From: Sasha Levin Date: Wed, 12 Aug 2026 16:27:21 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d5365564930137e28306cd18e68718bf5aba503;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-usb-audio-evaluate-packsize-caps-at-the-right-p.patch b/queue-5.10/alsa-usb-audio-evaluate-packsize-caps-at-the-right-p.patch new file mode 100644 index 0000000000..b32bc0ead5 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-evaluate-packsize-caps-at-the-right-p.patch @@ -0,0 +1,71 @@ +From 73197a1c560960f16e597371bd2b7a6fda0653b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2026 22:57:40 +0800 +Subject: ALSA: usb-audio: Evaluate packsize caps at the right place +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +[ Upstream commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 ] + +We introduced the upper bound checks of the packet sizes by the +ep->maxframesize for avoiding the URB submission errors. However, the +check was applied at an incorrect place in the function +snd_usb_endpoint_set_params() where ep->maxframesize isn't defined +yet; the value is defined at a bit later position. So this ended up +with a failure at the first run while the second run works. + +For fixing it, move the check at the correct place, right after the +calculation of ep->maxframesize in the same function. + +Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292 +Cc: +Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +[王YP: Move the check to `snd_usb_pcm_prepare()`. For linux-5.10.y, + ep->maxframesize is calculated in `snd_usb_pcm_prepare()`.] +Signed-off-by: 王YP +Signed-off-by: Sasha Levin +--- + sound/usb/endpoint.c | 3 --- + sound/usb/pcm.c | 7 +++++++ + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 3ac4251f9cde6..730744104df61 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1101,9 +1101,6 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep, + return -EINVAL; + } + +- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize); +- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize); +- + /* calculate the frequency in 16.16 format */ + ep->freqm = ep->freqn; + ep->freqshift = INT_MIN; +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index f4494d0549172..802ed1dbd23b0 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -953,6 +953,13 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) + subs->data_endpoint->curframesize = + bytes_to_frames(runtime, subs->data_endpoint->curpacksize); + ++ subs->data_endpoint->packsize[0] = min( ++ subs->data_endpoint->packsize[0], ++ subs->data_endpoint->maxframesize); ++ subs->data_endpoint->packsize[1] = min( ++ subs->data_endpoint->packsize[1], ++ subs->data_endpoint->maxframesize); ++ + /* reset the pointer */ + subs->hwptr_done = 0; + subs->transfer_done = 0; +-- +2.53.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 28a5dd62e1..f30f30fb9c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -338,3 +338,5 @@ sctp-remove-the-unessessary-hold-for-idev-in-sctp_v6.patch sctp-extract-sctp_v6_err_handle-function-from-sctp_v.patch sctp-extract-sctp_v4_err_handle-function-from-sctp_v.patch tls-don-t-abort-the-connection-on-signal-interrupted.patch +spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch +alsa-usb-audio-evaluate-packsize-caps-at-the-right-p.patch diff --git a/queue-5.10/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch b/queue-5.10/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch new file mode 100644 index 0000000000..cf757943d6 --- /dev/null +++ b/queue-5.10/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch @@ -0,0 +1,55 @@ +From 38b1b9d10ee97f5ab1f5ba97daee40fb7fbc75cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:37 +0100 +Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + +From: Larisa Grigore + +[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ] + +Repacking multiple smaller words into larger ones to make use of the +full FIFO doesn't save anything in DMA mode, so don't bother doing it. + +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 580fdcbcd9b6c..2bf8cc137d31e 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + struct spi_transfer *xfer = dspi->cur_transfer; + bool odd = !!(dspi->len & 1); + +- /* No accel for frames not multiple of 8 bits at the moment */ +- if (xfer->bits_per_word % 8) ++ /* ++ * No accel for DMA transfers or frames not multiples of 8 bits at the ++ * moment. ++ */ ++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE || ++ xfer->bits_per_word % 8) + goto no_accel; + + if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) { +@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + dspi->oper_bits_per_word = 8; + } else { + /* Start off with maximum supported by hardware */ +- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE) +- dspi->oper_bits_per_word = 32; +- else +- dspi->oper_bits_per_word = 16; ++ dspi->oper_bits_per_word = 32; + + /* + * And go down only if the buffer can't be sent with +-- +2.53.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 2659fdafc4..e6469d3290 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -396,3 +396,4 @@ ata-pata_sl82c105-fix-bridge-revision-use-after-free.patch sctp-clear-control-chunk-transport-if-it-is-being-re.patch tls-don-t-abort-the-connection-on-signal-interrupted.patch hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch +spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch diff --git a/queue-5.15/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch b/queue-5.15/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch new file mode 100644 index 0000000000..bccdd6d8c3 --- /dev/null +++ b/queue-5.15/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch @@ -0,0 +1,55 @@ +From adbfdb6e441c7b35911ecd068c473436ae3599a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:37 +0100 +Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + +From: Larisa Grigore + +[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ] + +Repacking multiple smaller words into larger ones to make use of the +full FIFO doesn't save anything in DMA mode, so don't bother doing it. + +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 580fdcbcd9b6c..2bf8cc137d31e 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + struct spi_transfer *xfer = dspi->cur_transfer; + bool odd = !!