(inode->i_mapping); + } + + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) +@@ -115,9 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) + + f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); + + file_update_time(vmf->vma->vm_file); + filemap_invalidate_lock_shared(inode->i_mapping); +@@ -1077,7 +1083,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + filemap_invalidate_lock(inode->i_mapping); + + if (attr->ia_size > old_size) +- f2fs_zero_post_eof_page(inode, attr->ia_size); ++ f2fs_zero_post_eof_page(inode, attr->ia_size, false); + truncate_setsize(inode, attr->ia_size); + + if (attr->ia_size <= old_size) +@@ -1196,9 +1202,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) + if (ret) + return ret; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1484,7 +1488,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + + f2fs_lock_op(sbi); + f2fs_drop_extent_tree(inode); +@@ -1608,9 +1612,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + return ret; + +- filemap_invalidate_lock(mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1744,7 +1746,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + truncate_pagecache(inode, offset); + + while (!ret && idx > pg_start) { +@@ -1800,9 +1802,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + f2fs_balance_fs(sbi, true); + +@@ -4718,9 +4718,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, ++ iocb->ki_pos + iov_iter_count(from), true); + return count; + } + +-- +2.51.0 + diff --git a/queue-6.6/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch b/queue-6.6/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch new file mode 100644 index 0000000000..25fb99cc2c --- /dev/null +++ b/queue-6.6/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch @@ -0,0 +1,83 @@ +From a2b853613a2f8a51b13c645039395cbd13304b88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:40:24 +0800 +Subject: f2fs: fix to truncate first page in error path of f2fs_truncate() + +From: Chao Yu + +[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ] + +syzbot reports a bug as below: + +loop0: detected capacity change from 0 to 40427 +F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) +F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock +F2FS-fs (loop0): invalid crc value +F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. +------------[ cut here ]------------ +kernel BUG at fs/inode.c:753! +RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 +Call Trace: + + evict+0x504/0x9c0 fs/inode.c:810 + f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 + get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 + vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 + do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 + do_mount fs/namespace.c:4136 [inline] + __do_sys_mount fs/namespace.c:4347 [inline] + __se_sys_mount+0x317/0x410 fs/namespace.c:4324 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +During f2fs_evict_inode(), clear_inode() detects that we missed to truncate +all page cache before destorying inode, that is because in below path, we +will create page #0 in cache, but missed to drop it in error path, let's fix +it. + +- evict + - f2fs_evict_inode + - f2fs_truncate + - f2fs_convert_inline_inode + - f2fs_grab_cache_folio + : create page #0 in cache + - f2fs_convert_inline_folio + : sanity check failed, return -EFSCORRUPTED + - clear_inode detects that inode->i_data.nrpages is not zero + +Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large") +Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 031015823acb2..20d102009f715 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -844,8 +844,16 @@ int f2fs_truncate(struct inode *inode) + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +- if (err) ++ if (err) { ++ /* ++ * Always truncate page #0 to avoid page cache ++ * leak in evict() path. ++ */ ++ truncate_inode_pages_range(inode->i_mapping, ++ F2FS_BLK_TO_BYTES(0), ++ F2FS_BLK_END_BYTES(0)); + return err; ++ } + } + + err = f2fs_truncate_blocks(inode, i_size_read(inode), true); +-- +2.51.0 + diff --git a/queue-6.6/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch b/queue-6.6/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch new file mode 100644 index 0000000000..d23d5ca52c --- /dev/null +++ b/queue-6.6/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch @@ -0,0 +1,56 @@ +From 0dc0482272bb82291dbabbcdca6aeb1b3d778cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 16:12:50 +0800 +Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() + +From: Chao Yu + +[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ] + +Script to reproduce: +mkfs.f2fs -O extra_attr,compression /dev/vdb -f +mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache +cd /mnt/f2fs +f2fs_io write 1 0 1024 rand dsync testfile +xfs_io testfile -c "fsync" +f2fs_io write 1 0 512 rand dsync testfile +xfs_io testfile -c "fsync" +cd / +umount /mnt/f2fs +mount /dev/vdb /mnt/f2fs +f2fs_io precache_extents /mnt/f2fs/testfile +umount /mnt/f2fs + +Tracepoint output: +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0 +f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0 + +During precache_extents, there is off-by-one issue, we should update +map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is +valid and not contiguous to previous extent. + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index d37104aa847a7..0e119218ebf74 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1756,7 +1756,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + map->m_len - ofs); + } + if (map->m_next_extent) +- *map->m_next_extent = pgofs + 1; ++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; + } + f2fs_put_dnode(&dn); + unlock_out: +-- +2.51.0 + diff --git a/queue-6.6/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.6/f2fs-fix-zero-sized-extent-for-precache-extents.patch new file mode 100644 index 0000000000..c4cf5e0b9b --- /dev/null +++ b/queue-6.6/f2fs-fix-zero-sized-extent-for-precache-extents.patch @@ -0,0 +1,97 @@ +From 3cf3b7f647f3ecddd5ec5e6f701007ee3ab56136 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 10:36:21 +0800 +Subject: f2fs: fix zero-sized extent for precache extents + +From: wangzijie + +[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ] + +Script to reproduce: +f2fs_io write 1 0 1881 rand dsync testfile +f2fs_io fallocate 0 7708672 4096 testfile +f2fs_io write 1 1881 1 rand buffered testfile +fsync testfile +umount +mount +f2fs_io precache_extents testfile + +When the data layout is something like this: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +During precache_extents, we map the last block(valid blkaddr) in dnode1: +map->m_flags |= F2FS_MAP_MAPPED; +map->m_pblk = blkaddr(valid blkaddr); +map->m_len = 1; +then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out: +map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent: + +map->m_len = 1 +ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1 +ei.fofs = start_pgofs = 1882 +ei.len = map->m_len - ofs = 1 - 1 = 0 + +Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent: +A,B,C is valid blkaddr +case1: +dnode1: dnode2: +[0] A [0] NEW_ADDR +[1] A+1 [1] 0x0 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case2: +dnode1: dnode2: +[0] A [0] C (C!=B+1) +[1] A+1 [1] C+1 +... .... +[1016] A+1016 +[1017] B (B!=A+1017) [1017] 0x0 + +case3: +dnode1: dnode2: +[0] A [0] C (C!=B+2) +[1] A+1 [1] C+1 +... .... +[1015] A+1015 +[1016] B (B!=A+1016) +[1017] B+1 [1017] 0x0 + +[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/ + +Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS") +Signed-off-by: wangzijie +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 0e119218ebf74..fe23ebfc88ea1 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1751,9 +1751,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) + *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; +-- +2.51.0 + diff --git a/queue-6.6/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.6/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch new file mode 100644 index 0000000000..7d19c5430f --- /dev/null +++ b/queue-6.6/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch @@ -0,0 +1,37 @@ +From cbb2694a43c0c01fd573f1fd52601ab975ed19cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 11:23:33 -0400 +Subject: filelock: add FL_RECLAIM to show_fl_flags() macro + +From: Jeff Layton + +[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ] + +Show the FL_RECLAIM flag symbolically in tracepoints. + +Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims") +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/trace/events/filelock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index 1646dadd7f37c..3b1c8d93b2654 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +-- +2.51.0 + diff --git a/queue-6.6/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.6/firmware-firmware-meson-sm-fix-compile-test-default.patch new file mode 100644 index 0000000000..2da8ff0092 --- /dev/null +++ b/queue-6.6/firmware-firmware-meson-sm-fix-compile-test-default.patch @@ -0,0 +1,39 @@ +From 028d2d58a4b464685d984d58a28e928b97707046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 09:54:29 +0200 +Subject: firmware: firmware: meson-sm: fix compile-test default + +From: Johan Hovold + +[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ] + +Enabling compile testing should not enable every individual driver (we +have "allyesconfig" for that). + +Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module") +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd37566482..179f5d46d8ddf 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.6/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch new file mode 100644 index 0000000000..8fb7146c0e --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch @@ -0,0 +1,85 @@ +From 0177a9822d7f982563085fbeb64f71b346ec9db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 13:08:55 +0300 +Subject: fs: ntfs3: Fix integer overflow in run_unpack() + +From: Vitaly Grigoryev + +[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ] + +The MFT record relative to the file being opened contains its runlist, +an array containing information about the file's location on the physical +disk. Analysis of all Call Stack paths showed that the values of the +runlist array, from which LCNs are calculated, are not validated before +run_unpack function. + +The run_unpack function decodes the compressed runlist data format +from MFT attributes (for example, $DATA), converting them into a runs_tree +structure, which describes the mapping of virtual clusters (VCN) to +logical clusters (LCN). The NTFS3 subsystem also has a shortcut for +deleting files from MFT records - in this case, the RUN_DEALLOCATE +command is sent to the run_unpack input, and the function logic +provides that all data transferred to the runlist about file or +directory is deleted without creating a runs_tree structure. + +Substituting the runlist in the $DATA attribute of the MFT record for an +arbitrary file can lead either to access to arbitrary data on the disk +bypassing access checks to them (since the inode access check +occurs above) or to destruction of arbitrary data on the disk. + +Add overflow check for addition operation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Vitaly Grigoryev +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/run.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 44e93ad491ba7..0139124578d9e 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else + return -EINVAL; + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1151,7 +1156,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +-- +2.51.0 + diff --git a/queue-6.6/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch b/queue-6.6/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch new file mode 100644 index 0000000000..571027157d --- /dev/null +++ b/queue-6.6/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch @@ -0,0 +1,58 @@ +From 741e43cb83fbae5829f180d4083b9f49416fafbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 10:40:16 -0700 +Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks + exist + +From: Moon Hee Lee + +[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ] + +Index allocation requires at least one bit in the $BITMAP attribute to +track usage of index entries. If the bitmap is empty while index blocks +are already present, this reflects on-disk corruption. + +syzbot triggered this condition using a malformed NTFS image. During a +rename() operation involving a long filename (which spans multiple +index entries), the empty bitmap allowed the name to be added without +valid tracking. Subsequent deletion of the original entry failed with +-ENOENT, due to unexpected index state. + +Reject such cases by verifying that the bitmap is not empty when index +blocks exist. + +Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64 +Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") +Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com +Signed-off-by: Moon Hee Lee +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 191b91ffadbb2..f227db9f76c2b 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1510,6 +1510,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); + } + ++ /* ++ * Index blocks exist, but $BITMAP has zero valid bits. ++ * This implies an on-disk corruption and must be rejected. ++ */ ++ if (in->name == I30_NAME && ++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { ++ err = -EINVAL; ++ goto out1; ++ } ++ + bit = bmp_size << 3; + } + +-- +2.51.0 + diff --git a/queue-6.6/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch b/queue-6.6/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch new file mode 100644 index 0000000000..ad75ca99a6 --- /dev/null +++ b/queue-6.6/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch @@ -0,0 +1,37 @@ +From 23e5bbd2f5bd51689b9d9ba7dd81ee1efc315939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Aug 2025 23:57:24 +0200 +Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote + +From: Andreas Gruenbacher + +[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ] + +Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS +flag a second time after it has already been cleared. Fix that. + +Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount") +Signed-off-by: Andreas Gruenbacher +Reviewed-by: Andrew Price +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 687670075d225..c4bc86c3535ba 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -811,8 +811,6 @@ __acquires(&gl->gl_lockref.lock) + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); + return; +- } else { +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +-- +2.51.0 + diff --git a/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch new file mode 100644 index 0000000000..12afd290e6 --- /dev/null +++ b/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch @@ -0,0 +1,81 @@ +From 83e42592569a03ef06be720e78b5d08936610bd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Sep 2025 09:02:54 +0530 +Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Deepanshu Kartikey + +[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] + +hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate +operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: +use new vma_lock for pmd sharing synchronization"), if the trylock fails +or the VMA has no lock, it should skip that VMA. Any remaining mapped +pages are handled by remove_inode_hugepages() which is called after +hugetlb_vmdelete_list() and uses proper lock ordering to guarantee +unmapping success. + +Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs +without shareable locks, the code proceeds to call unmap_hugepage_range(). +This causes assertion failures in huge_pmd_unshare() → +hugetlb_vma_assert_locked() because no lock is actually held: + + WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted + Call Trace: + hugetlb_vma_assert_locked+0x1dd/0x250 + huge_pmd_unshare+0x2c8/0x540 + __unmap_hugepage_range+0x6e3/0x1aa0 + unmap_hugepage_range+0x32e/0x410 + hugetlb_vmdelete_list+0x189/0x1f0 + +Fix by using goto to ensure locks acquired by trylock are always released, +even when skipping VMAs without shareable locks. + +Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com +Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") +Signed-off-by: Deepanshu Kartikey +Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 +Suggested-by: Andrew Morton +Cc: David Hildenbrand +Cc: Muchun Song +Cc: Oscar Salvador +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hugetlbfs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 914e850b9cbb7..a1ec55fc3a311 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -592,6 +592,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + if (!hugetlb_vma_trylock_write(vma)) + continue; + ++ /* ++ * Skip VMAs without shareable locks. Per the design in commit ++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() ++ * called after this function with proper locking. ++ */ ++ if (!__vma_shareable_lock(vma)) ++ goto skip; ++ + v_start = vma_offset_start(vma, start); + v_end = vma_offset_end(vma, end); + +@@ -602,6 +610,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, + * vmas. Therefore, lock is not held when calling + * unmap_hugepage_range for private vmas. + */ ++skip: + hugetlb_vma_unlock_write(vma); + } + } +-- +2.51.0 + diff --git a/queue-6.6/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.6/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch new file mode 100644 index 0000000000..c0aee2dcc2 --- /dev/null +++ b/queue-6.6/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch @@ -0,0 +1,102 @@ +From f1af8dfa3ca082b03742f40baebce4e6ec483918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:48:58 +0200 +Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from + different subsystems + +From: Vadim Pasternak + +[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ] + +Distinct between fan speed setting request coming for hwmon and +thermal subsystems. + +There are fields 'last_hwmon_state' and 'last_thermal_state' in the +structure 'mlxreg_fan_pwm', which respectively store the cooling state +set by the 'hwmon' and 'thermal' subsystem. +The purpose is to make arbitration of fan speed setting. For example, if +fan speed required to be not lower than some limit, such setting is to +be performed through 'hwmon' subsystem, thus 'thermal' subsystem will +not set fan below this limit. + +Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing +cooling state to never be set to a lower value. + +Eliminate update of 'last_thermal_state', when request is coming from +'hwmon' subsystem. + +Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index c25a54d5b39ad..0ba9195c9d713 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +-- +2.51.0 + diff --git a/queue-6.6/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.6/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch new file mode 100644 index 0000000000..1384fd6d73 --- /dev/null +++ b/queue-6.6/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch @@ -0,0 +1,47 @@ +From 1b82bbc3ca21371df209f5f7bc477c395fcdada3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 08:20:02 -0500 +Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init + +From: Nishanth Menon + +[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ] + +Fix division by zero in ks_sa_rng_init caused by missing clock +pointer initialization. The clk_get_rate() call is performed on +an uninitialized clk pointer, resulting in division by zero when +calculating delay values. + +Add clock initialization code before using the clock. + +Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") +Signed-off-by: Nishanth Menon + + drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ + 1 file changed, 7 insertions(+) +Reviewed-by: Alexander Sverdlin + +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/ks-sa-rng.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 2f2f21f1b659e..d7b42888f25c2 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +-- +2.51.0 + diff --git a/queue-6.6/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.6/hwrng-nomadik-add-arm_amba-dependency.patch new file mode 100644 index 0000000000..5617383600 --- /dev/null +++ b/queue-6.6/hwrng-nomadik-add-arm_amba-dependency.patch @@ -0,0 +1,44 @@ +From 864b4ddb864ddc9b6beb6dc5f14621b60d960ddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 17:28:00 +0200 +Subject: hwrng: nomadik - add ARM_AMBA dependency + +From: Arnd Bergmann + +[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ] + +Compile-testing this driver is only possible when the AMBA bus driver is +available in the kernel: + +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove': +nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions' +x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe': +nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions' +x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions' + +The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be +specified for the COMPILE_TEST case. + +Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index 8de74dcfa18cf..ece2d794174d4 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.51.0 + diff --git a/queue-6.6/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.6/i2c-designware-add-disabling-clocks-when-probe-fails.patch new file mode 100644 index 0000000000..af1ff9124d --- /dev/null +++ b/queue-6.6/i2c-designware-add-disabling-clocks-when-probe-fails.patch @@ -0,0 +1,39 @@ +From 25700074f6325715b91d936ae835930ed73cd95f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:11 +0900 +Subject: i2c: designware: Add disabling clocks when probe fails + +From: Kunihiko Hayashi + +[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ] + +After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is +called. However, this function doesn't disable clocks and the clock-enable +count keeps increasing. Should disable these clocks explicitly. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index ca6e1991ad13f..e6fa6cb1011ab 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -394,6 +394,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +-- +2.51.0 + diff --git a/queue-6.6/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch b/queue-6.6/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch new file mode 100644 index 0000000000..05dcb6a7a6 --- /dev/null +++ b/queue-6.6/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch @@ -0,0 +1,68 @@ +From 26bed8638c1f486e194639f3d677bf046af33e5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jul 2025 13:22:10 +0900 +Subject: i2c: designware: Fix clock issue when PM is disabled + +From: Kunihiko Hayashi + +[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ] + +When the driver is removed, the clocks are first enabled by +calling pm_runtime_get_sync(), and then disabled with +pm_runtime_put_sync(). + +If CONFIG_PM=y, clocks for this controller are disabled when it's in +the idle state. So the clocks are properly disabled when the driver +exits. + +Othewise, the clocks are always enabled and the PM functions have +no effect. Therefore, the driver exits without disabling the clocks. + + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 18 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind + # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count + 20 + +To ensure that the clocks can be disabled correctly even without +CONFIG_PM=y, should add the following fixes: + +- Replace with pm_runtime_put_noidle(), which only decrements the runtime + PM usage count. +- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. + +Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") +Co-developed-by: Kohei Ito +Signed-off-by: Kohei Ito +Signed-off-by: Kunihiko Hayashi +Tested-by: Jarkko Nikula +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 1ebcf5673a06b..ca6e1991ad13f 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -411,9 +411,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) + i2c_dw_disable(dev); + + pm_runtime_dont_use_autosuspend(device); +- pm_runtime_put_sync(device); ++ pm_runtime_put_noidle(device); + dw_i2c_plat_pm_cleanup(dev); + ++ i2c_dw_prepare_clk(dev, false); ++ + i2c_dw_remove_lock_support(dev); + + reset_control_assert(dev->rst); +-- +2.51.0 + diff --git a/queue-6.6/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.6/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch new file mode 100644 index 0000000000..aeaec57a9e --- /dev/null +++ b/queue-6.6/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch @@ -0,0 +1,86 @@ +From 194e5ef4f3a9528c65efaf74d7f4ef5c3ad09d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 16:24:06 +0800 +Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leilk.Liu + +[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ] + +The old IC does not support the I2C_MASTER_WRRD (write-then-read) +function, but the current code’s handling of i2c->auto_restart may +potentially lead to entering the I2C_MASTER_WRRD software flow, +resulting in unexpected bugs. + +Instead of repurposing the auto_restart flag, add a separate flag +to signal I2C_MASTER_WRRD operations. + +Also fix handling of msgs. If the operation (i2c->op) is +I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. +For all other operations, msgs is simply incremented by 1. + +Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") +Signed-off-by: Leilk.Liu +Suggested-by: Chen-Yu Tsai +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 1a9b5a068ef1b..6b788bca64d54 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +-- +2.51.0 + diff --git a/queue-6.6/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.6/i3c-master-svc-recycle-unused-ibi-slot.patch new file mode 100644 index 0000000000..a2d2ca04c8 --- /dev/null +++ b/queue-6.6/i3c-master-svc-recycle-unused-ibi-slot.patch @@ -0,0 +1,39 @@ +From 889014650f0fb96ee9b114f8d79be61fa05213a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:09 +0800 +Subject: i3c: master: svc: Recycle unused IBI slot + +From: Stanley Chu + +[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ] + +In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool +to store the IBI payload. However, when an error condition is encountered, +the function returns without recycling the IBI slot, resulting in an IBI +slot leak. + +Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index 1cfc8f480d15c..277884b5e1ca4 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -369,6 +369,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.6/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.6/i3c-master-svc-use-manual-response-for-ibi-events.patch new file mode 100644 index 0000000000..5479bfd42f --- /dev/null +++ b/queue-6.6/i3c-master-svc-use-manual-response-for-ibi-events.patch @@ -0,0 +1,96 @@ +From 2e22e49cd1d5a28b0370924d098276ebdbcbd518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 09:23:08 +0800 +Subject: i3c: master: svc: Use manual response for IBI events + +From: Stanley Chu + +[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ] + +Driver wants to nack the IBI request when the target is not in the +known address list. In below code, svc_i3c_master_nack_ibi() will +cause undefined behavior when using AUTOIBI with auto response rule, +because hw always auto ack the IBI request. + + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); + if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) + svc_i3c_master_nack_ibi(master); + ... + break; + +AutoIBI has another issue that the controller doesn't quit AutoIBI state +after IBIWON polling timeout when there is a SDA glitch(high->low->high). +1. SDA high->low: raising an interrupt to execute IBI ISR +2. SDA low->high +3. Driver writes an AutoIBI request +4. AutoIBI process does not start because SDA is not low +5. IBIWON polling times out +6. Controller reamins in AutoIBI state and doesn't accept EmitStop request + +Emitting broadcast address with IBIRESP_MANUAL avoids both issues. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Signed-off-by: Stanley Chu +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index d1630d47ef6fc..1cfc8f480d15c 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -430,9 +430,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -452,10 +467,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +-- +2.51.0 + diff --git a/queue-6.6/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.6/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch new file mode 100644 index 0000000000..58de913f26 --- /dev/null +++ b/queue-6.6/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch @@ -0,0 +1,61 @@ +From ec73035e9b8b3bc8162b794923d6e398ad18c068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 19:31:12 +0300 +Subject: IB/sa: Fix sa_local_svc_timeout_ms read race + +From: Vlad Dumitrescu + +[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ] + +When computing the delta, the sa_local_svc_timeout_ms is read without +ib_nl_request_lock held. Though unlikely in practice, this can cause +a race condition if multiple local service threads are managing the +timeout. + +Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") +Signed-off-by: Vlad Dumitrescu +Reviewed-by: Mark Zhang +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sa_query.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 8175dde60b0a8..9902bb96c7409 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/iio-consumers-fix-handling-of-negative-channel-scale.patch b/queue-6.6/iio-consumers-fix-handling-of-negative-channel-scale.patch new file mode 100644 index 0000000000..d73240711c --- /dev/null +++ b/queue-6.6/iio-consumers-fix-handling-of-negative-channel-scale.patch @@ -0,0 +1,121 @@ +From 640b3cf6ed309cb96c33ad728f764ac7744ba943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:20 +0200 +Subject: iio: consumers: Fix handling of negative channel scale in + iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ] + +There is an issue with the handling of negative channel scales +in iio_convert_raw_to_processed_unlocked() when the channel-scale +is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type: + +Things work for channel-scale values > -1.0 and < 0.0 because of +the use of signed values in: + + *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); + +Things will break however for scale values < -1.0. Lets for example say +that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5. + +The result should then be 2 * 10 * -1.5 = -30. + +channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000, +now lets see what gets stored in processed: + +1. *processed = raw64 * scale_val * scale; +2. *processed += raw64 * scale_val2 * scale / 1000000LL; + +1. Sets processed to 2 * -1 * 10 = -20 +2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed + +And the end result is processed = -20 + 10 = -10, which is not correct. + +Fix this by always using the abs value of both scale_val and scale_val2 +and if either is negative multiply the end-result by -1. + +Note there seems to be an unwritten rule about negative +IIO_VAL_INT_PLUS_[MICRO|NANO] values that: + +i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx +ii. values <= -1.0 are written as val=-xxx val2=xxx + +But iio_format_value() will also correctly display a third option: + +iii. values <= -1.0 written as val=-xxx val2=-xxx + +Since iio_format_value() uses abs(val) when val2 < 0. + +This fix also makes iio_convert_raw_to_processed() properly handle +channel-scales using this third option. + +Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") +Cc: Matteo Martelli +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 8255035ff124f..34abbf46916cc 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -635,7 +636,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + { + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; +- s64 raw64 = raw; ++ s64 denominator, raw64 = raw; + + offset_type = iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); +@@ -679,20 +680,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000LL); +- break; + case IIO_VAL_INT_PLUS_NANO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000000LL); ++ switch (scale_type) { ++ case IIO_VAL_INT_PLUS_MICRO: ++ denominator = MICRO; ++ break; ++ case IIO_VAL_INT_PLUS_NANO: ++ denominator = NANO; ++ break; ++ } ++ *processed = raw64 * scale * abs(scale_val); ++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); ++ if (scale_val < 0 || scale_val2 < 0) ++ *processed *= -1; + break; + case IIO_VAL_FRACTIONAL: + *processed = div_s64(raw64 * (s64)scale_val * scale, +-- +2.51.0 + diff --git a/queue-6.6/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.6/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch new file mode 100644 index 0000000000..951c614e0a --- /dev/null +++ b/queue-6.6/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch @@ -0,0 +1,42 @@ +From ebe028ce09e03d854ef05a9531dd79d0224d192b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 12:48:21 +0200 +Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed() + +From: Hans de Goede + +[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ] + +Fix iio_convert_raw_to_processed() offset handling for channels without +a scale attribute. + +The offset has been applied to the raw64 value not to the original raw +value. Use the raw64 value so that the offset is taken into account. + +Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available") +Cc: Liam Beguin +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 34abbf46916cc..c7b2ab7870993 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -671,7 +671,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch b/queue-6.6/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch new file mode 100644 index 0000000000..51f8cf63c7 --- /dev/null +++ b/queue-6.6/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch @@ -0,0 +1,83 @@ +From 9b107250e6c49c871dcbbfa4770cae6ff661c47e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:30:51 +0000 +Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup() + +From: Eric Dumazet + +[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ] + +We need to check socket netns before considering them in ping_get_port(). +Otherwise, one malicious netns could 'consume' all ports. + +Add corresponding check in ping_lookup(). + +Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Reviewed-by: Yue Haibing +Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ping.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 4cb0c896caf97..5c848136bc266 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, + + int ping_get_port(struct sock *sk, unsigned short ident) + { ++ struct net *net = sock_net(sk); + struct inet_sock *isk, *isk2; + struct hlist_head *hlist; + struct sock *sk2 = NULL; +@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + for (i = 0; i < (1L << 16); i++, result++) { + if (!result) + result++; /* avoid zero */ +- hlist = ping_hashslot(&ping_table, sock_net(sk), +- result); ++ hlist = ping_hashslot(&ping_table, net, result); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + if (isk2->inet_num == result) +@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + if (i >= (1L << 16)) + goto fail; + } else { +- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); ++ hlist = ping_hashslot(&ping_table, net, ident); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + /* BUG? Why is this reuse and not reuseaddr? ping.c +@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) + pr_debug("was not hashed\n"); + sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); +- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ sock_prot_inuse_add(net, sk->sk_prot, 1); + } + spin_unlock(&ping_table.lock); + return 0; +@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + } + + sk_for_each_rcu(sk, hslot) { ++ if (!net_eq(sock_net(sk), net)) ++ continue; + isk = inet_sk(sk); + + pr_debug("iterate\n"); +-- +2.51.0 + diff --git a/queue-6.6/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.6/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch new file mode 100644 index 0000000000..8dbf708179 --- /dev/null +++ b/queue-6.6/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch @@ -0,0 +1,39 @@ +From 74703dcc00b4bf8db0e421bd1f1d28c52b349935 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 09:11:05 +0200 +Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD + +From: Geert Uytterhoeven + +[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ] + +INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and +init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to +prevent asking the user about this feature when configuring a kernel +without initramfs support. + +Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Martin Wilck +Reviewed-by: David Disseldorp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 8b630143c720f..461591503bf43 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1367,6 +1367,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +-- +2.51.0 + diff --git a/queue-6.6/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.6/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch new file mode 100644 index 0000000000..7821000004 --- /dev/null +++ b/queue-6.6/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch @@ -0,0 +1,63 @@ +From f490acde7184aa5bf1df552df1f5cb073d532e29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 01:57:59 +0800 +Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup + +From: Slavin Liu + +[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] + +On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp +before connections with valid cp->app pointers are flushed, leading to a +use-after-free. + +Fix this by introducing a global `exiting_module` flag, set to true in +ip_vs_ftp_exit() before unregistering the pernet subsystem. In +__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns +cleanup (when exiting_module is false) and defer it to +__ip_vs_cleanup_batch(), which unregisters all apps after all connections +are flushed. If called during module exit, unregister ip_vs_ftp +immediately. + +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Suggested-by: Julian Anastasov +Signed-off-by: Slavin Liu +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index ef1f45e43b630..61d3797fb7995 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +-- +2.51.0 + diff --git a/queue-6.6/ipvs-use-read_once-write_once-for-ipvs-enable.patch b/queue-6.6/ipvs-use-read_once-write_once-for-ipvs-enable.patch new file mode 100644 index 0000000000..a108e8d5d8 --- /dev/null +++ b/queue-6.6/ipvs-use-read_once-write_once-for-ipvs-enable.patch @@ -0,0 +1,223 @@ +From c7a7794fdc64c973b22be631edc7b54ee9458cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 21:46:54 +0800 +Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable + +From: Zhang Tengfei + +[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ] + +KCSAN reported a data-race on the `ipvs->enable` flag, which is +written in the control path and read concurrently from many other +contexts. + +Following a suggestion by Julian, this patch fixes the race by +converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. +This lightweight approach ensures atomic access and acts as a +compiler barrier, preventing unsafe optimizations where the flag +is checked in loops (e.g., in ip_vs_est.c). + +Additionally, the `enable` checks in the fast-path hooks +(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are +removed. These are unnecessary since commit 857ca89711de +("ipvs: register hooks only with services"). The `enable=0` +condition they check for can only occur in two rare and non-fatal +scenarios: 1) after hooks are registered but before the flag is set, +and 2) after hooks are unregistered on cleanup_net. In the worst +case, a single packet might be mishandled (e.g., dropped), which +does not lead to a system crash or data corruption. Adding a check +in the performance-critical fast-path to handle this harmless +condition is not a worthwhile trade-off. + +Fixes: 857ca89711de ("ipvs: register hooks only with services") +Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 +Suggested-by: Julian Anastasov +Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ +Signed-off-by: Zhang Tengfei +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + net/netfilter/ipvs/ip_vs_core.c | 11 ++++------- + net/netfilter/ipvs/ip_vs_ctl.c | 6 +++--- + net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++-------- + 4 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 8182833a35828..d9c3eefe8cbb0 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -884,7 +884,7 @@ static void ip_vs_conn_expire(struct timer_list *t) + * conntrack cleanup for the net. + */ + smp_rmb(); +- if (ipvs->enable) ++ if (READ_ONCE(ipvs->enable)) + ip_vs_conn_drop_conntrack(cp); + } + +@@ -1432,7 +1432,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) + cond_resched_rcu(); + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + break; + } + rcu_read_unlock(); +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 3230506ae3ffd..34c4648ba36ec 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat + if (unlikely(!skb_dst(skb))) + return NF_ACCEPT; + +- if (!ipvs->enable) +- return NF_ACCEPT; +- + ip_vs_fill_iph_skb(af, skb, false, &iph); + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +@@ -1936,7 +1933,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state + return NF_ACCEPT; + } + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + ip_vs_fill_iph_skb(af, skb, false, &iph); +@@ -2104,7 +2101,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, + int r; + + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + if (state->pf == NFPROTO_IPV4) { +@@ -2291,7 +2288,7 @@ static int __net_init __ip_vs_init(struct net *net) + return -ENOMEM; + + /* Hold the beast until a service is registered */ +- ipvs->enable = 0; ++ WRITE_ONCE(ipvs->enable, 0); + ipvs->net = net; + /* Counters used for creating unique names */ + ipvs->gen = atomic_read(&ipvs_netns_cnt); +@@ -2363,7 +2360,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) + ipvs = net_ipvs(net); + ip_vs_unregister_hooks(ipvs, AF_INET); + ip_vs_unregister_hooks(ipvs, AF_INET6); +- ipvs->enable = 0; /* Disable packet reception */ ++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index ae76542de3e98..c82dcbb4dabce 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) + struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock; + if (!kd) + continue; +@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + + *svc_p = svc; + +- if (!ipvs->enable) { ++ if (!READ_ONCE(ipvs->enable)) { + /* Now there is a service - full throttle */ +- ipvs->enable = 1; ++ WRITE_ONCE(ipvs->enable, 1); + + /* Start estimation for first time */ + ip_vs_est_reload_start(ipvs); +diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c +index c5970ba416aea..b48d3a09e2174 100644 +--- a/net/netfilter/ipvs/ip_vs_est.c ++++ b/net/netfilter/ipvs/ip_vs_est.c +@@ -230,7 +230,7 @@ static int ip_vs_estimation_kthread(void *data) + void ip_vs_est_reload_start(struct netns_ipvs *ipvs) + { + /* Ignore reloads before first service is added */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + return; + ip_vs_est_stopped_recalc(ipvs); + /* Bump the kthread configuration genid */ +@@ -304,7 +304,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + int i; + + if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && +- ipvs->enable && ipvs->est_max_threads) ++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) + return -EINVAL; + + mutex_lock(&ipvs->est_mutex); +@@ -341,7 +341,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + } + + /* Start kthread tasks only when services are present */ +- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { ++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { + ret = ip_vs_est_kthread_start(ipvs, kd); + if (ret < 0) + goto out; +@@ -484,7 +484,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) + struct ip_vs_estimator *est = &stats->est; + int ret; + +- if (!ipvs->est_max_threads && ipvs->enable) ++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) + ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); + + est->ktid = -1; +@@ -661,7 +661,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + /* Wait for cpufreq frequency transition */ + wait_event_idle_timeout(wq, kthread_should_stop(), + HZ / 50); +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + } + +@@ -679,7 +679,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + rcu_read_unlock(); + local_bh_enable(); + +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + cond_resched(); + +@@ -755,7 +755,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + mutex_lock(&ipvs->est_mutex); + for (id = 1; id < ipvs->est_kt_count; id++) { + /* netns clean up started, abort */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock2; + kd = ipvs->est_kt_arr[id]; + if (!kd) +@@ -785,7 +785,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + id = ipvs->est_kt_count; + + next_kt: +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto unlock; + id--; + if (id < 0) +-- +2.51.0 + diff --git a/queue-6.6/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch b/queue-6.6/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch new file mode 100644 index 0000000000..b60e0fa312 --- /dev/null +++ b/queue-6.6/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch @@ -0,0 +1,85 @@ +From 1c7196269f7ef10bc8d6b24cec394832837257c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 21:15:50 +0000 +Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing + +From: Fan Wu + +[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ] + +Fix the X.509 Basic Constraints CA flag parsing to correctly handle +the ASN.1 DER encoded structure. The parser was incorrectly treating +the length field as the