(dspi->len & 1); + +- /* No accel for frames not multiple of 8 bits at the moment */ +- if (xfer->bits_per_word % 8) ++ /* ++ * No accel for DMA transfers or frames not multiples of 8 bits at the ++ * moment. ++ */ ++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE || ++ xfer->bits_per_word % 8) + goto no_accel; + + if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) { +@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + dspi->oper_bits_per_word = 8; + } else { + /* Start off with maximum supported by hardware */ +- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE) +- dspi->oper_bits_per_word = 32; +- else +- dspi->oper_bits_per_word = 16; ++ dspi->oper_bits_per_word = 32; + + /* + * And go down only if the buffer can't be sent with +-- +2.53.0 + diff --git a/queue-6.1/kvm-x86-check-for-invalid-obsolete-root-after-making.patch b/queue-6.1/kvm-x86-check-for-invalid-obsolete-root-after-making.patch new file mode 100644 index 0000000000..420b3fc975 --- /dev/null +++ b/queue-6.1/kvm-x86-check-for-invalid-obsolete-root-after-making.patch @@ -0,0 +1,94 @@ +From 69534a2a689605d4a8ad55dc8f8d43c5ec04c9db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2026 08:15:35 -0400 +Subject: KVM: x86: Check for invalid/obsolete root *after* making MMU pages + available + +From: Sean Christopherson + +[ Upstream commit 2abd5287f08319fa35764566b15c6e22cb1068db ] + +Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, +after making MMU pages available for the shadow MMU. If reclaiming shadow +pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to +map memory into an invalid root. On its own, populating an invalid root is +"fine", but because child shadow pages inherit their parent's role, any +children created during the map/fetch will be created as invalid pages, +thus violating KVM's invariant that invalid pages are never on the list of +active MMU pages. + +Note, the underlying flaw has existed since KVM first started tracking +invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root +pagetables"), but the true badness only came along in 2020 (Linux 5.9) +with the invariant that invalid shadow pages can't be on the list of +active pages. + +Note #2, inheriting role.invalid when creating child shadow pages is also +far from ideal; that flaw will be addressed separately. + +Reported-by: Hyunwoo Kim +Fixes: f95eec9bed76 ("KVM: x86/mmu: Don't put invalid SPs back on the list of active pages") +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/mmu.c | 9 +++++---- + arch/x86/kvm/mmu/paging_tmpl.h | 10 ++++++---- + 2 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 7fc8a819b31ac..34f09908961c5 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -4281,16 +4281,17 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + return r; + } + +- r = RET_PF_RETRY; + write_lock(&vcpu->kvm->mmu_lock); + +- if (is_page_fault_stale(vcpu, fault)) +- goto out_unlock; +- + r = make_mmu_pages_available(vcpu); + if (r) + goto out_unlock; + ++ if (is_page_fault_stale(vcpu, fault)) { ++ r = RET_PF_RETRY; ++ goto out_unlock; ++ } ++ + r = direct_map(vcpu, fault); + + out_unlock: +diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h +index 8d1ab32ee5f9e..2ea7bd1a6bb5f 100644 +--- a/arch/x86/kvm/mmu/paging_tmpl.h ++++ b/arch/x86/kvm/mmu/paging_tmpl.h +@@ -865,15 +865,17 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + + orig_pfn = fault->pfn; + +- r = RET_PF_RETRY; + write_lock(&vcpu->kvm->mmu_lock); + +- if (is_page_fault_stale(vcpu, fault)) +- goto out_unlock; +- + r = make_mmu_pages_available(vcpu); + if (r) + goto out_unlock; ++ ++ if (is_page_fault_stale(vcpu, fault)) { ++ r = RET_PF_RETRY; ++ goto out_unlock; ++ } ++ + r = FNAME(fetch)(vcpu, fault, &walker); + + out_unlock: +-- +2.53.0 + diff --git a/queue-6.1/kvm-x86-mmu-rename-__direct_map-to-direct_map.patch b/queue-6.1/kvm-x86-mmu-rename-__direct_map-to-direct_map.patch new file mode 100644 index 0000000000..fd63935f13 --- /dev/null +++ b/queue-6.1/kvm-x86-mmu-rename-__direct_map-to-direct_map.patch @@ -0,0 +1,218 @@ +From cb2d269cf84a987d6367a982f0d26aa99775fe98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2026 08:15:34 -0400 +Subject: KVM: x86/mmu: Rename __direct_map() to direct_map() + +From: David Matlack + +[ Upstream commit 6c882ef4fc7bd99b67ad152e75428b669281c521 ] + +Rename __direct_map() to direct_map() since the leading underscores are +unnecessary. This also makes the page fault handler names more +consistent: kvm_tdp_mmu_page_fault() calls kvm_tdp_mmu_map() and +direct_page_fault() calls direct_map(). + +Opportunistically make some trivial cleanups to comments that had to be +modified anyway since they mentioned __direct_map(). Specifically, use +"()" when referring to functions, and include kvm_tdp_mmu_map() among +the various callers of disallowed_hugepage_adjust(). + +No functional change intended. + +Signed-off-by: David Matlack +Reviewed-by: Isaku Yamahata +Signed-off-by: Paolo Bonzini +Message-Id: <20220921173546.2674386-11-dmatlack@google.com> +Signed-off-by: Paolo Bonzini +Stable-dep-of: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available") +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/mmu.c | 61 ++++++++++++++++----------------- + arch/x86/kvm/mmu/mmu_internal.h | 3 +- + arch/x86/kvm/mmu/paging_tmpl.h | 6 +--- + 3 files changed, 33 insertions(+), 37 deletions(-) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 3b612294a1820..7fc8a819b31ac 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -3102,11 +3102,11 @@ void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_ + is_shadow_present_pte(spte) && + !is_large_pte(spte)) { + /* +- * A small SPTE exists for this pfn, but FNAME(fetch) +- * and __direct_map would like to create a large PTE +- * instead: just force them to go down another level, +- * patching back for them into pfn the next 9 bits of +- * the address. ++ * A small SPTE exists for this pfn, but FNAME(fetch), ++ * direct_map(), or kvm_tdp_mmu_map() would like to create a ++ * large PTE instead: just force them to go down another level, ++ * patching back for them into pfn the next 9 bits of the ++ * address. + */ + u64 page_mask = KVM_PAGES_PER_HPAGE(cur_level) - + KVM_PAGES_PER_HPAGE(cur_level - 1); +@@ -3115,7 +3115,7 @@ void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_ + } + } + +-static int __direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) ++static int direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + { + struct kvm_shadow_walk_iterator it; + struct kvm_mmu_page *sp; +@@ -4157,6 +4157,9 @@ static int kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + struct kvm_memory_slot *slot = fault->slot; + bool async; + ++ fault->mmu_seq = vcpu->kvm->mmu_invalidate_seq; ++ smp_rmb(); ++ + /* + * Retry the page fault if the gfn hit a memslot that is being deleted + * or moved. This ensures any existing SPTEs for the old memslot will +@@ -4213,8 +4216,7 @@ static int kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + * root was invalidated by a memslot update or a relevant mmu_notifier fired. + */ + static bool is_page_fault_stale(struct kvm_vcpu *vcpu, +- struct kvm_page_fault *fault, +- unsigned long mmu_seq) ++ struct kvm_page_fault *fault) + { + struct kvm_mmu_page *sp = to_shadow_page(vcpu->arch.mmu->root.hpa); + +@@ -4234,14 +4236,13 @@ static bool is_page_fault_stale(struct kvm_vcpu *vcpu, + return true; + + return fault->slot && +- mmu_invalidate_retry_hva(vcpu->kvm, mmu_seq, fault->hva); ++ mmu_invalidate_retry_hva(vcpu->kvm, fault->mmu_seq, fault->hva); + } + + static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + { + bool is_tdp_mmu_fault = is_tdp_mmu(vcpu->arch.mmu); + +- unsigned long mmu_seq; + kvm_pfn_t orig_pfn; + int r; + +@@ -4259,43 +4260,41 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + if (r) + return r; + +- mmu_seq = vcpu->kvm->mmu_invalidate_seq; +- smp_rmb(); +- + r = kvm_faultin_pfn(vcpu, fault); + if (r != RET_PF_CONTINUE) + return r; +- + r = handle_abnormal_pfn(vcpu, fault, ACC_ALL); + if (r != RET_PF_CONTINUE) + return r; + + orig_pfn = fault->pfn; + ++ if (is_tdp_mmu_fault) { ++ r = RET_PF_RETRY; ++ read_lock(&vcpu->kvm->mmu_lock); ++ ++ if (!is_page_fault_stale(vcpu, fault)) ++ r = kvm_tdp_mmu_map(vcpu, fault); ++ ++ read_unlock(&vcpu->kvm->mmu_lock); ++ kvm_release_pfn_clean(orig_pfn); ++ return r; ++ } ++ + r = RET_PF_RETRY; ++ write_lock(&vcpu->kvm->mmu_lock); + +- if (is_tdp_mmu_fault) +- read_lock(&vcpu->kvm->mmu_lock); +- else +- write_lock(&vcpu->kvm->mmu_lock); ++ if (is_page_fault_stale(vcpu, fault)) ++ goto out_unlock; + +- if (is_page_fault_stale(vcpu, fault, mmu_seq)) ++ r = make_mmu_pages_available(vcpu); ++ if (r) + goto out_unlock; + +- if (is_tdp_mmu_fault) { +- r = kvm_tdp_mmu_map(vcpu, fault); +- } else { +- r = make_mmu_pages_available(vcpu); +- if (r) +- goto out_unlock; +- r = __direct_map(vcpu, fault); +- } ++ r = direct_map(vcpu, fault); + + out_unlock: +- if (is_tdp_mmu_fault) +- read_unlock(&vcpu->kvm->mmu_lock); +- else +- write_unlock(&vcpu->kvm->mmu_lock); ++ write_unlock(&vcpu->kvm->mmu_lock); + kvm_release_pfn_clean(orig_pfn); + return r; + } +diff --git a/arch/x86/kvm/mmu/mmu_internal.h b/arch/x86/kvm/mmu/mmu_internal.h +index 5e4be3bb3624c..009024d421831 100644 +--- a/arch/x86/kvm/mmu/mmu_internal.h ++++ b/arch/x86/kvm/mmu/mmu_internal.h +@@ -197,7 +197,7 @@ struct kvm_page_fault { + + /* + * Maximum page size that can be created for this fault; input to +- * FNAME(fetch), __direct_map and kvm_tdp_mmu_map. ++ * FNAME(fetch), direct_map() and kvm_tdp_mmu_map(). + */ + u8 max_level; + +@@ -220,6 +220,7 @@ struct kvm_page_fault { + struct kvm_memory_slot *slot; + + /* Outputs of kvm_faultin_pfn. */ ++ unsigned long mmu_seq; + kvm_pfn_t pfn; + hva_t hva; + bool map_writable; +diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h +index 1c7d73b8081c6..8d1ab32ee5f9e 100644 +--- a/arch/x86/kvm/mmu/paging_tmpl.h ++++ b/arch/x86/kvm/mmu/paging_tmpl.h +@@ -792,7 +792,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + struct guest_walker walker; + kvm_pfn_t orig_pfn; + int r; +- unsigned long mmu_seq; + bool is_self_change_mapping; + + pgprintk("%s: addr %lx err %x\n", __func__, fault->addr, fault->error_code); +@@ -837,9 +836,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + else + fault->max_level = walker.level; + +- mmu_seq = vcpu->kvm->mmu_invalidate_seq; +- smp_rmb(); +- + r = kvm_faultin_pfn(vcpu, fault); + if (r != RET_PF_CONTINUE) + return r; +@@ -872,7 +868,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault + r = RET_PF_RETRY; + write_lock(&vcpu->kvm->mmu_lock); + +- if (is_page_fault_stale(vcpu, fault, mmu_seq)) ++ if (is_page_fault_stale(vcpu, fault)) + goto out_unlock; + + r = make_mmu_pages_available(vcpu); +-- +2.53.0 + diff --git a/queue-6.1/series b/queue-6.1/series index d76905fd83..758854eabe 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -532,3 +532,6 @@ tls-don-t-abort-the-connection-on-signal-interrupted.patch hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch regulator-devres-add-api-for-reference-voltage-suppl.patch hwmon-ads7828-fix-external-vref-regulator-handling.patch +kvm-x86-mmu-rename-__direct_map-to-direct_map.patch +kvm-x86-check-for-invalid-obsolete-root-after-making.patch +spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch diff --git a/queue-6.1/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch b/queue-6.1/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch new file mode 100644 index 0000000000..f50b2839e6 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch @@ -0,0 +1,55 @@ +From ca61f282c139318702bd9ffed722e7d0a3577c10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:37 +0100 +Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + +From: Larisa Grigore + +[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ] + +Repacking multiple smaller words into larger ones to make use of the +full FIFO doesn't save anything in DMA mode, so don't bother doing it. + +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 3a33156f52740..840b97ae6ec30 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + struct spi_transfer *xfer = dspi->cur_transfer; + bool odd = !!(dspi->len & 1); + +- /* No accel for frames not multiple of 8 bits at the moment */ +- if (xfer->bits_per_word % 8) ++ /* ++ * No accel for DMA transfers or frames not multiples of 8 bits at the ++ * moment. ++ */ ++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE || ++ xfer->bits_per_word % 8) + goto no_accel; + + if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) { +@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + dspi->oper_bits_per_word = 8; + } else { + /* Start off with maximum supported by hardware */ +- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE) +- dspi->oper_bits_per_word = 32; +- else +- dspi->oper_bits_per_word = 16; ++ dspi->oper_bits_per_word = 32; + + /* + * And go down only if the buffer can't be sent with +-- +2.53.0 + diff --git a/queue-6.12/mm-vmscan-wake-up-flushers-conditionally-to-avoid-cg.patch b/queue-6.12/mm-vmscan-wake-up-flushers-conditionally-to-avoid-cg.patch new file mode 100644 index 0000000000..8eef1bcfb4 --- /dev/null +++ b/queue-6.12/mm-vmscan-wake-up-flushers-conditionally-to-avoid-cg.patch @@ -0,0 +1,177 @@ +From e52937a68369296de98c7e296d0436495c29f6a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 19:57:14 +0800 +Subject: mm/vmscan: wake up flushers conditionally to avoid cgroup OOM + +From: Zeng Jingxiang + +[ Upstream commit 1bc542c6a0d1444559ab75823a89a94d244bf933 ] + +Commit 14aa8b2d5c2e ("mm/mglru: don't sync disk for each aging cycle") +removed the opportunity to wake up flushers during the MGLRU page +reclamation process can lead to an increased likelihood of triggering OOM +when encountering many dirty pages during reclamation on MGLRU. + +This leads to premature OOM if there are too many dirty pages in cgroup: +Killed + +dd invoked oom-killer: gfp_mask=0x101cca(GFP_HIGHUSER_MOVABLE|__GFP_WRITE), +order=0, oom_score_adj=0 + +Call Trace: + + dump_stack_lvl+0x5f/0x80 + dump_stack+0x14/0x20 + dump_header+0x46/0x1b0 + oom_kill_process+0x104/0x220 + out_of_memory+0x112/0x5a0 + mem_cgroup_out_of_memory+0x13b/0x150 + try_charge_memcg+0x44f/0x5c0 + charge_memcg+0x34/0x50 + __mem_cgroup_charge+0x31/0x90 + filemap_add_folio+0x4b/0xf0 + __filemap_get_folio+0x1a4/0x5b0 + ? srso_return_thunk+0x5/0x5f + ? __block_commit_write+0x82/0xb0 + ext4_da_write_begin+0xe5/0x270 + generic_perform_write+0x134/0x2b0 + ext4_buffered_write_iter+0x57/0xd0 + ext4_file_write_iter+0x76/0x7d0 + ? selinux_file_permission+0x119/0x150 + ? srso_return_thunk+0x5/0x5f + ? srso_return_thunk+0x5/0x5f + vfs_write+0x30c/0x440 + ksys_write+0x65/0xe0 + __x64_sys_write+0x1e/0x30 + x64_sys_call+0x11c2/0x1d50 + do_syscall_64+0x47/0x110 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + memory: usage 308224kB, limit 308224kB, failcnt 2589 + swap: usage 0kB, limit 9007199254740988kB, failcnt 0 + + ... + file_dirty 303247360 + file_writeback 0 + ... + +oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test, +mems_allowed=0,oom_memcg=/test,task_memcg=/test,task=dd,pid=4404,uid=0 +Memory cgroup out of memory: Killed process 4404 (dd) total-vm:10512kB, +anon-rss:1152kB, file-rss:1824kB, shmem-rss:0kB, UID:0 pgtables:76kB +oom_score_adj:0 + +The flusher wake up was removed to decrease SSD wearing, but if we are +seeing all dirty folios at the tail of an LRU, not waking up the flusher +could lead to thrashing easily. So wake it up when a memcg is about to +OOM due to dirty caches. + +I did run the build kernel test[1] on V6, with -j16 1G memcg on my local +branch: + +Without the patch(10 times): +user 1449.394 +system 368.78 372.58 363.03 362.31 360.84 372.70 368.72 364.94 373.51 +366.58 (avg 367.399) +real 164.883 + +With the V6 patch(10 times): +user 1447.525 +system 360.87 360.63 372.39 364.09 368.49 365.15 359.93 362.04 359.72 +354.60 (avg 362.79) +real 164.514 + +Test results show that this patch has about 1% performance improvement, +which should be caused by noise. + +Link: https://lkml.kernel.org/r/20241026115714.1437435-1-jingxiangzeng.cas@gmail.com +Link: https://lore.kernel.org/all/CACePvbV4L-gRN9UKKuUnksfVJjOTq_5Sti2-e=pb_w51kucLKQ@mail.gmail.com/ [1] +Fixes: 14aa8b2d5c2e ("mm/mglru: don't sync disk for each aging cycle") +Suggested-by: Wei Xu +Signed-off-by: Zeng Jingxiang +Signed-off-by: Kairui Song +Reviewed-by: Wei Xu +Tested-by: Chris Li +Cc: T.J. Mercier +Cc: Yu Zhao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/vmscan.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index deeb4310fd54c..20f4cb33d8e8a 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -4313,6 +4313,7 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c + int tier_idx) + { + bool success; ++ bool dirty, writeback; + int gen = folio_lru_gen(folio); + int type = folio_is_file_lru(folio); + int zone = folio_zonenum(folio); +@@ -4358,9 +4359,17 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c + return true; + } + ++ dirty = folio_test_dirty(folio); ++ writeback = folio_test_writeback(folio); ++ if (type == LRU_GEN_FILE && dirty) { ++ sc->nr.file_taken += delta; ++ if (!writeback) ++ sc->nr.unqueued_dirty += delta; ++ } ++ + /* waiting for writeback */ +- if (folio_test_locked(folio) || folio_test_writeback(folio) || +- (type == LRU_GEN_FILE && folio_test_dirty(folio))) { ++ if (folio_test_locked(folio) || writeback || ++ (type == LRU_GEN_FILE && dirty)) { + gen = folio_inc_gen(lruvec, folio, true); + list_move(&folio->lru, &lrugen->folios[gen][type][zone]); + return true; +@@ -4476,7 +4485,8 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, + trace_mm_vmscan_lru_isolate(sc->reclaim_idx, sc->order, MAX_LRU_BATCH, + scanned, skipped, isolated, + type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON); +- ++ if (type == LRU_GEN_FILE) ++ sc->nr.file_taken += isolated; + /* + * There might not be eligible folios due to reclaim_idx. Check the + * remaining to prevent livelock if it's not making progress. +@@ -4610,6 +4620,7 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swap + return scanned; + retry: + reclaimed = shrink_folio_list(&list, pgdat, sc, &stat, false); ++ sc->nr.unqueued_dirty += stat.nr_unqueued_dirty; + sc->nr_reclaimed += reclaimed; + trace_mm_vmscan_lru_shrink_inactive(pgdat->node_id, + scanned, reclaimed, &stat, sc->priority, +@@ -4821,6 +4832,13 @@ static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc) + cond_resched(); + } + ++ /* ++ * If too many file cache in the coldest generation can't be evicted ++ * due to being dirty, wake up the flusher. ++ */ ++ if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken) ++ wakeup_flusher_threads(WB_REASON_VMSCAN); ++ + /* whether