boolean value. + +Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. +According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: + +Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) + +The basicConstraints extension with CA:TRUE is encoded as: + + SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) + ^-- v[2] ^-- v[3] ^-- v[4] + +The parser was checking v[3] (the length field, always 0x01) instead +of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). + +Also handle the case where the extension is an empty SEQUENCE (30 00), +which is valid for CA:FALSE when the default value is omitted as +required by DER encoding rules (X.690 section 11.5). + +Per ITU-T X.690-0207: +- Section 11.5: Default values must be omitted in DER +- Section 11.1: DER requires TRUE to be encoded as 0xFF + +Link: https://datatracker.ietf.org/doc/html/rfc5280 +Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf +Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") +Signed-off-by: Fan Wu +Reviewed-by: Lukas Wunner +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 0a7049b470c18..5201f47e31d8b 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -618,11 +618,14 @@ int x509_process_extension(void *context, size_t hdrlen, + /* + * Get hold of the basicConstraints + * v[1] is the encoding size +- * (Expect 0x2 or greater, making it 1 or more bytes) ++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or ++ * 0x03 or greater for non-empty SEQUENCE) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) +- * v[3] is the contents of the ASN1_BOOL +- * (Expect 1 if the CA is TRUE) ++ * v[3] is the length of the ASN1_BOOL ++ * (Expect 1 for a single byte boolean) ++ * v[4] is the contents of the ASN1_BOOL ++ * (Expect 0xFF if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) +@@ -631,8 +634,13 @@ int x509_process_extension(void *context, size_t hdrlen, + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; +- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) ++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ ++ if (v[1] == 0) ++ return 0; ++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; ++ else ++ return -EBADMSG; + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/leds-flash-leds-qcom-flash-update-torch-current-clam.patch b/queue-6.6/leds-flash-leds-qcom-flash-update-torch-current-clam.patch new file mode 100644 index 0000000000..1f1a20aef1 --- /dev/null +++ b/queue-6.6/leds-flash-leds-qcom-flash-update-torch-current-clam.patch @@ -0,0 +1,141 @@ +From 741e32f78ccb3dcc84a5515277677db4771503dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jul 2025 12:51:22 +0800 +Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting + +From: Fenglin Wu + +[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ] + +There is a register to clamp the flash current per LED channel when +safety timer is disabled. It needs to be updated according to the +maximum torch LED current setting to ensure the torch current won't +be clamped unexpectedly. + +Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") +Signed-off-by: Fenglin Wu +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------ + 1 file changed, 36 insertions(+), 26 deletions(-) + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index a619dbe015243..07ca3e32d4bec 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -114,36 +114,39 @@ enum { + REG_THERM_THRSH1, + REG_THERM_THRSH2, + REG_THERM_THRSH3, ++ REG_TORCH_CLAMP, + REG_MAX_COUNT, + }; + + static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x08, 0, 7), /* status1 */ +- REG_FIELD(0x09, 0, 7), /* status2 */ +- REG_FIELD(0x0a, 0, 7), /* status3 */ +- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ +- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x47, 0, 5), /* iresolution */ +- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ +- REG_FIELD(0x4c, 0, 2), /* chan_en */ +- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ +- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ ++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), ++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), ++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), ++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), + }; + + static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x06, 0, 7), /* status1 */ +- REG_FIELD(0x07, 0, 6), /* status2 */ +- REG_FIELD(0x09, 0, 7), /* status3 */ +- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ +- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x49, 0, 3), /* iresolution */ +- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ +- REG_FIELD(0x4e, 0, 3), /* chan_en */ +- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ ++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), ++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), ++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), + }; + + struct qcom_flash_data { +@@ -156,6 +159,7 @@ struct qcom_flash_data { + u8 max_channels; + u8 chan_en_bits; + u8 revision; ++ u8 torch_clamp; + }; + + struct qcom_flash_led { +@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, + u32 current_ua, timeout_us; + u32 channels[4]; + int i, rc, count; ++ u8 torch_clamp; + + count = fwnode_property_count_u32(node, "led-sources"); + if (count <= 0) { +@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, + current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); + led->max_torch_current_ma = current_ua / UA_PER_MA; + ++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; ++ if (torch_clamp != 0) ++ torch_clamp--; ++ ++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); ++ + if (fwnode_property_present(node, "flash-max-microamp")) { + flash->led_cdev.flags |= LED_DEV_CAP_FLASH; + +@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) + flash_data->leds_count++; + } + +- return 0; +- ++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); + release: + fwnode_handle_put(child); + while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) +-- +2.51.0 + diff --git a/queue-6.6/libbpf-fix-reuse-of-devmap.patch b/queue-6.6/libbpf-fix-reuse-of-devmap.patch new file mode 100644 index 0000000000..463a89d702 --- /dev/null +++ b/queue-6.6/libbpf-fix-reuse-of-devmap.patch @@ -0,0 +1,53 @@ +From f164eb49421874daab86900d0895f60d39c20b0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 20:01:12 +0200 +Subject: libbpf: Fix reuse of DEVMAP + +From: Yureka Lilian + +[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ] + +Previously, re-using pinned DEVMAP maps would always fail, because +get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, +but BPF_F_RDONLY_PROG being set on a map during creation is invalid. + +Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +get_map_info when checking for compatibility with an existing DEVMAP. + +The same problem is handled in a third-party ebpf library: +- https://github.com/cilium/ebpf/issues/925 +- https://github.com/cilium/ebpf/pull/930 + +Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF") +Signed-off-by: Yureka Lilian +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index aefbfa2df6207..95f2ffefff3ff 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5013,6 +5013,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +-- +2.51.0 + diff --git a/queue-6.6/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.6/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch new file mode 100644 index 0000000000..f50538cadf --- /dev/null +++ b/queue-6.6/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch @@ -0,0 +1,47 @@ +From d2e1c8c1165781dca2e1ea9034aba63a74acc58e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 16:27:24 +0800 +Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe() + +From: Zhang Shurong + +[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ] + +rj54n1_probe() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index b430046f9e2a9..09293e90025d5 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1331,10 +1331,13 @@ static int rj54n1_probe(struct i2c_client *client) + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +-- +2.51.0 + diff --git a/queue-6.6/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.6/media-st-delta-avoid-excessive-stack-usage.patch new file mode 100644 index 0000000000..8d745d7d55 --- /dev/null +++ b/queue-6.6/media-st-delta-avoid-excessive-stack-usage.patch @@ -0,0 +1,92 @@ +From d2ef9796d86d3ecee1c99edba439bccb0cf9cdb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 11:31:56 +0200 +Subject: media: st-delta: avoid excessive stack usage + +From: Arnd Bergmann + +[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ] + +Building with a reduced stack warning limit shows that delta_mjpeg_decode() +copies a giant structure to the stack each time but only uses three of +its members: + +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode': +drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] + +Open-code the passing of the structure members that are actually used here. + +Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d24..a078f1107300e 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +-- +2.51.0 + diff --git a/queue-6.6/media-zoran-remove-zoran_fh-structure.patch b/queue-6.6/media-zoran-remove-zoran_fh-structure.patch new file mode 100644 index 0000000000..eca198d791 --- /dev/null +++ b/queue-6.6/media-zoran-remove-zoran_fh-structure.patch @@ -0,0 +1,63 @@ +From b6918e6ff17268c9f14b9bfc73b7ca6d4c8f5c0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 04:30:15 +0300 +Subject: media: zoran: Remove zoran_fh structure + +From: Jacopo Mondi + +[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ] + +The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been +mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"), +but the structure stayed by mistake. It is now used in a single +location, assigned from a void pointer and then recast to a void +pointer, without being every accessed. Drop it. + +Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2") +Signed-off-by: Jacopo Mondi +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/zoran/zoran.h | 6 ------ + drivers/media/pci/zoran/zoran_driver.c | 3 +-- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 56340553b2823..63592c4f9ed8c 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index fa672cc8bc678..feb39854a989e 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +-- +2.51.0 + diff --git a/queue-6.6/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.6/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch new file mode 100644 index 0000000000..3a8a9af038 --- /dev/null +++ b/queue-6.6/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch @@ -0,0 +1,38 @@ +From d24046dd9f70937cb3418a77be40c4f345361777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:37:12 +0100 +Subject: misc: genwqe: Fix incorrect cmd field being reported in error + +From: Colin Ian King + +[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ] + +There is a dev_err message that is reporting the value of +cmd->asiv_length when it should be reporting cmd->asv_length +instead. Fix this. + +Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_ddcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f..fd7d5cd50d396 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +-- +2.51.0 + diff --git a/queue-6.6/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.6/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch new file mode 100644 index 0000000000..222b35ddfa --- /dev/null +++ b/queue-6.6/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch @@ -0,0 +1,50 @@ +From 1c5ad6e6d21e6711cf05825326e8c30266801eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 14:07:27 +0300 +Subject: mtd: rawnand: atmel: Fix error handling path in + atmel_nand_controller_add_nands + +From: Erick Karanja + +[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ] + +In case of a jump to the err label due to atmel_nand_create() or +atmel_nand_controller_add_nand() failure, the reference to nand_np +need to be released + +Use for_each_child_of_node_scoped() to fix the issue. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") + +Signed-off-by: Erick Karanja +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index c5aff27ec4a89..14a09285f1551 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +-- +2.51.0 + diff --git a/queue-6.6/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.6/nbd-restrict-sockets-to-tcp-and-udp.patch new file mode 100644 index 0000000000..963913a9bd --- /dev/null +++ b/queue-6.6/nbd-restrict-sockets-to-tcp-and-udp.patch @@ -0,0 +1,54 @@ +From c17e89939b2dd8662deb0078132d6bef5cf19160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:22:43 +0000 +Subject: nbd: restrict sockets to TCP and UDP + +From: Eric Dumazet + +[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] + +Recently, syzbot started to abuse NBD with all kinds of sockets. + +Commit cf1b2326b734 ("nbd: verify socket is supported during setup") +made sure the socket supported a shutdown() method. + +Explicitely accept TCP and UNIX stream sockets. + +Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") +Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154 +Signed-off-by: Eric Dumazet +Cc: Mike Christie +Cc: Richard W.M. Jones +Cc: Jens Axboe +Cc: Yu Kuai +Cc: linux-block@vger.kernel.org +Cc: nbd@other.debian.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 3742ddf46c55a..27a05b1521f69 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.6/net-dlink-handle-copy_thresh-allocation-failure.patch new file mode 100644 index 0000000000..3f7c79bf1a --- /dev/null +++ b/queue-6.6/net-dlink-handle-copy_thresh-allocation-failure.patch @@ -0,0 +1,56 @@ +From 102c9e208a029849d02a46949c548c735f657a7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 04:01:24 +0900 +Subject: net: dlink: handle copy_thresh allocation failure + +From: Yeounsu Moon + +[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] + +The driver did not handle failure of `netdev_alloc_skb_ip_align()`. +If the allocation failed, dereferencing `skb->protocol` could lead to +a NULL pointer dereference. + +This patch tries to allocate `skb`. If the allocation fails, it falls +back to the normal path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Jakub Kicinski +Tested-on: D-Link DGE-550T Rev-A3 +Signed-off-by: Yeounsu Moon +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index f1208591ed67e..1c3a5cf379cd0 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -954,15 +954,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +-- +2.51.0 + diff --git a/queue-6.6/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.6/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch new file mode 100644 index 0000000000..b2171969b1 --- /dev/null +++ b/queue-6.6/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch @@ -0,0 +1,61 @@ +From 8bc3d7bb96466fb841d2f9ee48f1522332a25c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:02:22 +0900 +Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is + not configurable + +From: Kohei Enju + +[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ] + +In EC2 instances where the RSS hash key is not configurable, ethtool +shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally +returns ENA_HASH_KEY_SIZE. + +Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not +supported") added proper handling for devices that don't support RSS +hash key configuration, but ena_get_rxfh_key_size() has been unchanged. + +When the RSS hash key is not configurable, return 0 instead of +ENA_HASH_KEY_SIZE to clarify getting the value is not supported. + +Tested on m5 instance families. + +Without patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 + +With patch: + # ethtool -x ens5 | grep -A 1 "RSS hash key" + RSS hash key: + Operation not supported + +Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index d901877544445..82a7c52fdb721 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -752,7 +752,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +-- +2.51.0 + diff --git a/queue-6.6/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.6/net-mlx5-fw-reset-add-reset-timeout-work.patch new file mode 100644 index 0000000000..789a93deee --- /dev/null +++ b/queue-6.6/net-mlx5-fw-reset-add-reset-timeout-work.patch @@ -0,0 +1,97 @@ +From c78919b2fc145b6f65779e0082be429048d12325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:09 +0300 +Subject: net/mlx5: fw reset, add reset timeout work + +From: Moshe Shemesh + +[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ] + +Add sync reset timeout to stop poll_sync_reset in case there was no +reset done or abort event within timeout. Otherwise poll sync reset will +just continue and in case of fw fatal error no health reporting will be +done. + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 1547704c89767..4d64d179b5dd7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -27,6 +27,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + u8 reset_method; + struct timer_list timer; +@@ -257,6 +258,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -327,6 +330,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -700,6 +708,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -783,6 +804,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + static const struct devlink_param mlx5_fw_reset_devlink_params[] = { +@@ -826,6 +848,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +-- +2.51.0 + diff --git a/queue-6.6/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.6/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch new file mode 100644 index 0000000000..b7ae110f79 --- /dev/null +++ b/queue-6.6/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch @@ -0,0 +1,57 @@ +From af819245cde0a6c666b7fba1392c6c03c3e8485d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:08 +0300 +Subject: net/mlx5: pagealloc: Fix reclaim race during command interface + teardown + +From: Shay Drory + +[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ] + +The reclaim_pages_cmd() function sends a command to the firmware to +reclaim pages if the command interface is active. + +A race condition can occur if the command interface goes down (e.g., due +to a PCI error) while the mlx5_cmd_do() call is in flight. In this +case, mlx5_cmd_do() will return an error. The original code would +propagate this error immediately, bypassing the software-based page +reclamation logic that is supposed to run when the command interface is +down. + +Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark +that command interface is down. If this is the case, fall through to +the software reclamation path. If the command failed for any another +reason, or finished successfully, return as before. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index e0581c6f9cecd..5df1472fe2be2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +-- +2.51.0 + diff --git a/queue-6.6/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.6/net-mlx5-stop-polling-for-command-response-if-interf.patch new file mode 100644 index 0000000000..f1ac4a9607 --- /dev/null +++ b/queue-6.6/net-mlx5-stop-polling-for-command-response-if-interf.patch @@ -0,0 +1,53 @@ +From 65d2f00b0f4ccfdbe3c9f3242fd25cccd8fe38a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 00:02:07 +0300 +Subject: net/mlx5: Stop polling for command response if interface goes down + +From: Moshe Shemesh + +[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ] + +Stop polling on firmware response to command in polling mode if the +command interface got down. This situation can occur, for example, if a +firmware fatal error is detected during polling. + +This change halts the polling process when the command interface goes +down, preventing unnecessary waits. + +Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") +Signed-off-by: Moshe Shemesh +Reviewed-by: Shay Drori +Signed-off-by: Tariq Toukan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 5a2126679415c..336e0a54b3dc2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1059,7 +1063,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +-- +2.51.0 + diff --git a/queue-6.6/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.6/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch new file mode 100644 index 0000000000..04032dd3dc --- /dev/null +++ b/queue-6.6/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch @@ -0,0 +1,69 @@ +From 5b7b3b40c2f8c9b0354ffcdeccd47855f619bccc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 19:13:50 +0530 +Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast + +From: I Viswanath + +[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] + +syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. +This is the sequence of events that leads to the warning: + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); +} + +rtl8150_set_multicast() { + netif_stop_queue(); + netif_wake_queue(); <-- wakes up TX queue before URB is done +} + +rtl8150_start_xmit() { + netif_stop_queue(); + usb_submit_urb(dev->tx_urb); <-- double submission +} + +rtl8150_set_multicast being the ndo_set_rx_mode callback should not be +calling netif_stop_queue and notif_start_queue as these handle +TX queue synchronization. + +The net core function dev_set_rx_mode handles the synchronization +for rtl8150_set_multicast making it safe to remove these locks. + +Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Tested-by: Michal Pecio +Signed-off-by: I Viswanath +Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/rtl8150.