this lruvec should be rotated */ + return nr_to_scan < 0; + } +@@ -5966,6 +5984,7 @@ static void shrink_node(pg_data_t *pgdat, struct scan_control *sc) + bool reclaimable = false; + + if (lru_gen_enabled() && root_reclaim(sc)) { ++ memset(&sc->nr, 0, sizeof(sc->nr)); + lru_gen_shrink_node(pgdat, sc); + return; + } +-- +2.53.0 + diff --git a/queue-6.12/mtd-spinand-fix-direct-mapping-creation-sizes.patch b/queue-6.12/mtd-spinand-fix-direct-mapping-creation-sizes.patch new file mode 100644 index 0000000000..c48efbca86 --- /dev/null +++ b/queue-6.12/mtd-spinand-fix-direct-mapping-creation-sizes.patch @@ -0,0 +1,75 @@ +From e2ae5ebf404a8a679fdcaa433a3b43fcbc340f0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2026 18:13:36 +0200 +Subject: mtd: spinand: fix direct mapping creation sizes + +From: Mikhail Kshevetskiy + +[ Upstream commit e4a0cf9f1d90e6888e5373da3314f761024f6c97 ] + +Continuous mode is only supported for data reads, thus writing +requires only single flash page mapping. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Kshevetskiy +Signed-off-by: Miquel Raynal +Signed-off-by: Frieder Schrempf +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/core.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index 48ac009cbaad2..a480243385e2e 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -1036,18 +1036,13 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + unsigned int plane) + { + struct nand_device *nand = spinand_to_nand(spinand); +- struct spi_mem_dirmap_info info = { +- .length = nanddev_page_size(nand) + +- nanddev_per_page_oobsize(nand), +- }; ++ struct spi_mem_dirmap_info info = { 0 }; + struct spi_mem_dirmap_desc *desc; + +- if (spinand->cont_read_possible) +- info.length = nanddev_eraseblock_size(nand); +- + /* The plane number is passed in MSB just above the column address */ + info.offset = plane << fls(nand->memorg.pagesize); + ++ info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand); + info.op_tmpl = *spinand->op_templates.update_cache; + desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, + spinand->spimem, &info); +@@ -1056,6 +1051,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + + spinand->dirmaps[plane].wdesc = desc; + ++ if (spinand->cont_read_possible) ++ info.length = nanddev_eraseblock_size(nand); + info.op_tmpl = *spinand->op_templates.read_cache; + desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, + spinand->spimem, &info); +@@ -1071,6 +1068,7 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + return 0; + } + ++ info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand); + info.op_tmpl = *spinand->op_templates.update_cache; + info.op_tmpl.data.ecc = true; + desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, +@@ -1080,6 +1078,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + + spinand->dirmaps[plane].wdesc_ecc = desc; + ++ if (spinand->cont_read_possible) ++ info.length = nanddev_eraseblock_size(nand); + info.op_tmpl = *spinand->op_templates.read_cache; + info.op_tmpl.data.ecc = true; + desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, +-- +2.53.0 + diff --git a/queue-6.12/mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch b/queue-6.12/mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch new file mode 100644 index 0000000000..e9c99b89b0 --- /dev/null +++ b/queue-6.12/mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch @@ -0,0 +1,76 @@ +From 2a690438191571ec45791997ae1e06575fd3555a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2026 18:13:38 +0200 +Subject: mtd: spinand: repeat reading in regular mode if continuous reading + fails + +From: Mikhail Kshevetskiy + +[ Upstream commit 010dc7f2dd6a0078ade3f88f627ed5fbf45ceb94 ] + +Continuous reading may result in multiple flash pages reading in one +operation. Unfortunately, not all spinand controllers support such +large reading. They will read less data. Unfortunately, the operation +can't be continued. + +In this case: + * disable continuous reading on this (not good enough) spi controller + * repeat reading in regular mode. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Kshevetskiy +Signed-off-by: Miquel Raynal +Signed-off-by: Frieder Schrempf +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/core.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index 10339209e7322..bf16901b77b64 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -427,8 +427,16 @@ static int spinand_read_from_cache_op(struct spinand_device *spinand, + * Dirmap accesses are allowed to toggle the CS. + * Toggling the CS during a continuous read is forbidden. + */ +- if (nbytes && req->continuous) +- return -EIO; ++ if (nbytes && req->continuous) { ++ /* ++ * Spi controller with broken support of continuous ++ * reading was detected. Disable future use of ++ * continuous reading and return -EAGAIN to retry ++ * reading within regular mode. ++ */ ++ spinand->cont_read_possible = false; ++ return -EAGAIN; ++ } + } + + if (req->datalen) +@@ -849,10 +857,19 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from, + + old_stats = mtd->ecc_stats; + +- if (spinand_use_cont_read(mtd, from, ops)) ++ if (spinand_use_cont_read(mtd, from, ops)) { + ret = spinand_mtd_continuous_page_read(mtd, from, ops, &max_bitflips); +- else ++ if (ret == -EAGAIN && !spinand->cont_read_possible) { ++ /* ++ * Spi controller with broken support of continuous ++ * reading was detected (see spinand_read_from_cache_op()), ++ * repeat reading in regular mode. ++ */ ++ ret = spinand_mtd_regular_page_read(mtd, from, ops, &max_bitflips); ++ } ++ } else { + ret = spinand_mtd_regular_page_read(mtd, from, ops, &max_bitflips); ++ } + + if (ops->stats) { + ops->stats->uncorrectable_errors += +-- +2.53.0 + diff --git a/queue-6.12/mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch b/queue-6.12/mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch new file mode 100644 index 0000000000..27df2ee4df --- /dev/null +++ b/queue-6.12/mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch @@ -0,0 +1,110 @@ +From 4e91bcda764fef48c244cba38ee1ebde14e5ab07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2026 18:13:37 +0200 +Subject: mtd: spinand: try a regular dirmap if creating a dirmap for + continuous reading fails + +From: Mikhail