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98e..92add3daadbb1 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +-- +2.51.0 + diff --git a/queue-6.6/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.6/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch new file mode 100644 index 0000000000..c01e1e08ef --- /dev/null +++ b/queue-6.6/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch @@ -0,0 +1,68 @@ +From 39aacb2d3b08438b72dc0b409dbe2c50a4f68c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 16:36:21 +0800 +Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region + +From: Zhen Ni + +[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ] + +Since the ahash_region() macro was redefined to calculate the region +index solely from HTABLE_REGION_BITS, the htable_bits parameter became +unused. + +Remove the unused htable_bits argument and its call sites, simplifying +the code without changing semantics. + +Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types") +Signed-off-by: Zhen Ni +Reviewed-by: Phil Sutter +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index c2d88b1b06b87..20b223e6e93b9 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -62,7 +62,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -701,7 +701,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -851,7 +851,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1049,7 +1049,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +-- +2.51.0 + diff --git a/queue-6.6/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.6/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch new file mode 100644 index 0000000000..23b61d0508 --- /dev/null +++ b/queue-6.6/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch @@ -0,0 +1,41 @@ +From be2328575ffa5d42fd3e55c62e199ff4603e62f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:42:15 +0900 +Subject: nfp: fix RSS hash key size when RSS is not supported + +From: Kohei Enju + +[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ] + +The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when +devices don't support RSS, and callers treat the negative value as a +large positive value since the return type is u32. + +Return 0 when devices don't support RSS, aligning with the ethtool +interface .get_rxfh_key_size() that requires returning 0 in such cases. + +Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") +Signed-off-by: Kohei Enju +Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index e75cbb287625f..87383f9d09ce3 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1413,7 +1413,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +-- +2.51.0 + diff --git a/queue-6.6/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.6/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch new file mode 100644 index 0000000000..0d1c188ecd --- /dev/null +++ b/queue-6.6/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch @@ -0,0 +1,50 @@ +From fa740de26c63bc8462123ec7d8c0b5234f88166c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 11:00:46 +0200 +Subject: NFSv4.1: fix backchannel max_resp_sz verification check + +From: Anthony Iliopoulos + +[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ] + +When the client max_resp_sz is larger than what the server encodes in +its reply, the nfs4_verify_back_channel_attrs() check fails and this +causes nfs4_proc_create_session() to fail, in cases where the client +page size is larger than that of the server and the server does not want +to negotiate upwards. + +While this is not a problem with the linux nfs server that will reflect +the proposed value in its reply irrespective of the local page size, +other nfs server implementations may insist on their own max_resp_sz +value, which could be smaller. + +Fix this by accepting smaller max_resp_sz values from the server, as +this does not violate the protocol. The server is allowed to decrease +but not increase proposed the size, and as such values smaller than the +client-proposed ones are valid. + +Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 124b9cee6fed7..94a1caf326699 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9226,7 +9226,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.6/null_blk-fix-the-description-of-the-cache_size-modul.patch new file mode 100644 index 0000000000..06d648124b --- /dev/null +++ b/queue-6.6/null_blk-fix-the-description-of-the-cache_size-modul.patch @@ -0,0 +1,56 @@ +From d40da6015e54d890a6e90449c3772b8c796a3eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Aug 2025 17:07:32 +0800 +Subject: null_blk: Fix the description of the cache_size module argument + +From: Genjian Zhang + +[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ] + +When executing modinfo null_blk, there is an error in the description +of module parameter mbps, and the output information of cache_size is +incomplete.The output of modinfo before and after applying this patch +is as follows: + +Before: +[...] +parm: cache_size:ulong +[...] +parm: mbps:Cache size in MiB for memory-backed device. + Default: 0 (none) (uint) +[...] + +After: +[...] +parm: cache_size:Cache size in MiB for memory-backed device. + Default: 0 (none) (ulong) +[...] +parm: mbps:Limit maximum bandwidth (in MiB/s). + Default: 0 (no limit) (uint) +[...] + +Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options") +Signed-off-by: Genjian Zhang +Reviewed-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 97ed3bd9707f4..2dd254c720f5f 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static unsigned int g_mbps; + module_param_named(mbps, g_mbps, uint, 0444); +-- +2.51.0 + diff --git a/queue-6.6/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.6/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch new file mode 100644 index 0000000000..294570f2f8 --- /dev/null +++ b/queue-6.6/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch @@ -0,0 +1,107 @@ +From 57f2cd8a9cd5c1df577482683acfc9d8dc3bfc2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 12:22:00 +0200 +Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Wagner + +[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ] + +It’s possible for more than one async command to be in flight from +__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. + +In the current code, only one put work item is queued at a time, which +results in a leaked reference. + +To fix this, move the work item to the nvmet_fc_ls_req_op struct, which +already tracks all resources related to the command. + +Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path") +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 570c58d2b5a58..a15e764bae35b 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.51.0 + diff --git a/queue-6.6/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.6/ocfs2-fix-double-free-in-user_cluster_connect.patch new file mode 100644 index 0000000000..c6b0fe9309 --- /dev/null +++ b/queue-6.6/ocfs2-fix-double-free-in-user_cluster_connect.patch @@ -0,0 +1,44 @@ +From 2e3a635c2bb032e88f4c61b618550a49cb0ced9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 14:26:07 +0300 +Subject: ocfs2: fix double free in user_cluster_connect() + +From: Dan Carpenter + +[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ] + +user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then +the error handling frees "lc" a second time. Set "lc" to NULL on this +path to avoid a double free. + +Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain +Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Reviewed-by: Goldwyn Rodrigues +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stack_user.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 9b76ee66aeb2f..38c0d6f64fce3 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +-- +2.51.0 + diff --git a/queue-6.6/once-fix-race-by-moving-do_once-to-separate-section.patch b/queue-6.6/once-fix-race-by-moving-do_once-to-separate-section.patch new file mode 100644 index 0000000000..4f22142173 --- /dev/null +++ b/queue-6.6/once-fix-race-by-moving-do_once-to-separate-section.patch @@ -0,0 +1,91 @@ +From 368b74cb2486b2d3ebb2fb9a01dd6b639f031674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 19:29:10 +0800 +Subject: once: fix race by moving DO_ONCE to separate section + +From: Qi Xi + +[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ] + +The commit c2c60ea37e5b ("once: use __section(".data.once")") moved +DO_ONCE's ___done variable to .data.once section, which conflicts with +DO_ONCE_LITE() that also uses the same section. + +This creates a race condition when clear_warn_once is used: + +Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) +__do_once_start + read ___done (false) + acquire once_lock +execute func +__do_once_done + write ___done (true) __do_once_start + release once_lock // Thread 3 clear_warn_once reset ___done + read ___done (false) + acquire once_lock + execute func +schedule once_work __do_once_done +once_deferred: OK write ___done (true) +static_branch_disable release once_lock + schedule once_work + once_deferred: + BUG_ON(!static_key_enabled) + +DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning +macros. Keep its ___done flag in the .data..once section and allow resetting +by clear_warn_once, as originally intended. + +In contrast, DO_ONCE() is used for functions like get_random_once() and +relies on its ___done flag for internal synchronization. We should not reset +DO_ONCE() by clear_warn_once. + +Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, +shielding it from clear_warn_once. + +Fixes: c2c60ea37e5b ("once: use __section(".data.once")") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 1 + + include/linux/once.h | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index cf3f8b9bf43f0..010ac18c05916 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -351,6 +351,7 @@ + __start_once = .; \ + *(.data..once) \ + __end_once = .; \ ++ *(.data..do_once) \ + STRUCT_ALIGN(); \ + *(__tracepoints) \ + /* implement dynamic printk debug */ \ +diff --git a/include/linux/once.h b/include/linux/once.h +index 30346fcdc7995..449a0e34ad5ad 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + unsigned long ___flags; \ +@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE_SLEEPABLE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_sleepable_start(&___done); \ +-- +2.51.0 + diff --git a/queue-6.6/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.6/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch new file mode 100644 index 0000000000..11911807d2 --- /dev/null +++ b/queue-6.6/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch @@ -0,0 +1,43 @@ +From 8e73719bed253cbcfbed2e2176489503a884121a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 08:04:08 -0700 +Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys + allocation + +From: Alok Tiwari + +[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ] + +Fix incorrect argument order in devm_kcalloc() when allocating port->phys. +The original call used sizeof(phy) as the number of elements and +port->lanes as the element size, which is reversed. While this happens to +produce the correct total allocation size with current pointer size and +lane counts, the argument order is wrong. + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Alok Tiwari +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 038d974a318ea..80d975dcb2ee2 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.6/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.6/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch new file mode 100644 index 0000000000..43617b4798 --- /dev/null +++ b/queue-6.6/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch @@ -0,0 +1,53 @@ +From 5853edc3eeab9f53c9fd4d2d73788753d2479821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 11:30:22 +0200 +Subject: PCI: tegra194: Fix duplicate PLL disable in + pex_ep_event_pex_rst_assert() + +From: Nagarjuna Kristam + +[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ] + +During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently +called twice. + +pex_ep_event_pex_rst_assert() should do the opposite of +pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate +tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate +tegra_pcie_bpmp_set_pll_state() call should instead be a call to +tegra_pcie_bpmp_set_ctrl_state(). + +With this, the uninitialization sequence also matches that of +tegra_pcie_unconfig_controller(). + +Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") +Signed-off-by: Nagarjuna Kristam +[cassel: improve commit log] +Signed-off-by: Niklas Cassel +Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org +[mani: added Fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 416d6b45d1fe8..115a21cf869ae 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1734,9 +1734,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +-- +2.51.0 + diff --git a/queue-6.6/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.6/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch new file mode 100644 index 0000000000..94973bab24 --- /dev/null +++ b/queue-6.6/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch @@ -0,0 +1,37 @@ +From 96d52ed1f6196078c3e3516c9088fd96c1547f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 18:41:39 +0100 +Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() + +From: Leo Yan + +[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] + +Cast nr_pages to unsigned long to avoid overflow when handling large +AUX buffer sizes (>= 2 GiB). + +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Leo Yan +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 2bec2e3af0bd6..affa78376b6a8 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -96,7 +96,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +-- +2.51.0 + diff --git a/queue-6.6/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch b/queue-6.6/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch new file mode 100644 index 0000000000..74623a7024 --- /dev/null +++ b/queue-6.6/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch @@ -0,0 +1,69 @@ +From 4e08d35e41c43c44fe2c7e971c43c85bcccd19ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 07:23:22 +0000 +Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 + +From: Jonas Karlman + +[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ] + +The boot firmware may disable the U3 port early during boot and leave it +up to the controller or PHY driver to re-enable U3 when needed. + +The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, +something the Rockchip Naneng Combo PHY driver never does for RK3568. +This may result in USB 3.0 ports being limited to only using USB 2.0 or +in special cases not working at all on RK3568. + +Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled +when a PHY with PHY_TYPE_USB3 mode is used. + +Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index 2354ce8b21594..9ef496092b7e6 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg { + struct combphy_reg pipe_xpcs_phy_ready; + struct combphy_reg pipe_pcie1l0_sel; + struct combphy_reg pipe_pcie1l1_sel; ++ struct combphy_reg u3otg0_port_en; ++ struct combphy_reg u3otg1_port_en; + }; + + struct rockchip_combphy_cfg { +@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); ++ switch (priv->id) { ++ case 0: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); ++ break; ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); ++ break; ++ } + break; + + case PHY_TYPE_SATA: +@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + /* pipe-grf */ + .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, + .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, ++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, ++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { +-- +2.51.0 + diff --git a/queue-6.6/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.6/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch new file mode 100644 index 0000000000..aea9e096c0 --- /dev/null +++ b/queue-6.6/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch @@ -0,0 +1,67 @@ +From cf287ada592b45876f1ffaaae9a6803207b8d6be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 19:33:34 -0400 +Subject: pinctrl: meson-gxl: add missing i2c_d pinmux + +From: Da Xue + +[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ] + +Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11. + +Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D. + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Da Xue +Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 51408996255bd..e2601e45935e6 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +-- +2.51.0 + diff --git a/queue-6.6/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.6/pinctrl-renesas-use-int-type-to-store-negative-error.patch new file mode 100644 index 0000000000..944dc2c16a --- /dev/null +++ b/queue-6.6/pinctrl-renesas-use-int-type-to-store-negative-error.patch @@ -0,0 +1,42 @@ +From a979b474c33f1876ca17d39087e5376f63536023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Aug 2025 16:49:58 +0800 +Subject: pinctrl: renesas: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ] + +Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned +int to int, as it needs to store either negative error codes or zero +returned by sh_pfc_pinconf_set(). + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config") +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pinctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 4d9d58fc1356f..852e179f9e383 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -730,7 +730,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +-- +2.51.0 + diff --git a/queue-6.6/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.6/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch new file mode 100644 index 0000000000..c9a7d51291 --- /dev/null +++ b/queue-6.6/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch @@ -0,0 +1,40 @@ +From 2c53490f0ce7a2cceebe20938f5ca2622a349189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:58:23 +0300 +Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in + probe() + +From: Dan Carpenter + +[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ] + +The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which +would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check +that the pointer is valid. + +Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") +Signed-off-by: Dan Carpenter +Signed-off-by: Chanwoo Choi +Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + drivers/devfreq/mtk-cci-devfreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index 83a73f0ccd803..eff9b2c06aef4 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +-- +2.51.0 + diff --git a/queue-6.6/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.6/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch new file mode 100644 index 0000000000..37e94b32c9 --- /dev/null +++ b/queue-6.6/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch @@ -0,0 +1,67 @@ +From 2d26aeed8a89f8c3debf501f6c4c0a117787ebf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:55:45 +0200 +Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path + +From: Rafael J. Wysocki + +[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ] + +If system suspend is aborted in the "noirq" phase (for instance, due to +an error returned by one of the device callbacks), power.is_noirq_suspended +will not be set for some devices and device_resume_noirq() will return +early for them. Consequently, noirq resume callbacks will not run for +them at all because the noirq suspend callbacks have not run for them +yet. + +If any of them has power.must_resume set and late suspend has been +skipped for it (due to power.smart_suspend), early resume should be +skipped for it either, or its state may become inconsistent (for +instance, if the early resume assumes that it will always follow +noirq resume). + +Make that happen by clearing power.must_resume in device_resume_noirq() +for devices with power.is_noirq_suspended clear that have been left in +suspend by device_suspend_late(), which will subsequently cause +device_resume_early() to leave the device in suspend and avoid +changing its state. + +Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") +Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index baa31194cf20d..ef5157fc8dcc5 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +-- +2.51.0 + diff --git a/queue-6.6/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.6/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch new file mode 100644 index 0000000000..5013826cd1 --- /dev/null +++ b/queue-6.6/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch @@ -0,0 +1,37 @@ +From f2ebb9bc0a0c3c2103550878be78847802e572c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Aug 2025 20:32:59 +0800 +Subject: power: supply: cw2015: Fix a alignment coding style issue + +From: Andy Yan + +[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ] + +Fix the checkpatch warning: +CHECK: Alignment should match open parenthesis + +Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") +Signed-off-by: Andy Yan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index 99f3ccdc30a6a..434e3233c9f8c 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +-- +2.51.0 + diff --git a/queue-6.6/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.6/pps-fix-warning-in-pps_register_cdev-when-register-d.patch new file mode 100644 index 0000000000..4e576c0f45 --- /dev/null +++ b/queue-6.6/pps-fix-warning-in-pps_register_cdev-when-register-d.patch @@ -0,0 +1,115 @@ +From 5376f410b2d2fb0b5326dea5c6534b36ede0046b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Aug 2025 15:50:23 +0800 +Subject: pps: fix warning in pps_register_cdev when register device fail + +From: Wang Liang + +[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ] + +Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error +handling in __video_register_device()"), the release hook should be set +before device_register(). Otherwise, when device_register() return error +and put_device() try to callback the release function, the below warning +may happen. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 + Modules linked in: + CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE + RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 + Call Trace: + + kobject_cleanup+0x136/0x410 lib/kobject.c:689 + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0xe9/0x130 lib/kobject.c:737 + put_device+0x24/0x30 drivers/base/core.c:3797 + pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 + pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 + pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 + tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 + tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 + tiocsetd drivers/tty/tty_io.c:2429 [inline] + tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:598 [inline] + __se_sys_ioctl fs/ioctl.c:584 [inline] + __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + +Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), +pps_register_cdev() call device_create() to create pps->dev, which will +init dev->release to device_create_release(). Now the comment is outdated, +just remove it. + +Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed +in pps_register_source() to avoid a double free in the failure case. + +Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ +Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") +Signed-off-by: Wang Liang +Reviewed-By: Calvin Owens +Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pps/kapi.c | 5 +---- + drivers/pps/pps.c | 5 ++--- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d..e9389876229ea 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index e1689957736d9..9539695b337a8 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +-- +2.51.0 + diff --git a/queue-6.6/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.6/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch new file mode 100644 index 0000000000..802c0abba1 --- /dev/null +++ b/queue-6.6/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch @@ -0,0 +1,53 @@ +From cc809f2cff2340c8de11f36b6cd8cf90b858e1ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 18:01:02 +0200 +Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ] + +The function set_prescale_div() is responsible for calculating the clock +divisor settings such that the input clock rate is divided down such that +the required period length is at most 0x10000 clock ticks. If period_cycles +is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is +good enough. So round up in the calculation of the required divisor and +compare it using >= instead of >. + +Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tiehrpwm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index ecbfd7e954ecb..d693b2d65cccf 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.6/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch new file mode 100644 index 0000000000..270f04b59d --- /dev/null +++ b/queue-6.6/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch @@ -0,0 +1,44 @@ +From 540ac4a9936dcd0294827f9a5e83af1086db8e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Sep 2025 12:05:20 +0200 +Subject: RDMA/cm: Rate limit destroy CM ID timeout error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ] + +When the destroy CM ID timeout kicks in, you typically get a storm of +them which creates a log flooding. Hence, change pr_err() to +pr_err_ratelimited() in cm_destroy_id_wait_timeout(). + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: HÃ¥kon Bugge +Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index d45e3909dafe1..50bb3c43f40bf 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +-- +2.51.0 + diff --git a/queue-6.6/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.6/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch new file mode 100644 index 0000000000..e2237108e6 --- /dev/null +++ b/queue-6.6/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch @@ -0,0 +1,53 @@ +From 52f4dbda2464731bfa9e215716211cc921d31117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 14:11:01 +0300 +Subject: RDMA/core: Resolve MAC of next-hop device without ARP support + +From: Parav Pandit + +[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ] + +Currently, if the next-hop netdevice does not support ARP resolution, +the destination MAC address is silently set to zero without reporting +an error. This leads to incorrect behavior and may result in packet +transmission failures. + +Fix this by deferring MAC resolution to the IP stack via neighbour +lookup, allowing proper resolution or error reporting as appropriate. + +Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)") +Signed-off-by: Parav Pandit +Reviewed-by: Vlad Dumitrescu +Signed-off-by: Edward Srouji +Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index f20dfe70fa0e4..8bf705921618c 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.6/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/queue-6.6/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch new file mode 100644 index 0000000000..e886fb7f91 --- /dev/null +++ b/queue-6.6/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch @@ -0,0 +1,117 @@ +From 940c1e857bb002579847d6a7e723eaf5a95b43a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:41:19 +0300 +Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device + +From: Patrisious Haddad + +[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ] + +Previously loopback for MPV was supposed to be permanently enabled, +however other driver flows were able to over-ride that configuration and +disable it. + +Add force_lb parameter that indicates that loopback should always be +enabled which prevents all other driver flows from disabling it. + +Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") +Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++---- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index e922fb8728654..0adb98b8dacc8 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1691,7 +1691,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + } + + static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + int err; + +@@ -1703,6 +1704,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + if (err) + goto out; + ++ lb_state->force_enable = true; + return 0; + + out: +@@ -1711,16 +1713,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + } + + static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + mlx5_nic_vport_update_local_lb(slave, false); + mlx5_nic_vport_update_local_lb(master, false); ++ ++ lb_state->force_enable = false; + } + + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; + ++ if (dev->lb.force_enable) ++ return 0; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td++; +@@ -1742,6 +1750,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + + void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { ++ if (dev->lb.force_enable) ++ return; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td--; +@@ -3251,7 +3262,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + +- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + + mlx5_core_mp_event_replay(ibdev->mdev, + MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, +@@ -3348,7 +3359,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + MLX5_DRIVER_EVENT_AFFILIATION_DONE, + &key); + +- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + if (err) + goto unbind; + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 94678e5c59dd5..9b780f48a382b 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1065,6 +1065,7 @@ struct mlx5_ib_lb_state { + u32 user_td; + int qps; + bool enabled; ++ bool force_enable; + }; + + struct mlx5_ib_pf_eq { +-- +2.51.0 + diff --git a/queue-6.6/rdma-rxe-fix-race-in-do_task-when-draining.patch b/queue-6.6/rdma-rxe-fix-race-in-do_task-when-draining.patch new file mode 100644 index 0000000000..3e8661f756 --- /dev/null +++ b/queue-6.6/rdma-rxe-fix-race-in-do_task-when-draining.patch @@ -0,0 +1,62 @@ +From 20b6d0c887c79bf3835319af4096e837d1130134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 02:52:12 +0000 +Subject: RDMA/rxe: Fix race in do_task() when draining + +From: Gui-Dong Han + +[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ] + +When do_task() exhausts its iteration budget (!ret), it sets the state +to TASK_STATE_IDLE to reschedule, without a secondary check on the +current task->state. This can overwrite the TASK_STATE_DRAINING state +set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). + +While state changes are protected by a spinlock, both rxe_cleanup_task() +and rxe_disable_task() release the lock while waiting for the task to +finish draining in the while(!is_done(task)) loop. The race occurs if +do_task() hits its iteration limit and acquires the lock in this window. +The cleanup logic may then proceed while the task incorrectly +reschedules itself, leading to a potential use-after-free. + +This bug was introduced during the migration from tasklets to workqueues, +where the special handling for the draining case was lost. + +Fix this by restoring the original pre-migration behavior. If the state is +TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to +force a new loop iteration. This allows the task to finish its work, so +that a subsequent iteration can reach the switch statement and correctly +transition the state to TASK_STATE_DRAINED, stopping the task as intended. + +Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks") +Reviewed-by: Zhu Yanjun +Signed-off-by: Gui-Dong Han +Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 80332638d9e3a..be6cd8ce4d97e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) + * yield the cpu and reschedule the task + */ + if (!ret) { +- task->state = TASK_STATE_IDLE; +- resched = 1; ++ if (task->state != TASK_STATE_DRAINING) { ++ task->state = TASK_STATE_IDLE; ++ resched = 1; ++ } else { ++ cont = 1; ++ } + goto exit; + } + +-- +2.51.0 + diff --git a/queue-6.6/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.6/rdma-siw-always-report-immediate-post-sq-errors.patch new file mode 100644 index 0000000000..67f5ed288a --- /dev/null +++ b/queue-6.6/rdma-siw-always-report-immediate-post-sq-errors.patch @@ -0,0 +1,85 @@ +From 8b8d890e3659ba89f1a065a3ffe38e966b0eef5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Sep 2025 16:45:36 +0200 +Subject: RDMA/siw: Always report immediate post SQ errors + +From: Bernard Metzler + +[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ] + +In siw_post_send(), any immediate error encountered during processing of +the work request list must be reported to the caller, even if previous +work requests in that list were just accepted and added to the send queue. + +Not reporting those errors confuses the caller, which would wait +indefinitely for the failing and potentially subsequently aborted work +requests completion. + +This fixes a case where immediate errors were overwritten by subsequent +code in siw_post_send(). + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev +Suggested-by: Stefan Metzmacher +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index fdbef3254e308..1768b8695c45a 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +-- +2.51.0 + diff --git a/queue-6.6/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.6/regmap-remove-superfluous-check-for-config-in-__regm.patch new file mode 100644 index 0000000000..bcf96b7cef --- /dev/null +++ b/queue-6.6/regmap-remove-superfluous-check-for-config-in-__regm.patch @@ -0,0 +1,37 @@ +From a7dc8a65060530cb4f4662aeee9247b1ffc2ad1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 15:07:18 +0200 +Subject: regmap: Remove superfluous check for !config in __regmap_init() + +From: Geert Uytterhoeven + +[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ] + +The first thing __regmap_init() do is check if config is non-NULL, +so there is no need to check for this again later. + +Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config") +Signed-off-by: Geert Uytterhoeven +Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1209e01f8c7f9..9603c28a3ed82 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +-- +2.51.0 + diff --git a/queue-6.6/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.6/regulator-scmi-use-int-type-to-store-negative-error-.patch new file mode 100644 index 0000000000..4c0c61948f --- /dev/null +++ b/queue-6.6/regulator-scmi-use-int-type-to-store-negative-error-.patch @@ -0,0 +1,46 @@ +From 70d6f21663b342e1e89b16eeb187f05739f16bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 18:14:11 +0800 +Subject: regulator: scmi: Use int type to store negative error codes + +From: Qianfeng Rong + +[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ] + +Change the 'ret' variable from u32 to int to store negative error codes or +zero returned by of_property_read_u32(). + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. Additionally, assigning negative error +codes to unsigned type may trigger a GCC warning when the -Wsign-conversion +flag is enabled. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Reviewed-by: Sudeep Holla +Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") +Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/scmi-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 29ab217297d6d..432654fbd7a12 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +-- +2.51.0 + diff --git a/queue-6.6/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.6/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch new file mode 100644 index 0000000000..fe9e2550fa --- /dev/null +++ b/queue-6.6/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch @@ -0,0 +1,49 @@ +From 41d7008129f496442a7d56c7753112a786e99b39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 18:02:33 +0200 +Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice + +From: Stephan Gerhold + +[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ] + +enable_irq() and disable_irq() are reference counted, so we must make sure +that each enable_irq() is always paired with a single disable_irq(). If we +call disable_irq() twice followed by just a single enable_irq(), the IRQ +will remain disabled forever. + +For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() +will end up being called twice, because disable_irq() also happens in +qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare(). + +Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since +qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more +sense to have the rollback handled always by qcom_q6v5_unprepare(). + +Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 4ee5e67a9f03f..769c6d6d6a731 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +-- +2.51.0 + diff --git a/queue-6.6/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.6/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch new file mode 100644 index 0000000000..b26769fb68 --- /dev/null +++ b/queue-6.6/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch @@ -0,0 +1,114 @@ +From b0ae8aee8137941e83da39613b8762c6394880e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:15:29 -0700 +Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" + +From: Jakub Kicinski + +[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ] + +This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. + +Commit in question breaks the mapping of PGs to pools for some SKUs. +Specifically multi-host NICs seem to be shipped with a custom buffer +configuration which maps the lossy PG to pool 4. But the bad commit +overrides this with pool 0 which does not have sufficient buffer space +reserved. Resulting in ~40% packet loss. The commit also breaks BMC / +OOB connection completely (100% packet loss). + +Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and +set Xon/Xoff upon port speed set""). The breakage is exactly the same, +the only difference is that quoted commit would break the NIC immediately +on boot, and the currently reverted commit only when MTU is changed. + +Note: "good" kernels do not restore the configuration, so downgrade isn't +enough to recover machines. A NIC power cycle seems to be necessary to +return to a healthy state (or overriding the relevant registers using +a custom patch). + +Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ + .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- + 2 files changed, 1 insertion(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 66d276a1be836..f4a19ffbb641c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 09ba60b2e744b..5c6f01abdcb91 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -44,7 +44,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2723,11 +2722,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2737,18 +2734,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +-- +2.51.0 + diff --git a/queue-6.6/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.6/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch new file mode 100644 index 0000000000..42c2cd1bbc --- /dev/null +++ b/queue-6.6/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch @@ -0,0 +1,71 @@ +From dbdbcc87489b6c7aa5e85fb8c6031b2fde37b634 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 00:07:20 +0300 +Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint + seems Running" + +From: Michal Pecio + +[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ] + +This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3. + +No actual HW bugs are known where Endpoint Context shows Running state +but Stop Endpoint fails repeatedly with Context State Error and leaves +the endpoint state unchanged. Stop Endpoint retries on Running EPs have +been performed since early 2021 with no such issues reported so far. + +Trying to handle this hypothetical case brings a more realistic danger: +if Stop Endpoint fails on an endpoint which hasn't yet started after a +doorbell ring and enough latency occurs before this completion event is +handled, the driver may time out and begin removing cancelled TDs from +a running endpoint, even though one more retry would stop it reliably. + +Such high latency is rare but not impossible, and removing TDs from a +running endpoint can cause more damage than not giving back a cancelled +URB (which wasn't happening anyway). So err on the side of caution and +revert to the old policy of always retrying if the EP appears running. + +[Remove stable tag as we are dealing with theoretical cases -Mathias] + +Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running") +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index a21ac9d80275f..6443e11eaac04 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1224,19 +1224,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +-- +2.51.0 + diff --git a/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch b/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch new file mode 100644 index 0000000000..506dbc115a --- /dev/null +++ b/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch @@ -0,0 +1,77 @@ +From 74dfe6acd15cd6587d1244674e9452bd495b55d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:29 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL + +From: Ilya Leoshkevich + +[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ] + +The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is +as follows: + + entry() + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + subprog_tail() + bpf_tail_call_static(0) -> entry + tail_call_start + +entry() copies its tail call counter to the subprog_tail()'s frame, +which then increments it. However, the incremented result is discarded, +leading to an astronomically large number of tail calls. + +Fix by writing the incremented counter back to the entry()'s frame. + +Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 2d8facfd4e425..31a4bbd2e7dc4 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1425,13 +1425,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + jit->seen |= SEEN_FUNC; + /* + * Copy the tail call counter to where the callee expects it. +- * +- * Note 1: The callee can increment the tail call counter, but +- * we do not load it back, since the x86 JIT does not do this +- * either. +- * +- * Note 2: We assume that the verifier does not let us call the +- * main program, which clears the tail call counter on entry. + */ + /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */ + _EMIT6(0xd203f000 | STK_OFF_TCCNT, +@@ -1457,6 +1450,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + call_r1(jit); + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); ++ ++ /* ++ * Copy the potentially updated tail call counter back. ++ */ ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc frame_off+tail_call_cnt(%r15), ++ * tail_call_cnt(4,%r15) ++ */ ++ _EMIT6(0xd203f000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt)), ++ 0xf000 | offsetof(struct prog_frame, ++ tail_call_cnt)); ++ + break; + } + case BPF_JMP | BPF_TAIL_CALL: { +-- +2.51.0 + diff --git a/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch b/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch new file mode 100644 index 0000000000..fd82dcc446 --- /dev/null +++ b/queue-6.6/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch @@ -0,0 +1,52 @@ +From 893445b9a191c634c2e59e7a3f7f182ea3e9076b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Aug 2025 14:06:30 +0200 +Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG + +From: Ilya Leoshkevich + +[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ] + +The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call +graph is as follows: + + entry() + subprog_tail() + trampoline() + fentry() + the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG + return to entry() + +The problem is that the rest of subprog_tail() increments the tail call +counter, but the trampoline discards the incremented value. This +results in an astronomically large number of tail calls. + +Fix by making the trampoline write the incremented tail call counter +back. + +Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 31a4bbd2e7dc4..fe0354ad3bb96 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -2442,6 +2442,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r2,retval_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, + tjit->retval_off); ++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ ++ _EMIT6(0xd203f000 | tjit->tccnt_off, ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + + im->ip_after_call = jit->prg_buf + jit->prg; + +-- +2.51.0 + diff --git a/queue-6.6/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.6/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch new file mode 100644 index 0000000000..0f4a33cccf --- /dev/null +++ b/queue-6.6/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch @@ -0,0 +1,90 @@ +From 75e05ab8edeca46e3c8f6c82603792678b5c9679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 15:21:10 +0530 +Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() + +From: Ranjan Kumar + +[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] + +During mpt3sas_transport_port_remove(), messages were logged with +dev_printk() against &mpt3sas_port->port->dev. At this point the SAS +transport device may already be partially unregistered or freed, leading +to a crash when accessing its struct device. + +Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), +guaranteed to remain valid until driver removal. + +[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI +[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) +[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 +[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 +[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff +[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 +[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 +[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 +[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 +[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 +[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 +[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 +[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 +[83428.295844] PKRU: 55555554 +[83428.295846] Call Trace: +[83428.295848] +[83428.295850] _dev_printk+0x5c/0x80 +[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] +[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] +[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] +[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] +[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] +[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] +[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] +[83428.295957] pci_device_remove+0x3b/0xb0 +[83428.295962] device_release_driver_internal+0x193/0x200 +[83428.295968] driver_detach+0x44/0x90 +[83428.295971] bus_remove_driver+0x69/0xf0 +[83428.295975] pci_unregister_driver+0x2a/0xb0 +[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] +[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 +[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296000] ? __x64_sys_getdents64+0x9a/0x110 +[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296009] ? syscall_trace_enter+0xf6/0x1b0 +[83428.296014] do_syscall_64+0x7b/0x2c0 +[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 +[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Ranjan Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index e8a4750f6ec47..7d6e4fe31ceed 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +-- +2.51.0 + diff --git a/queue-6.6/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.6/scsi-myrs-fix-dma_alloc_coherent-error-check.patch new file mode 100644 index 0000000000..533a0f65ff --- /dev/null +++ b/queue-6.6/scsi-myrs-fix-dma_alloc_coherent-error-check.patch @@ -0,0 +1,63 @@ +From 14c87c928faef3a2fed6703250ded7940b713e18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 10:31:06 +0200 +Subject: scsi: myrs: Fix dma_alloc_coherent() error check + +From: Thomas Fourier + +[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ] + +Check for NULL return value with dma_alloc_coherent(), because DMA +address is not always set by dma_alloc_coherent() on failure. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Signed-off-by: Thomas Fourier +Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index e824be9d9bbb9..9075836ccc3e2 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +-- +2.51.0 + diff --git a/queue-6.6/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.6/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch new file mode 100644 index 0000000000..7c9b0aa2e4 --- /dev/null +++ b/queue-6.6/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch @@ -0,0 +1,79 @@ +From 397f064752ce8b4ea8444eb5572595b255adafb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Aug 2025 19:32:17 +0200 +Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod + +From: Niklas Cassel + +[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ] + +Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when +device is gone") UBSAN reports: + + UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 + index 28 is out of range for type 'pm8001_phy [16]' + +on rmmod when using an expander. + +For a direct attached device, attached_phy contains the local phy id. +For a device behind an expander, attached_phy contains the remote phy +id, not the local phy id. + +I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a +device behind an expander, attached_phy can be much larger than +pm8001_ha->chip->n_phy (depending on the amount of phys of the +expander). + +E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the +ports has an expander connected. The expander has 31 phys with phy ids +0-30. + +The pm8001_ha->phy array only contains the phys of the HBA. It does not +contain the phys of the expander. Thus, it is wrong to use attached_phy +to index the pm8001_ha->phy array for a device behind an expander. + +Thus, we can only clear phy_attached for devices that are directly +attached. + +Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") +Reviewed-by: Igor Pylypiv +Signed-off-by: Niklas Cassel +Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index a9d6dac413346..4daab8b6d6752 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.6/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch new file mode 100644 index 0000000000..55d9004f1c --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch @@ -0,0 +1,47 @@ +From 56c3f4d3dae9f04810fa8563c6ab6e696147292d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:43 +0800 +Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code + +From: Qianfeng Rong + +[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ] + +Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and +qla_edif_process_els() to align with qla2x00_start_sp() returning +negative error codes or QLA_SUCCESS, preventing logical errors. + +Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index dcde55c8ee5de..be20e2c457b8e 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch b/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch new file mode 100644 index 0000000000..e976ad29ff --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch @@ -0,0 +1,39 @@ +From 7832c381d2eb1a6e42482edf452e6af211f90e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:45 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + qla_nvme_xmt_ls_rsp() + +From: Qianfeng Rong + +[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ] + +Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to +align with qla2x00_start_sp() returning negative error codes or +QLA_SUCCESS, preventing logical errors. + +Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 8f4cc136a9c9c..080670cb2aa51 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -420,7 +420,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(PURLS_MSLEEP_INTERVAL); + cnt++; + if (cnt < PURLS_RETRY_COUNT) +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch new file mode 100644 index 0000000000..311f596616 --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch @@ -0,0 +1,46 @@ +From 113aec37df5e24c0af9cad70fbd470fd8d948b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 15:54:44 +0800 +Subject: scsi: qla2xxx: Fix incorrect sign of error code in + START_SP_W_RETRIES() + +From: Qianfeng Rong + +[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ] + +Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align +with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, +preventing logical errors. Additionally, the '_rval' variable should +store negative error codes to conform to Linux kernel error code +conventions. + +Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") +Signed-off-by: Qianfeng Rong +Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5fa2727c1bea7..e881d704b45d1 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +-- +2.51.0 + diff --git a/queue-6.6/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.6/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch new file mode 100644 index 0000000000..63d2cc0057 --- /dev/null +++ b/queue-6.6/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch @@ -0,0 +1,78 @@ +From 696bf4fc1ef382cf9b13522cf63669bc5aa9f002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jul 2025 18:31:18 +0200 +Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too + fast + +From: Johannes Nixdorf + +[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ] + +Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an +event to the tracer, and starts to wait interruptibly. With +SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the +message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting +and is subsequently interrupted, the tracee begins to wait again +uninterruptibly (but killable). + +This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee +is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a +condition to begin waiting again. In this case the tracee is interrupted +even though the tracer already acted on its behalf. This breaks the +assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure, +namely that the tracer can be sure the syscall is not interrupted or +restarted on the tracee after it is received on the tracer. Fix this +by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to +switch to uninterruptible waiting. + +With the condition changed the loop in seccomp_do_user_notification() +would exit immediately after deciding that noninterruptible waiting +is required if the operation already reached SECCOMP_NOTIFY_REPLIED, +skipping the code that processes pending addfd commands first. Prevent +this by executing the remaining loop body one last time in this case. + +Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier") +Reported-by: Ali Polatel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291 +Signed-off-by: Johannes Nixdorf +Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + kernel/seccomp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 255999ba9190a..1d26a0e978f26 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1099,7 +1099,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1146,13 +1146,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +-- +2.51.0 + diff --git a/queue-6.6/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.6/selftests-arm64-check-fread-return-value-in-exec_tar.patch new file mode 100644 index 0000000000..c7cce5a46b --- /dev/null +++ b/queue-6.6/selftests-arm64-check-fread-return-value-in-exec_tar.patch @@ -0,0 +1,48 @@ +From 49e11754cc7bca29b9bc4636ea349e4d6e48fe5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 13:38:30 +0530 +Subject: selftests: arm64: Check fread return value in exec_target + +From: Bala-Vignesh-Reddy + +[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ] + +Fix -Wunused-result warning generated when compiled with gcc 13.3.0, +by checking fread's return value and handling errors, preventing +potential failures when reading from stdin. + +Fixes compiler warning: +warning: ignoring return value of 'fread' declared with attribute +'warn_unused_result' [-Wunused-result] + +Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys") + +Signed-off-by: Bala-Vignesh-Reddy +Reviewed-by: Mark Brown +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400d..e597861b26d6b 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +-- +2.51.0 + diff --git a/queue-6.6/selftests-nolibc-fix-expect_nz-macro.patch b/queue-6.6/selftests-nolibc-fix-expect_nz-macro.patch new file mode 100644 index 0000000000..9b517510c3 --- /dev/null +++ b/queue-6.6/selftests-nolibc-fix-expect_nz-macro.patch @@ -0,0 +1,42 @@ +From 92124c4c428da63bfdf5ecc5f69b6e358536d95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 22:12:22 +0200 +Subject: selftests/nolibc: fix EXPECT_NZ macro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benjamin Berg + +[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ] + +The expect non-zero macro was incorrect and never used. Fix its +definition. + +Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests") +Signed-off-by: Benjamin Berg +Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index 4aaafbfc2f973..a019de995e5df 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -176,8 +176,8 @@ int expect_zr(int expr, int llen) + } + + +-#define EXPECT_NZ(cond, expr, val) \ +- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) ++#define EXPECT_NZ(cond, expr) \ ++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) + + static __attribute__((unused)) + int expect_nz(int expr, int llen) +-- +2.51.0 + diff --git a/queue-6.6/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.6/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch new file mode 100644 index 0000000000..e86da16508 --- /dev/null +++ b/queue-6.6/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch @@ -0,0 +1,67 @@ +From 5c60d99199563b740403b20a0c86ea6338ec787b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Sep 2025 20:58:41 +0530 +Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not + supported + +From: Akhilesh Patil + +[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ] + +Check if watchdog device supports WDIOF_KEEPALIVEPING option before +entering keep_alive() ping test loop. Fix watchdog-test silently looping +if ioctl based ping is not supported by the device. Exit from test in +such case instead of getting stuck in loop executing failing keep_alive() + +watchdog_info: + identity: m41t93 rtc Watchdog + firmware_version: 0 +Support/Status: Set timeout (in seconds) +Support/Status: Watchdog triggers a management or other external alarm not a reboot + +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +WDIOC_KEEPALIVE not supported by this device + +without this change +Watchdog card disabled. +Watchdog timeout set to 5 seconds. +Watchdog ping rate set to 2 seconds. +Watchdog card enabled. +Watchdog Ticking Away! +(Where test stuck here forver silently) + +Updated change log at commit time: +Shuah Khan + +Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in +Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path") +Signed-off-by: Akhilesh Patil +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index a1f506ba55786..4f09c5db0c7f3 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* +-- +2.51.0 + diff --git a/queue-6.6/serial-max310x-add-error-checking-in-probe.patch b/queue-6.6/serial-max310x-add-error-checking-in-probe.patch new file mode 100644 index 0000000000..8803fe97b4 --- /dev/null +++ b/queue-6.6/serial-max310x-add-error-checking-in-probe.patch @@ -0,0 +1,36 @@ +From 3bc326a5b7ecc17e3693ae3abe60bb6dbc2a9e3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:54:37 +0300 +Subject: serial: max310x: Add error checking in probe() + +From: Dan Carpenter + +[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ] + +Check if devm_i2c_new_dummy_device() fails. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index e339abff926d3..e10dcdeeda2d3 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1659,6 +1659,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); + } +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series new file mode 100644 index 0000000000..94c2498bea --- /dev/null +++ b/queue-6.6/series @@ -0,0 +1,169 @@ +filelock-add-fl_reclaim-to-show_fl_flags-macro.patch +init-initramfs_preserve_mtime-should-depend-on-blk_d.patch +seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch +selftests-arm64-check-fread-return-value-in-exec_tar.patch +gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch +coresight-trbe-prevent-overflow-in-perf_idx2off.patch +perf-arm_spe-prevent-overflow-in-perf_idx2off.patch +smb-server-fix-ird-ord-negotiation-with-the-client.patch +edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch +x86-vdso-fix-output-operand-size-of-rdpid.patch +arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch +regmap-remove-superfluous-check-for-config-in-__regm.patch +bpf-selftests-fix-test_tcpnotify_user.patch +bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch +libbpf-fix-reuse-of-devmap.patch +arm-dts-renesas-porter-fix-can-pin-group.patch +leds-flash-leds-qcom-flash-update-torch-current-clam.patch +s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch +s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch +cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch +acpi-processor-idle-fix-memory-leak-when-register-cp.patch +soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch +pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch +blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch +arm-at91-pm-fix-mckx-restore-routine.patch +arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch +regulator-scmi-use-int-type-to-store-negative-error-.patch +selftests-nolibc-fix-expect_nz-macro.patch +block-use-int-to-store-blk_stack_limits-return-value.patch +pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch +arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch +arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch +arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch +pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch +power-supply-cw2015-fix-a-alignment-coding-style-iss.patch +pinctrl-renesas-use-int-type-to-store-negative-error.patch +null_blk-fix-the-description-of-the-cache_size-modul.patch +arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch +nbd-restrict-sockets-to-tcp-and-udp.patch +firmware-firmware-meson-sm-fix-compile-test-default.patch +cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch +arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch +arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch +arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch +pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch +acpica-fix-largest-possible-resource-descriptor-inde.patch +nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch +i3c-master-svc-use-manual-response-for-ibi-events.patch +i3c-master-svc-recycle-unused-ibi-slot.patch +selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch +bpf-explicitly-check-accesses-to-bpf_sock_addr.patch +smp-fix-up-and-expand-the-smp_call_function_many-ker.patch +tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch +once-fix-race-by-moving-do_once-to-separate-section.patch +hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch +thermal-drivers-qcom-make-lmh-select-qcom_scm.patch +thermal-drivers-qcom-lmh-add-missing-irq-includes.patch +i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch +i2c-designware-fix-clock-issue-when-pm-is-disabled.patch +i2c-designware-add-disabling-clocks-when-probe-fails.patch +bpf-enforce-expected_attach_type-for-tailcall-compat.patch +drm-panel-novatek-nt35560-fix-invalid-return-value.patch +drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch +f2fs-fix-condition-in-__allow_reserved_blocks.patch +drm-bridge-it6505-select-regmap_i2c.patch +media-zoran-remove-zoran_fh-structure.patch +phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch +usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch +usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch +serial-max310x-add-error-checking-in-probe.patch +drm-amd-display-remove-redundant-semicolons.patch +crypto-keembay-add-missing-check-after-sg_nents_for_.patch +hwrng-nomadik-add-arm_amba-dependency.patch +scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch +scsi-myrs-fix-dma_alloc_coherent-error-check.patch +media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch +rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch +alsa-lx_core-use-int-type-to-store-negative-error-co.patch +media-st-delta-avoid-excessive-stack-usage.patch +crypto-hisilicon-zip-remove-unnecessary-validation-f.patch +crypto-hisilicon-re-enable-address-prefetch-after-de.patch +crypto-hisilicon-qm-check-whether-the-input-function.patch +inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch +coresight-only-register-perf-symlink-for-sinks-with-.patch +drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch +drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch +drm-amd-pm-fix-si_upload_smc_data-v3.patch +drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch +drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch +drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch +drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch +wifi-mwifiex-send-world-regulatory-domain-to-driver.patch +pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch +tcp-fix-__tcp_close-to-only-send-rst-when-required.patch +drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch +usb-phy-twl6030-fix-incorrect-type-for-ret.patch +usb-gadget-configfs-correctly-set-use_os_string-at-b.patch +tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch +misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch +pps-fix-warning-in-pps_register_cdev-when-register-d.patch +asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch +asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch +asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch +drm-msm-dpu-fix-incorrect-type-for-ret.patch +fs-ntfs3-fix-integer-overflow-in-run_unpack.patch +fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch +iio-consumers-fix-handling-of-negative-channel-scale.patch +iio-consumers-fix-offset-handling-in-iio_convert_raw.patch +netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch +ipvs-use-read_once-write_once-for-ipvs-enable.patch +watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch +drivers-base-node-handle-error-properly-in-register_.patch +rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch +wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch +f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch +f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch +f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch +acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch +scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch +scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch +f2fs-fix-zero-sized-extent-for-precache-extents.patch +revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch +rdma-core-resolve-mac-of-next-hop-device-without-arp.patch +ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch +documentation-trace-historgram-design-separate-sched.patch +wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch +wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21124 +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12726 +sparc-fix-accurate-exception-reporting-in-copy_to_us.patch +sparc-fix-accurate-exception-reporting-in-copy_-from.patch-7638 +vfio-pds-replace-bitmap_free-with-vfree.patch +crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch +rdma-rxe-fix-race-in-do_task-when-draining.patch +wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch +pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch +remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch +coresight-etm4x-conditionally-access-register-trcext.patch +coresight-etm4x-support-atclk.patch +coresight-trbe-return-null-pointer-for-allocation-fa.patch +nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch +ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch +scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch +usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch +rdma-siw-always-report-immediate-post-sq-errors.patch +net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch +vhost-vringh-fix-copy_to_iter-return-value-check.patch +bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch +bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch +bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch +bluetooth-hci_sync-fix-using-random-address-for-big-.patch +keys-x.509-fix-basic-constraints-ca-flag-parsing.patch +hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch +ocfs2-fix-double-free-in-user_cluster_connect.patch +drivers-base-node-fix-double-free-in-register_one_no.patch +hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch +nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch +net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch +net-dlink-handle-copy_thresh-allocation-failure.patch +net-mlx5-stop-polling-for-command-response-if-interf.patch +net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch +net-mlx5-fw-reset-add-reset-timeout-work.patch +smb-client-fix-crypto-buffers-in-non-linear-memory.patch +revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch +vhost-vringh-modify-the-return-value-check.patch +bpf-reject-negative-offsets-for-alu-ops.patch diff --git a/queue-6.6/smb-client-fix-crypto-buffers-in-non-linear-memory.patch b/queue-6.6/smb-client-fix-crypto-buffers-in-non-linear-memory.patch new file mode 100644 index 0000000000..5d88d1c9be --- /dev/null +++ b/queue-6.6/smb-client-fix-crypto-buffers-in-non-linear-memory.patch @@ -0,0 +1,169 @@ +From e992334e94895b7ae727ecaf4d6f33edfbefb68b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 12:10:33 -0300 +Subject: smb: client: fix crypto buffers in non-linear memory + +From: Enzo Matsumiya + +[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ] + +The crypto API, through the scatterlist API, expects input buffers to be +in linear memory. We handle this with the cifs_sg_set_buf() helper +that converts vmalloc'd memory to their corresponding pages. + +However, when we allocate our aead_request buffer (@creq in +smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly +puts aead_request->__ctx in vmalloc area. + +AEAD algorithm then uses ->__ctx for its private/internal data and +operations, and uses sg_set_buf() for such data on a few places. + +This works fine as long as @creq falls into kmalloc zone (small +requests) or vmalloc'd memory is still within linear range. + +Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too +many tasks will increment the base stacks' addresses to a point where +virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that +happens. + +In practice: too many parallel reads and writes on an encrypted mount +will trigger this bug. + +To fix this, always alloc @creq with kmalloc() instead. +Also drop the @sensitive_size variable/arguments since +kfree_sensitive() doesn't need it. + +Backtrace: + +[ 945.272081] ------------[ cut here ]------------ +[ 945.272774] kernel BUG at include/linux/scatterlist.h:209! +[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) +[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 +[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) +[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 +[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b +[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 +[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 +[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 +[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 +[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 +[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 +[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 +[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 +[ 945.286683] Call Trace: +[ 945.286952] +[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] +[ 945.287719] crypto_gcm_encrypt+0x36/0xe0 +[ 945.288152] crypt_message+0x54a/0xad0 [cifs] +[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] +[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] +[ 945.289944] cifs_call_async+0x178/0x340 [cifs] +[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] +[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] +[ 945.291759] ? find_held_lock+0x32/0x90 +[ 945.292212] ? netfs_advance_write+0xf2/0x310 +[ 945.292723] netfs_advance_write+0xf2/0x310 +[ 945.293210] netfs_write_folio+0x346/0xcc0 +[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 +[ 945.294250] netfs_writepages+0x117/0x460 +[ 945.294724] do_writepages+0xbe/0x170 +[ 945.295152] ? find_held_lock+0x32/0x90 +[ 945.295600] ? kvm_sched_clock_read+0x11/0x20 +[ 945.296103] __writeback_single_inode+0x56/0x4b0 +[ 945.296643] writeback_sb_inodes+0x229/0x550 +[ 945.297140] __writeback_inodes_wb+0x4c/0xe0 +[ 945.297642] wb_writeback+0x2f1/0x3f0 +[ 945.298069] wb_workfn+0x300/0x490 +[ 945.298472] process_one_work+0x1fe/0x590 +[ 945.298949] worker_thread+0x1ce/0x3c0 +[ 945.299397] ? __pfx_worker_thread+0x10/0x10 +[ 945.299900] kthread+0x119/0x210 +[ 945.300285] ? __pfx_kthread+0x10/0x10 +[ 945.300729] ret_from_fork+0x119/0x1b0 +[ 945.301163] ? __pfx_kthread+0x10/0x10 +[ 945.301601] ret_from_fork_asm+0x1a/0x30 +[ 945.302055] + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: Enzo Matsumiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index b74f769047394..ee6a6ba13f89c 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4152,7 +4152,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct sg_table *sgt, +- unsigned int *num_sgs, size_t *sensitive_size) ++ unsigned int *num_sgs) + { + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); +@@ -4169,9 +4169,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += array_size(*num_sgs, sizeof(struct scatterlist)); +- *sensitive_size = len; + +- p = kvzalloc(len, GFP_NOFS); ++ p = kzalloc(len, GFP_NOFS); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -4185,16 +4184,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + + static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, +- struct aead_request **req, struct scatterlist **sgl, +- size_t *sensitive_size) ++ struct aead_request **req, struct scatterlist **sgl) + { + struct sg_table sgtable = {}; + unsigned int skip, num_sgs, i, j; + ssize_t rc; + void *p; + +- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, +- &num_sgs, sensitive_size); ++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); + if (IS_ERR(p)) + return ERR_CAST(p); + +@@ -4283,7 +4280,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + DECLARE_CRYPTO_WAIT(wait); + unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; +- size_t sensitive_size; + + rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); + if (rc) { +@@ -4309,8 +4305,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + return rc; + } + +- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, +- &sensitive_size); ++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (IS_ERR(creq)) + return PTR_ERR(creq); + +@@ -4340,7 +4335,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + if (!rc && enc) + memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); + +- kvfree_sensitive(creq, sensitive_size); ++ kfree_sensitive(creq); + return rc; + } + +-- +2.51.0 + diff --git a/queue-6.6/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.6/smb-server-fix-ird-ord-negotiation-with-the-client.patch new file mode 100644 index 0000000000..223e68483f --- /dev/null +++ b/queue-6.6/smb-server-fix-ird-ord-negotiation-with-the-client.patch @@ -0,0 +1,192 @@ +From b9514d3459298d14948c42c50967d069ed8939e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 15:34:58 +0200 +Subject: smb: server: fix IRD/ORD negotiation with the client + +From: Stefan Metzmacher + +[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ] + +Already do real negotiation in smb_direct_handle_connect_request() +where we see the requested initiator_depth and responder_resources +from the client. + +We should detect legacy iwarp clients using MPA v1 +with the custom IRD/ORD negotiation. + +We need to send the custom IRD/ORD in big endian, +but we need to try to let clients with broken requests +using little endian (older cifs.ko) to work. + +Note the reason why this uses u8 for +initiator_depth and responder_resources is +that the rdma layer also uses it. + +Acked-by: Namjae Jeon +Cc: Steve French +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Cc: linux-rdma@vger.kernel.org +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++----- + 1 file changed, 85 insertions(+), 14 deletions(-) + +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 504e2a1cf33b8..31c1ac256e1be 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -152,6 +152,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +-- +2.51.0 + diff --git a/queue-6.6/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.6/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch new file mode 100644 index 0000000000..b73eda7680 --- /dev/null +++ b/queue-6.6/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch @@ -0,0 +1,52 @@ +From bafc1b2e185390dd4605311ae85bc96058936f3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 13:44:14 +0200 +Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc + +From: Rafael J. Wysocki + +[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ] + +The smp_call_function_many() kerneldoc comment got out of sync with the +function definition (bool parameter "wait" is incorrectly described as a +bitmask in it), so fix it up by copying the "wait" description from the +smp_call_function() kerneldoc and add information regarding the handling +of the local CPU to it. + +Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/smp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/smp.c b/kernel/smp.c +index 3eeffeaf5450c..13b376c7296a5 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -862,16 +862,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +-- +2.51.0 + diff --git a/queue-6.6/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.6/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch new file mode 100644 index 0000000000..665f90ca07 --- /dev/null +++ b/queue-6.6/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch @@ -0,0 +1,50 @@ +From b255a3a68158b5ce852187097584873314521b38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 11:53:50 +0530 +Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS + +From: Sneh Mankad + +[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ] + +Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a +transaction completes. Previously this bit was only cleared when +a wake TCS was borrowed as an AMC TCS but not for dedicated +AMC TCS. Leaving this bit set for AMC TCS and entering deeper low +power modes can generate a false completion IRQ. + +Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER +bit upon receiving a completion IRQ. + +Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS") +Signed-off-by: Sneh Mankad +Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 163a58eb02e0a..d0ec42ec0d041 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); +-- +2.51.0 + diff --git a/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch new file mode 100644 index 0000000000..5dd8006f87 --- /dev/null +++ b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch @@ -0,0 +1,87 @@ +From d9d5c7f3f5cbeb2ee78e5522c1949eb20976c391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:30 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on QEMU 10.0.3 +Tested-by: René Rebe # on Ultra 5 UltraSparc IIi +Tested-by: Jonathan 'theJPster' Pallant # on Sun Netra T1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index 635398ec7540e..154fbd35400ca 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +-- +2.51.0 + diff --git a/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12726 b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12726 new file mode 100644 index 0000000000..389693c366 --- /dev/null +++ b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12726 @@ -0,0 +1,111 @@ +From c33f8d78183ec7c315a598c6b0354a3ec4cf7cdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:32 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + Niagara + +From: Michael Karcher + +[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations and a broken epilogue in the exception handlers. This will +prevent crashes and ensure correct return values of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on SPARC T4 with modified kernel to use Niagara 1 code +Tested-by: Magnus Lindholm # on Sun Fire T2000 +Signed-off-by: Michael Karcher +Tested-by: Ethan Hawke # on Sun Fire T2000 +Tested-by: Ken Link # on Sun Fire T1000 +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894..bbd3ea0a64822 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +-- +2.51.0 + diff --git a/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21124 b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21124 new file mode 100644 index 0000000000..b90e238f7b --- /dev/null +++ b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21124 @@ -0,0 +1,67 @@ +From 060009688d2fefd46b348779d3bbf350aafda471 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:31 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for + UltraSPARC III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Karcher + +[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ] + +Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios +enabled resulted from copy_from_user() returning impossibly large values +greater than the size to be copied. This lead to __copy_from_iter() +returning impossible values instead of the actual number of bytes it was +able to copy. + +The BUG_ON has been reported in +https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. The exception handlers expect that +%o2 has already been masked during the bulk copy loop, but the masking was +performed after that loop. This will fix the return value of copy_from_user +and copy_to_user in the faulting case. The behaviour of memcpy stays +unchanged. + +Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Sun Netra 240 +Reviewed-by: Anthony Yznaga +Tested-by: René Rebe # on UltraSparc III+ and UltraSparc IIIi +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/U3memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce..bace3a18f836f 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +-- +2.51.0 + diff --git a/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-7638 b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-7638 new file mode 100644 index 0000000000..4425a9ccd9 --- /dev/null +++ b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-7638 @@ -0,0 +1,112 @@ +From 1c5eb3223215fe9a23a13bb91da13363083a0acb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:34 +0200 +Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7 + +From: Michael Karcher + +[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a couple of bad +calculations. This will fix the return value of copy_from_user and +copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. + +Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC S7 +Tested-by: Tony Rodriguez # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- + arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c..99357bfa8e82a 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db1..207343367bb2d 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +-- +2.51.0 + diff --git a/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch new file mode 100644 index 0000000000..ce9a764daa --- /dev/null +++ b/queue-6.6/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch @@ -0,0 +1,43 @@ +From 860fcc580776bb868a06f4d5b24b6e1cab48b57c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 00:03:33 +0200 +Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4 + +From: Michael Karcher + +[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ] + +The referenced commit introduced exception handlers on user-space memory +references in copy_from_user and copy_to_user. These handlers return from +the respective function and calculate the remaining bytes left to copy +using the current register contents. This commit fixes a bad calculation. +This will fix the return value of copy_to_user in a specific faulting case. +The behaviour of memcpy stays unchanged. + +Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.") +Tested-by: John Paul Adrian Glaubitz # on Oracle SPARC T4-1 +Signed-off-by: Michael Karcher +Reviewed-by: Andreas Larsson +Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/lib/NG4memcpy.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d009..df0ec1bd19489 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +-- +2.51.0 + diff --git a/queue-6.6/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.6/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch new file mode 100644 index 0000000000..422bb9a4b8 --- /dev/null +++ b/queue-6.6/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch @@ -0,0 +1,60 @@ +From ed49ccc39c3e84e9492d45dceebae7d4c04593a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 08:47:18 +0000 +Subject: tcp: fix __tcp_close() to only send RST when required + +From: Eric Dumazet + +[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ] + +If the receive queue contains payload that was already +received, __tcp_close() can send an unexpected RST. + +Refine the code to take tp->copied_seq into account, +as we already do in tcp recvmsg(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reviewed-by: Neal Cardwell +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jason Xing +Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 40a2f172be2cb..7d824578f217a 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2786,8 +2786,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2806,11 +2806,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +-- +2.51.0 + diff --git a/queue-6.6/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.6/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch new file mode 100644 index 0000000000..17e8dd5327 --- /dev/null +++ b/queue-6.6/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch @@ -0,0 +1,41 @@ +From 19e2725412aa133012b1f8401e2cb45664e094e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:24 +0300 +Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes + +From: Dmitry Baryshkov + +[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ] + +As reported by LKP, the Qualcomm LMH driver needs to include several +IRQ-related headers, which decrlare necessary IRQ functionality. +Currently driver builds on ARM64 platforms, where the headers are pulled +in implicitly by other headers, but fails to build on other platforms. + +Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/lmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index d2d49264cf83a..7c299184c59b1 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.6/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.6/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch new file mode 100644 index 0000000000..0cf3927452 --- /dev/null +++ b/queue-6.6/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch @@ -0,0 +1,40 @@ +From a260239ad59f7b95b491f66b7c8be3480b6363f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jul 2025 15:18:23 +0300 +Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM + +From: Dmitry Baryshkov + +[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ] + +The QCOM_SCM symbol is not user-visible, so it makes little sense to +depend on it. Make LMH driver select QCOM_SCM as all other drivers do +and, as the dependecy is now correctly handled, enable || COMPILE_TEST +in order to include the driver into broader set of build tests. + +Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebb..a6bb01082ec69 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +-- +2.51.0 + diff --git a/queue-6.6/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.6/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch new file mode 100644 index 0000000000..94d96fcdf0 --- /dev/null +++ b/queue-6.6/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch @@ -0,0 +1,51 @@ +From 12bb56562c462f5da4da733bae11af3d9e20419a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 01:46:43 +0000 +Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in + host headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhouyi Zhou + +[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ] + +Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of +__kernel_old_time_t") made nolibc use the kernel's time type so that +`time_t` matches `timespec::tv_sec` on all ABIs (notably x32). + +But since __kernel_old_time_t is fairly new, notably from 2020 in commit +94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), +nolibc builds that rely on host headers may fail. + +Switch to __kernel_time_t, which is the same as __kernel_old_time_t and +has existed for longer. + +Tested in PPC VM of Open Source Lab of Oregon State University +(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh) + +Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") +Signed-off-by: Zhouyi Zhou +[Thomas: Reformat commit and its message a bit] +Signed-off-by: Thomas Weißschuh +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/std.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index a9d8b5b51f37f..f24953f8b949c 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -33,6 +33,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +-- +2.51.0 + diff --git a/queue-6.6/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch b/queue-6.6/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch new file mode 100644 index 0000000000..113dfa03d8 --- /dev/null +++ b/queue-6.6/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch @@ -0,0 +1,82 @@ +From da69780da5cc7aba9b8644794e122f3f92f36717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 15:26:56 +0300 +Subject: tty: n_gsm: Don't block input queue by waiting MSC + +From: Seppo Takalo + +[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ] + +Currently gsm_queue() processes incoming frames and when opening +a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). +If basic mode is used it calls gsm_modem_upd_via_msc() and it +cannot block the input queue by waiting the response to come +into the same input queue. + +Instead allow sending Modem Status Command without waiting for remote +end to respond. Define a new function gsm_modem_send_initial_msc() +for this purpose. As MSC is only valid for basic encoding, it does +not do anything for advanced or when convergence layer type 2 is used. + +Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") +Signed-off-by: Seppo Takalo +Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 8559ba1361c64..901f5c8311fbf 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); + static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); + static void gsmld_write_trigger(struct gsm_mux *gsm); + static void gsmld_write_task(struct work_struct *work); ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); + + /** + * gsm_fcs_add - update FCS +@@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + pr_debug("DLCI %d goes open.