Kshevetskiy + +[ Upstream commit 004f8ea0d9917398aabff7388b3bf62a84a4088b ] + +Continuous reading may result in multiple flash pages reading in one +operation. Typically only one flash page has read/written (a little bit +more than 2-4 Kb), but continuous reading requires the spi controller +to read up to 512 Kb in one operation without toggling CS in beetween. + +Roughly speaking spi controllers can be divided on 2 categories: + * spi controllers without dirmap acceleration support + * spi controllers with dirmap acceleration support + +Firt of them will have issues with continuous reading if restriction on +the transfer length is implemented in the adjust_op_size() handler. +Second group often supports acceleration of single page only reading. +Thus enabling of continuous reading can break flash reading. + +This patch tries to create dirmap for continuous reading first and +fallback to regular reading if spi controller refuses to create it. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Kshevetskiy +Signed-off-by: Miquel Raynal +Signed-off-by: Frieder Schrempf +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/core.c | 43 ++++++++++++++++++++++++++++++------- + 1 file changed, 35 insertions(+), 8 deletions(-) + +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index a480243385e2e..10339209e7322 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -1032,6 +1032,39 @@ static int spinand_mtd_block_isreserved(struct mtd_info *mtd, loff_t offs) + return ret; + } + ++static struct spi_mem_dirmap_desc *spinand_create_rdesc( ++ struct spinand_device *spinand, ++ struct spi_mem_dirmap_info *info) ++{ ++ struct nand_device *nand = spinand_to_nand(spinand); ++ struct spi_mem_dirmap_desc *desc = NULL; ++ ++ if (spinand->cont_read_possible) { ++ /* ++ * spi controller may return an error if info->length is ++ * too large ++ */ ++ info->length = nanddev_eraseblock_size(nand); ++ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, ++ spinand->spimem, info); ++ } ++ ++ if (IS_ERR_OR_NULL(desc)) { ++ /* ++ * continuous reading is not supported by flash or ++ * its spi controller, use regular reading ++ */ ++ spinand->cont_read_possible = false; ++ ++ info->length = nanddev_page_size(nand) + ++ nanddev_per_page_oobsize(nand); ++ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, ++ spinand->spimem, info); ++ } ++ ++ return desc; ++} ++ + static int spinand_create_dirmap(struct spinand_device *spinand, + unsigned int plane) + { +@@ -1051,11 +1084,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + + spinand->dirmaps[plane].wdesc = desc; + +- if (spinand->cont_read_possible) +- info.length = nanddev_eraseblock_size(nand); + info.op_tmpl = *spinand->op_templates.read_cache; +- desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, +- spinand->spimem, &info); ++ desc = spinand_create_rdesc(spinand, &info); + if (IS_ERR(desc)) + return PTR_ERR(desc); + +@@ -1078,12 +1108,9 @@ static int spinand_create_dirmap(struct spinand_device *spinand, + + spinand->dirmaps[plane].wdesc_ecc = desc; + +- if (spinand->cont_read_possible) +- info.length = nanddev_eraseblock_size(nand); + info.op_tmpl = *spinand->op_templates.read_cache; + info.op_tmpl.data.ecc = true; +- desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev, +- spinand->spimem, &info); ++ desc = spinand_create_rdesc(spinand, &info); + if (IS_ERR(desc)) + return PTR_ERR(desc); + +-- +2.53.0 + diff --git a/queue-6.12/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch b/queue-6.12/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch new file mode 100644 index 0000000000..25ae2e78f4 --- /dev/null +++ b/queue-6.12/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch @@ -0,0 +1,74 @@ +From 837f293acc3d475a9489a946d2b8860d4a2a5853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 14:39:02 +0200 +Subject: net: fec: do not release NULL pages when RX buffer allocation fails + +From: Mehmet Fide + +fec_enet_alloc_rxq_buffers() leaves the loop as soon as +page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which +calls fec_enet_free_buffers(). That helper walks the whole ring and +hands every rx_skb_info[i].page to page_pool_put_full_page(), including +the entries the allocation loop never reached. Those are still NULL, +because the queue was allocated with kzalloc(), and +page_pool_put_full_page() dereferences the page, so an open that runs +out of memory oopses instead of returning -ENOMEM: + + Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read + Internal error: Oops: 5 [#1] SMP ARM + CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1 + Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) + PC is at fec_enet_free_buffers+0xb0/0x2a8 + Call trace: + fec_enet_free_buffers from fec_enet_open+0x1e0/0x504 + fec_enet_open from __dev_open+0x114/0x238 + __dev_open from __dev_change_flags+0x190/0x208 + __dev_change_flags from netif_change_flags+0x1c/0x58 + netif_change_flags from dev_change_flags+0x44/0x74 + dev_change_flags from devinet_ioctl+0x3a4/0x768 + +Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot. + +Skip the entries that hold no page, and clear the ones that do after +releasing them, so that a later failed open cannot release the same page +a second time. + +Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add +fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced +this loop with fec_free_rxq_buffers(), which skips and clears the empty +entries. That commit is part of the XDP zero copy series and is not a +stable candidate, so this is the equivalent minimal fix for 6.18.y. + +Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers") +Cc: stable@vger.kernel.org +Signed-off-by: Mehmet Fide +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index d8189c433847c..22cd47d19ce24 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3323,8 +3323,15 @@ static void fec_enet_free_buffers(struct net_device *ndev) + + for (q = 0; q < fep->num_rx_queues; q++) { + rxq = fep->rx_queue[q]; +- for (i = 0; i < rxq->bd.ring_size; i++) +- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false); ++ for (i = 0; i < rxq->bd.ring_size; i++) { ++ struct page *page = rxq->rx_skb_info[i].page; ++ ++ if (!page) ++ continue; ++ ++ page_pool_put_full_page(rxq->page_pool, page, false); ++ rxq->rx_skb_info[i].page = NULL; ++ } + + for (i = 0; i < XDP_STATS_TOTAL; i++) + rxq->stats[i] = 0; +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 3aa996e848..cb446c0fac 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -64,3 +64,10 @@ hwmon-ads7828-fix-external-vref-regulator-handling.patch hwmon-ltc4282-avoid-overflow-in-maximum-power-calcul.patch hwmon-ltc4282-clamp-negative-current-limits.patch hwmon-ltc4282-fix-parsing-adi-current-limit-sense-mi.patch +mm-vmscan-wake-up-flushers-conditionally-to-avoid-cg.patch +net-fec-do-not-release-null-pages-when-rx-buffer-all.patch +spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch +mtd-spinand-fix-direct-mapping-creation-sizes.patch +mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch +mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch +swapfile-call-cond_resched-before-locking-si-lock.patch diff --git a/queue-6.12/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch b/queue-6.12/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch new file mode 100644 index 0000000000..bf2de37784 --- /dev/null +++ b/queue-6.12/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch @@ -0,0 +1,55 @@ +From e833fe14d7c215a7ce6c8ba9a0bef91ad2733476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:37 +0100 +Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + +From: Larisa Grigore + +[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ] + +Repacking multiple smaller words into larger ones to make use of the +full FIFO doesn't save anything in DMA mode, so don't bother doing it. + +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index e26363ae74890..bc7479c834ff6 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -746,8 +746,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + struct spi_transfer *xfer = dspi->cur_transfer; + bool odd = !!(dspi->len & 1); + +- /* No accel for frames not multiple of 8 bits at the moment */ +- if (xfer->bits_per_word % 8) ++ /* ++ * No accel for DMA transfers or frames not multiples of 8 bits at the ++ * moment. ++ */ ++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE || ++ xfer->bits_per_word % 8) + goto no_accel; + + if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) { +@@ -756,10 +760,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + dspi->oper_bits_per_word = 8; + } else { + /* Start off with maximum supported by hardware */ +- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE) +- dspi->oper_bits_per_word = 32; +- else +- dspi->oper_bits_per_word = 16; ++ dspi->oper_bits_per_word = 32; + + /* + * And go down only if the buffer can't be sent with +-- +2.53.0 + diff --git a/queue-6.12/swapfile-call-cond_resched-before-locking-si-lock.patch b/queue-6.12/swapfile-call-cond_resched-before-locking-si-lock.patch new file mode 100644 index 0000000000..6aa96eb1c5 --- /dev/null +++ b/queue-6.12/swapfile-call-cond_resched-before-locking-si-lock.patch @@ -0,0 +1,44 @@ +From 726cf412ad28f0045a7b8b507b3e01b51972ea0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2026 10:51:47 +0200 +Subject: swapfile: call cond_resched() before locking si->lock + +From: Guillaume Morin + +The 6.12 backport of commit 66366d291f66 ("mm/swap: add cond_resched() +in swap_reclaim_full_clusters to prevent softlockup"), +added a cond_resched() after locking si->lock. Move cond_resched() +before spin_lock(). + +Signed-off-by: Guillaume Morin +Fixes: 60cbe67d1342 ("mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup") +Link: https://lore.kernel.org/stable/ansgKOOXi6KE3oKf@bender.morinfr.org/ +Cc: stable@vger.kernel.org +Cc: Chris Li +Cc: Zijiang Huang +Cc: gregkh@linuxfoundation.org +Signed-off-by: Sasha Levin +--- + mm/swapfile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 552df432c37f4..ed0a5ed25e65b 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force) + } + offset++; + } ++ cond_resched(); + spin_lock(&si->lock); + + if (to_scan <= 0) + break; +- cond_resched(); + } + } + +-- +2.53.0 + diff --git a/queue-6.18/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch b/queue-6.18/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch new file mode 100644 index 0000000000..c6b72d5789 --- /dev/null +++ b/queue-6.18/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch @@ -0,0 +1,74 @@ +From 73f77319ec84f27513393a21d2181970a0e94774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 14:39:02 +0200 +Subject: net: fec: do not release NULL pages when RX buffer allocation fails + +From: Mehmet Fide + +fec_enet_alloc_rxq_buffers() leaves the loop as soon as +page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which +calls fec_enet_free_buffers(). That helper walks the whole ring and +hands every rx_skb_info[i].page to page_pool_put_full_page(), including +the entries the allocation loop never reached. Those are still NULL, +because the queue was allocated with kzalloc(), and +page_pool_put_full_page() dereferences the page, so an open that runs +out of memory oopses instead of returning -ENOMEM: + + Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read + Internal error: Oops: 5 [#1] SMP ARM + CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1 + Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) + PC is at fec_enet_free_buffers+0xb0/0x2a8 + Call trace: + fec_enet_free_buffers from fec_enet_open+0x1e0/0x504 + fec_enet_open from __dev_open+0x114/0x238 + __dev_open from __dev_change_flags+0x190/0x208 + __dev_change_flags from netif_change_flags+0x1c/0x58 + netif_change_flags from dev_change_flags+0x44/0x74 + dev_change_flags from devinet_ioctl+0x3a4/0x768 + +Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot. + +Skip the entries that hold no page, and clear the ones that do after +releasing them, so that a later failed open cannot release the same page +a second time. + +Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add +fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced +this loop with fec_free_rxq_buffers(), which skips and clears the empty +entries. That commit is part of the XDP zero copy series and is not a +stable candidate, so this is the equivalent minimal fix for 6.18.y. + +Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers") +Cc: stable@vger.kernel.org +Signed-off-by: Mehmet Fide +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index a2cf8cbe2539e..7699a970cb25e 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3341,8 +3341,15 @@ static void fec_enet_free_buffers(struct net_device *ndev) + + for (q = 0; q < fep->num_rx_queues; q++) { + rxq = fep->rx_queue[q]; +- for (i = 0; i < rxq->bd.ring_size; i++) +- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false); ++ for (i = 0; i < rxq->bd.ring_size; i++) { ++ struct page *page = rxq->rx_skb_info[i].page; ++ ++ if (!page) ++ continue; ++ ++ page_pool_put_full_page(rxq->page_pool, page, false); ++ rxq->rx_skb_info[i].page = NULL; ++ } + + for (i = 0; i < XDP_STATS_TOTAL; i++) + rxq->stats[i] = 0; +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index e6700afd07..6604d946c4 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -107,3 +107,4 @@ hwmon-ads7828-fix-external-vref-regulator-handling.patch hwmon-ltc4282-avoid-overflow-in-maximum-power-calcul.patch hwmon-ltc4282-clamp-negative-current-limits.patch hwmon-ltc4282-fix-parsing-adi-current-limit-sense-mi.patch +net-fec-do-not-release-null-pages-when-rx-buffer-all.patch diff --git a/queue-6.6/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch b/queue-6.6/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch new file mode 100644 index 0000000000..f5406e76f2 --- /dev/null +++ b/queue-6.6/net-fec-do-not-release-null-pages-when-rx-buffer-all.patch @@ -0,0 +1,74 @@ +From de0c7a5a01201e46f45accd3ae4cb0be9c5320aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 14:39:02 +0200 +Subject: net: fec: do not release NULL pages when RX buffer allocation fails + +From: Mehmet Fide + +fec_enet_alloc_rxq_buffers() leaves the loop as soon as +page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which +calls fec_enet_free_buffers(). That helper walks the whole ring and +hands every rx_skb_info[i].page to page_pool_put_full_page(), including +the entries the allocation loop never reached. Those are still NULL, +because the queue was allocated with kzalloc(), and +page_pool_put_full_page() dereferences the page, so an open that runs +out of memory oopses instead of returning -ENOMEM: + + Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read + Internal error: Oops: 5 [#1] SMP ARM + CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1 + Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) + PC is at fec_enet_free_buffers+0xb0/0x2a8 + Call trace: + fec_enet_free_buffers from fec_enet_open+0x1e0/0x504 + fec_enet_open from __dev_open+0x114/0x238 + __dev_open from __dev_change_flags+0x190/0x208 + __dev_change_flags from netif_change_flags+0x1c/0x58 + netif_change_flags from dev_change_flags+0x44/0x74 + dev_change_flags from devinet_ioctl+0x3a4/0x768 + +Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot. + +Skip the entries that hold no page, and clear the ones that do after +releasing them, so that a later failed open cannot release the same page +a second time. + +Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add +fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced +this loop with fec_free_rxq_buffers(), which skips and clears the empty +entries. That commit is part of the XDP zero copy series and is not a +stable candidate, so this is the equivalent minimal fix for 6.18.y. + +Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers") +Cc: stable@vger.kernel.org +Signed-off-by: Mehmet Fide +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 49297b83c3fdb..ec7fe943e5682 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3322,8 +3322,15 @@ static void fec_enet_free_buffers(struct net_device *ndev) + + for (q = 0; q < fep->num_rx_queues; q++) { + rxq = fep->rx_queue[q]; +- for (i = 0; i < rxq->bd.ring_size; i++) +- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false); ++ for (i = 0; i < rxq->bd.ring_size; i++) { ++ struct page *page = rxq->rx_skb_info[i].page; ++ ++ if (!page) ++ continue; ++ ++ page_pool_put_full_page(rxq->page_pool, page, false); ++ rxq->rx_skb_info[i].page = NULL; ++ } + + for (i = 0; i < XDP_STATS_TOTAL; i++) + rxq->stats[i] = 0; +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index d2f39c780c..202a8fb064 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -59,3 +59,5 @@ tls-don-t-abort-the-connection-on-signal-interrupted.patch hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch regulator-devres-add-api-for-reference-voltage-suppl.patch hwmon-ads7828-fix-external-vref-regulator-handling.patch +net-fec-do-not-release-null-pages-when-rx-buffer-all.patch +spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch diff --git a/queue-6.6/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch b/queue-6.6/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch new file mode 100644 index 0000000000..9954e61c02 --- /dev/null +++ b/queue-6.6/spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch @@ -0,0 +1,55 @@ +From 463a34e9f649f0bd5490abd3cb00f2fb62656602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:37 +0100 +Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + +From: Larisa Grigore + +[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ] + +Repacking multiple smaller words into larger ones to make use of the +full FIFO doesn't save anything in DMA mode, so don't bother doing it. + +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 3206c84c6f22f..b7dc2add9114e 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + struct spi_transfer *xfer = dspi->cur_transfer; + bool odd = !!(dspi->len & 1); + +- /* No accel for frames not multiple of 8 bits at the moment */ +- if (xfer->bits_per_word % 8) ++ /* ++ * No accel for DMA transfers or frames not multiples of 8 bits at the ++ * moment. ++ */ ++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE || ++ xfer->bits_per_word % 8) + goto no_accel; + + if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) { +@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) + dspi->oper_bits_per_word = 8; + } else { + /* Start off with maximum supported by hardware */ +- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE) +- dspi->oper_bits_per_word = 32; +- else +- dspi->oper_bits_per_word = 16; ++ dspi->oper_bits_per_word = 32; + + /* + * And go down only if the buffer can't be sent with +-- +2.53.0 +