\n", dlci->addr); + /* Send current modem state */ + if (dlci->addr) { +- gsm_modem_update(dlci, 0); ++ gsm_modem_send_initial_msc(dlci); + } else { + /* Start keep-alive control */ + gsm->ka_num = 0; +@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) + return gsm_control_wait(dlci->gsm, ctrl); + } + ++/** ++ * gsm_modem_send_initial_msc - Send initial modem status message ++ * ++ * @dlci channel ++ * ++ * Send an initial MSC message after DLCI open to set the initial ++ * modem status lines. This is only done for basic mode. ++ * Does not wait for a response as we cannot block the input queue ++ * processing. ++ */ ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) ++{ ++ u8 modembits[2]; ++ ++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) ++ return 0; ++ ++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ ++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; ++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); ++} ++ + /** + * gsm_modem_update - send modem status line state + * @dlci: channel +-- +2.51.0 + diff --git a/queue-6.6/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.6/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch new file mode 100644 index 0000000000..4138a6ccab --- /dev/null +++ b/queue-6.6/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch @@ -0,0 +1,58 @@ +From ca4564167024d7be1e242cfb0ec436b95d5e7f1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 11:36:09 +0800 +Subject: usb: gadget: configfs: Correctly set use_os_string at bind + +From: William Wu + +[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ] + +Once the use_os_string flag is set to true for some functions +(e.g. adb/mtp) which need to response the OS string, and then +if we re-bind the ConfigFS gadget to use the other functions +(e.g. hid) which should not to response the OS string, however, +because the use_os_string flag is still true, so the usb gadget +response the OS string descriptor incorrectly, this can cause +the USB device to be unrecognizable on the Windows system. + +An example of this as follows: + +echo 1 > os_desc/use +ln -s functions/ffs.adb configs/b.1/function0 +start adbd +echo "" > UDC #succeed + +stop adbd +rm configs/b.1/function0 +echo 0 > os_desc/use +ln -s functions/hid.gs0 configs/b.1/function0 +echo "" > UDC #fail to connect on Windows + +This patch sets the use_os_string flag to false at bind if +the functions not support OS Descriptors. + +Signed-off-by: William Wu +Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support") +Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 4c89f7629d530..9e8af571448bf 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1747,6 +1747,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +-- +2.51.0 + diff --git a/queue-6.6/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.6/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch new file mode 100644 index 0000000000..284ca89002 --- /dev/null +++ b/queue-6.6/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch @@ -0,0 +1,39 @@ +From 9ec8e773f546f1254194aad1cfe628d2913db283 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:55:00 +0300 +Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe + cleanup + +From: Dan Carpenter + +[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ] + +The kthread_run() function returns error pointers so the +max3421_hcd->spi_thread pointer can be either error pointers or NULL. +Check for both before dereferencing it. + +Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index cc1f579f02de1..2d792ab271e2a 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +-- +2.51.0 + diff --git a/queue-6.6/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch b/queue-6.6/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch new file mode 100644 index 0000000000..5729539f0b --- /dev/null +++ b/queue-6.6/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch @@ -0,0 +1,143 @@ +From 61810c5fbbde9e2d6f203fa44729426338b5457c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 14:31:32 +0530 +Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls + +From: Komal Bajaj + +[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ] + +EUD_MODE_MANAGER2 register is mapped to a memory region that is marked +as read-only for operating system running at EL1, enforcing access +restrictions that prohibit direct memory-mapped writes via writel(). + +Attempts to write to this region from HLOS can result in silent failures +or memory access violations, particularly when toggling EUD (Embedded +USB Debugger) state. To ensure secure register access, modify the driver +to use qcom_scm_io_writel(), which routes the write operation to Qualcomm +Secure Channel Monitor (SCM). SCM has the necessary permissions to access +protected memory regions, enabling reliable control over EUD state. + +SC7280, the only user of EUD is also affected, indicating that this could +never have worked on a properly fused device. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Signed-off-by: Melody Olvera +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Souradeep Chowdhury +Signed-off-by: Komal Bajaj +Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/Kconfig | 1 + + drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++--------- + 2 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig +index 99b15b77dfd57..fe1b5fec1dfca 100644 +--- a/drivers/usb/misc/Kconfig ++++ b/drivers/usb/misc/Kconfig +@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY + config USB_QCOM_EUD + tristate "QCOM Embedded USB Debugger(EUD) Driver" + depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + select USB_ROLE_SWITCH + help + This module enables support for Qualcomm Technologies, Inc. +diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c +index 7f371ea1248c3..cfb195a0f6ce2 100644 +--- a/drivers/usb/misc/qcom_eud.c ++++ b/drivers/usb/misc/qcom_eud.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define EUD_REG_INT1_EN_MASK 0x0024 + #define EUD_REG_INT_STATUS_1 0x0044 +@@ -34,7 +35,7 @@ struct eud_chip { + struct device *dev; + struct usb_role_switch *role_sw; + void __iomem *base; +- void __iomem *mode_mgr; ++ phys_addr_t mode_mgr; + unsigned int int_status; + int irq; + bool enabled; +@@ -43,18 +44,29 @@ struct eud_chip { + + static int enable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); ++ if (ret) ++ return ret; ++ + writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); + writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, + priv->base + EUD_REG_INT1_EN_MASK); +- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); + + return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); + } + +-static void disable_eud(struct eud_chip *priv) ++static int disable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); ++ if (ret) ++ return ret; ++ + writel(0, priv->base + EUD_REG_CSR_EUD_EN); +- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); ++ return 0; + } + + static ssize_t enable_show(struct device *dev, +@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, + chip->enabled = enable; + else + disable_eud(chip); ++ + } else { +- disable_eud(chip); ++ ret = disable_eud(chip); + } + +- return count; ++ return ret < 0 ? ret : count; + } + + static DEVICE_ATTR_RW(enable); +@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) + static int eud_probe(struct platform_device *pdev) + { + struct eud_chip *chip; ++ struct resource *res; + int ret; + + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); +@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) + if (IS_ERR(chip->base)) + return PTR_ERR(chip->base); + +- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(chip->mode_mgr)) +- return PTR_ERR(chip->mode_mgr); ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -ENODEV; ++ chip->mode_mgr = res->start; + + chip->irq = platform_get_irq(pdev, 0); + ret = devm_request_threaded_irq(&pdev->dev, chip->irq, handle_eud_irq, +-- +2.51.0 + diff --git a/queue-6.6/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.6/usb-phy-twl6030-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..2d9af3ad50 --- /dev/null +++ b/queue-6.6/usb-phy-twl6030-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From d994621ab8226ae5d9d1320217b982a755b8c650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Aug 2025 17:22:24 +0800 +Subject: usb: phy: twl6030: Fix incorrect type for ret + +From: Xichao Zhao + +[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ] + +In the twl6030_usb_probe(), the variable ret is declared as +a u32 type. However, since ret may receive -ENODEV when accepting +the return value of omap_usb2_set_comparator().Therefore, its type +should be changed to int. + +Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2") +Signed-off-by: Xichao Zhao +Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index c3ce6b1054f1c..292c32ccae050 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +-- +2.51.0 + diff --git a/queue-6.6/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.6/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch new file mode 100644 index 0000000000..d21e0000b4 --- /dev/null +++ b/queue-6.6/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch @@ -0,0 +1,74 @@ +From d5b14ab9543d77be932aab5fea2efddcc859a2fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 15:15:46 +0300 +Subject: usb: vhci-hcd: Prevent suspending virtually attached devices + +From: Cristian Ciocaltea + +[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ] + +The VHCI platform driver aims to forbid entering system suspend when at +least one of the virtual USB ports are bound to an active USB/IP +connection. + +However, in some cases, the detection logic doesn't work reliably, i.e. +when all devices attached to the virtual root hub have been already +suspended, leading to a broken suspend state, with unrecoverable resume. + +Ensure the virtually attached devices do not enter suspend by setting +the syscore PM flag. Note this is currently limited to the client side +only, since the server side doesn't implement system suspend prevention. + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Signed-off-by: Cristian Ciocaltea +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 14a5f55f24fc8..b22e0881bfaf3 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +-- +2.51.0 + diff --git a/queue-6.6/vfio-pds-replace-bitmap_free-with-vfree.patch b/queue-6.6/vfio-pds-replace-bitmap_free-with-vfree.patch new file mode 100644 index 0000000000..448b910580 --- /dev/null +++ b/queue-6.6/vfio-pds-replace-bitmap_free-with-vfree.patch @@ -0,0 +1,43 @@ +From a3eaa70f3bb3873a19847a7816492509c4353eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 15:31:54 +0000 +Subject: vfio/pds: replace bitmap_free with vfree + +From: Zilin Guan + +[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ] + +host_seq_bmp is allocated with vzalloc but is currently freed with +bitmap_free, which uses kfree internally. This mismach prevents the +resource from being released properly and may result in memory leaks +or other issues. + +Fix this by freeing host_seq_bmp with vfree to match the vzalloc +allocation. + +Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") +Signed-off-by: Zilin Guan +Reviewed-by: Brett Creeley +Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/dirty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c +index 27607d7b9030a..6adc5f1ae2eb9 100644 +--- a/drivers/vfio/pci/pds/dirty.c ++++ b/drivers/vfio/pci/pds/dirty.c +@@ -81,7 +81,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_dirty *dirty, + + host_ack_bmp = vzalloc(bytes); + if (!host_ack_bmp) { +- bitmap_free(host_seq_bmp); ++ vfree(host_seq_bmp); + return -ENOMEM; + } + +-- +2.51.0 + diff --git a/queue-6.6/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.6/vhost-vringh-fix-copy_to_iter-return-value-check.patch new file mode 100644 index 0000000000..4e1b9fe4b3 --- /dev/null +++ b/queue-6.6/vhost-vringh-fix-copy_to_iter-return-value-check.patch @@ -0,0 +1,53 @@ +From f8288bdd92bd35c331935c4238a9dcd7fc2abae6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Sep 2025 02:04:08 -0400 +Subject: vhost: vringh: Fix copy_to_iter return value check + +From: Michael S. Tsirkin + +[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ] + +The return value of copy_to_iter can't be negative, check whether the +copied length is equal to the requested length instead of checking for +negative values. + +Cc: zhang jiao +Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Simon Horman +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 7b8fd977f71cc..60961c65fd472 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.6/vhost-vringh-modify-the-return-value-check.patch b/queue-6.6/vhost-vringh-modify-the-return-value-check.patch new file mode 100644 index 0000000000..09976ab133 --- /dev/null +++ b/queue-6.6/vhost-vringh-modify-the-return-value-check.patch @@ -0,0 +1,50 @@ +From f99b65e5b7c271f9691b017029e94c95424c7dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 17:17:38 +0800 +Subject: vhost: vringh: Modify the return value check + +From: zhang jiao + +[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ] + +The return value of copy_from_iter and copy_to_iter can't be negative, +check whether the copied lengths are equal. + +Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") +Cc: "Stefano Garzarella" +Signed-off-by: zhang jiao +Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vringh.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 60961c65fd472..134cc10af776b 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +-- +2.51.0 + diff --git a/queue-6.6/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.6/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch new file mode 100644 index 0000000000..890138119a --- /dev/null +++ b/queue-6.6/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch @@ -0,0 +1,49 @@ +From 275631b0f7cd954ba8bfbe5679d31fa77564ec86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 14:51:26 +0200 +Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the + watchdog + +From: Christophe Leroy + +[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ] + +When the watchdog gets enabled with this driver, it leaves enough time +for the core watchdog subsystem to start pinging it. But when the +watchdog is already started by hardware or by the boot loader, little +time remains before it fires and it happens that the core watchdog +subsystem doesn't have time to start pinging it. + +Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker +function") pinging was managed by the driver itself and the watchdog +was immediately pinged by setting the timer expiry to 0. + +So restore similar behaviour by pinging it when enabling it so that +if it was already enabled the watchdog timer counter is reloaded. + +Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") +Signed-off-by: Christophe Leroy +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mpc8xxx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 867f9f3113797..a4b497ecfa205 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.6/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch new file mode 100644 index 0000000000..569890f776 --- /dev/null +++ b/queue-6.6/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch @@ -0,0 +1,93 @@ +From 6be2b91c5dc0d46de417ddf5ea8684bf7efa8298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Aug 2025 17:26:45 +0800 +Subject: wifi: ath10k: avoid unnecessary wait for service ready message + +From: Baochen Qiang + +[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ] + +Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before +failing") works around the failure in waiting for the service ready +message by active polling. Note the polling is triggered after initial +wait timeout, which means that the wait-till-timeout can not be avoided +even the message is ready. + +A possible fix is to do polling once before wait as well, however this +can not handle the race that the message arrives right after polling. +So the solution is to do periodic polling until timeout. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 + +Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") +Reported-by: Paul Menzel +Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- + 1 file changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 818aea99f85eb..340502c47a10d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1763,33 +1763,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +-- +2.51.0 + diff --git a/queue-6.6/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.6/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch new file mode 100644 index 0000000000..2fbc4a8866 --- /dev/null +++ b/queue-6.6/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch @@ -0,0 +1,87 @@ +From dcfe2bd020ed96f01ea424656420174535f641a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 12:42:03 +0530 +Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not + available + +From: Aditya Kumar Singh + +[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ] + +In ieee80211_rx_handle_packet(), if the caller does not provide pubsta +information, an attempt is made to find the station using the address 2 +(source address) field in the header. Since pubsta is missing, link +information such as link_valid and link_id is also unavailable. Now if such +a situation comes, and if a matching ML station entry is found based on +the source address, currently the packet is dropped due to missing link ID +in the status field which is not correct. + +Hence, to fix this issue, if link_valid is not set and the station is an +ML station, make an attempt to find a link station entry using the source +address. If a valid link station is found, derive the link ID and proceed +with packet processing. Otherwise, drop the packet as per the existing +flow. + +Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status") +Suggested-by: Vasanthakumar Thiagarajan +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 210337ef23cf5..164c6e8049826 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5219,12 +5219,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5232,10 +5240,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +-- +2.51.0 + diff --git a/queue-6.6/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.6/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch new file mode 100644 index 0000000000..1c65930b6b --- /dev/null +++ b/queue-6.6/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch @@ -0,0 +1,40 @@ +From 08971e28d1d4c5714d5827d3fd84b379c030dcf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 20:25:30 +0530 +Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe() + +From: Abdun Nihaal + +[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ] + +In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory +is allocated for both struct ieee80211_hw and a workqueue. However, on +the error path, the workqueue is not freed. Fix that by calling +mt76_free_device() on the error path. + +Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Abdun Nihaal +Reviewed-by: Jiri Slaby +Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ba927033bbe8c..1206769cdc7fd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.6/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.6/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch new file mode 100644 index 0000000000..49ba27c49f --- /dev/null +++ b/queue-6.6/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch @@ -0,0 +1,44 @@ +From 0fd9f9cc1bc52a7cc59c3f917d5c24ae8bbd5814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Aug 2025 16:16:59 +0200 +Subject: wifi: mwifiex: send world regulatory domain to driver + +From: Stefan Kerkmann + +[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ] + +The world regulatory domain is a restrictive subset of channel +configurations which allows legal operation of the adapter all over the +world. Changing to this domain should not be prevented. + +Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed +Signed-off-by: Stefan Kerkmann +Reviewed-by: Jeff Chen +Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 69eea0628e670..df6e4a112ec48 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +-- +2.51.0 + diff --git a/queue-6.6/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.6/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch new file mode 100644 index 0000000000..15b1e60422 --- /dev/null +++ b/queue-6.6/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch @@ -0,0 +1,149 @@ +From e027c0029865d27be7eccfb7643655fe224bf7d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Sep 2025 00:08:50 +0300 +Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run() + +From: Fedor Pchelkin + +[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ] + +Lockdep gives a splat [1] when ser_hdl_work item is executed. It is +scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a +wiphy lock inside. However, this workqueue can be flushed when e.g. +closing the interface and wiphy lock is already taken in that case. + +Choosing wiphy_work_queue() for SER is likely not suitable. Back on to +the global workqueue. + +[1]: + + WARNING: possible circular locking dependency detected + 6.17.0-rc2 #17 Not tainted + ------------------------------------------------------ + kworker/u32:1/61 is trying to acquire lock: + ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core] + + but task is already holding lock: + ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}: + process_one_work+0x7c6/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + -> #1 ((wq_completion)phy0){+.+.}-{0:0}: + touch_wq_lockdep_map+0x8e/0x180 + __flush_workqueue+0x129/0x10d0 + ieee80211_stop_device+0xa8/0x110 + ieee80211_do_stop+0x14ce/0x2880 + ieee80211_stop+0x13a/0x2c0 + __dev_close_many+0x18f/0x510 + __dev_change_flags+0x25f/0x670 + netif_change_flags+0x7b/0x160 + do_setlink.isra.0+0x1640/0x35d0 + rtnl_newlink+0xd8c/0x1d30 + rtnetlink_rcv_msg+0x700/0xb80 + netlink_rcv_skb+0x11d/0x350 + netlink_unicast+0x49a/0x7a0 + netlink_sendmsg+0x759/0xc20 + ____sys_sendmsg+0x812/0xa00 + ___sys_sendmsg+0xf7/0x180 + __sys_sendmsg+0x11f/0x1b0 + do_syscall_64+0xbb/0x360 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + other info that might help us debug this: + + Chain exists of: + &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work) + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&ser->ser_hdl_work)); + lock((wq_completion)phy0); + lock((work_completion)(&ser->ser_hdl_work)); + lock(&rdev->wiphy.mtx); + + *** DEADLOCK *** + + 2 locks held by kworker/u32:1/61: + #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450 + #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450 + + stack backtrace: + CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary) + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 + Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core] + Call Trace: + + dump_stack_lvl+0x5d/0x80 + print_circular_bug.cold+0x178/0x1be + check_noncircular+0x14c/0x170 + __lock_acquire+0x124c/0x1d20 + lock_acquire+0x154/0x2e0 + __mutex_lock+0x17b/0x12f0 + ser_state_run+0x5e/0x180 [rtw89_core] + rtw89_ser_hdl_work+0x119/0x220 [rtw89_core] + process_one_work+0x82d/0x1450 + worker_thread+0x49e/0xd00 + kthread+0x313/0x640 + ret_from_fork+0x221/0x300 + ret_from_fork_asm+0x1a/0x30 + + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet") +Signed-off-by: Fedor Pchelkin +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/ser.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 45165cf3e824e..ae3e02efcc5d7 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.6/x86-vdso-fix-output-operand-size-of-rdpid.patch new file mode 100644 index 0000000000..04c5fd4894 --- /dev/null +++ b/queue-6.6/x86-vdso-fix-output-operand-size-of-rdpid.patch @@ -0,0 +1,59 @@ +From b07c1e1442b362814735fae448be3bc39f2fc3d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:52:57 +0200 +Subject: x86/vdso: Fix output operand size of RDPID + +From: Uros Bizjak + +[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ] + +RDPID instruction outputs to a word-sized register (64-bit on x86_64 and +32-bit on x86_32). Use an unsigned long variable to store the correct size. + +LSL outputs to 32-bit register, use %k operand prefix to always print the +32-bit name of the register. + +Use RDPID insn mnemonic while at it as the minimum binutils version of +2.30 supports it. + + [ bp: Merge two patches touching the same function into a single one. ] + +Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/segment.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 9d6411c659205..00cefbb59fa98 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +-- +2.51.0 +