From: Sasha Levin Date: Sun, 7 Sep 2025 14:12:44 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v5.4.299~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9899612e2d54fc615eef6fb9e2411f8db572ce00;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-5.10/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..4162db4dcd --- /dev/null +++ b/queue-5.10/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From b5c78d9b54478d5952bea7a429e4ce3b560d657c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 6e90927e65769..ab487edec2e5b 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 65d9bad304..95935d3522 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -43,3 +43,7 @@ net-phy-microchip-implement-generic-.handle_interrupt-callback.patch net-phy-microchip-remove-the-use-of-.ack_interrupt.patch net-phy-microchip-force-irq-polling-mode-for-lan88xx.patch alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch diff --git a/queue-5.10/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-5.10/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..88da93613d --- /dev/null +++ b/queue-5.10/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 81b7ff26c19055dafada090dcaf9fef12f159d42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index bf3f600bdd2c8..7ece48667f52d 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-5.10/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-5.10/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..690b9709e0 --- /dev/null +++ b/queue-5.10/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From 5c665bf2ae68cfaf2135e574f3a64877fe83815a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index ab096368a1fd5..319cd96bd201b 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-5.10/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-5.10/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..276fa8c889 --- /dev/null +++ b/queue-5.10/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From cd12d5173fd1fa6a2c02e8905310dcbc4778efbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 7ece48667f52d..ab096368a1fd5 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -71,7 +72,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_MASTER BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-5.15/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch b/queue-5.15/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch new file mode 100644 index 0000000000..d1c6de67cb --- /dev/null +++ b/queue-5.15/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch @@ -0,0 +1,55 @@ +From 9e33fd5769d0e56394af4a5c67f6b6805a0abf28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:23:41 +0200 +Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting + +From: Michael Walle + +[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ] + +The bridge has three bootstrap pins which are sampled to determine the +frequency of the external reference clock. The driver will also +(over)write that setting. But it seems this is racy after the bridge is +enabled. It was observed that although the driver write the correct +value (by sniffing on the I2C bus), the register has the wrong value. +The datasheet states that the GPIO lines have to be stable for at least +5us after asserting the EN signal. Thus, there seems to be some logic +which samples the GPIO lines and this logic appears to overwrite the +register value which was set by the driver. Waiting 20us after +asserting the EN line resolves this issue. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Michael Walle +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 1c9dd62d3c47b..1187bfb449f29 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -313,6 +313,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + + gpiod_set_value(pdata->enable_gpio, 1); + ++ /* ++ * After EN is deasserted and an external clock is detected, the bridge ++ * will sample GPIO3:1 to determine its frequency. The driver will ++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is ++ * racy. Thus we have to wait a couple of us. According to the datasheet ++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that ++ * is not enough and the refclk frequency value is still lost or ++ * overwritten by the bridge itself. Waiting for 20us seems to work. ++ */ ++ usleep_range(20, 30); ++ + /* + * If we have a reference clock we can enable communication w/ the + * panel (including the aux channel) w/out any need for an input clock +-- +2.51.0 + diff --git a/queue-5.15/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-5.15/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..5cb7b56667 --- /dev/null +++ b/queue-5.15/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From e26410b426d05750cadd91f4c0f8ed6243416674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index e6c90c0bb7646..58782f21a442a 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-5.15/perf-bpf-event-fix-use-after-free-in-synthesis.patch b/queue-5.15/perf-bpf-event-fix-use-after-free-in-synthesis.patch new file mode 100644 index 0000000000..f190d5fded --- /dev/null +++ b/queue-5.15/perf-bpf-event-fix-use-after-free-in-synthesis.patch @@ -0,0 +1,147 @@ +From 132a21457dab32928127fb92cc2e70ae276d2539 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:11 -0700 +Subject: perf bpf-event: Fix use-after-free in synthesis + +From: Ian Rogers + +[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ] + +Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread +may already have inserted the bpf_prog_info. Such failures may yield +info_linear being freed which then causes use-after-free issues with +the internal bpf_prog_info info struct. Make it so that +perf_env__insert_bpf_prog_info trigger early non-error paths and fix +the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper +return error handling to perf_env__add_bpf_info (that calls +perf_env__insert_bpf_prog_info) and propagate the return value in its +callers. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index 41b889ab4d6ab..e96a7fdfe283b 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -301,9 +301,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { +- free(info_linear); ++ /* ++ * Insert failed, likely because of a duplicate event ++ * made by the sideband thread. Ignore synthesizing the ++ * metadata. ++ */ + free(info_node); ++ goto out; + } ++ /* info_linear is now owned by info_node and shouldn't be freed below. */ + info_linear = NULL; + + /* +@@ -459,18 +465,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session, + return err; + } + +-static void perf_env__add_bpf_info(struct perf_env *env, u32 id) ++static int perf_env__add_bpf_info(struct perf_env *env, u32 id) + { + struct bpf_prog_info_linear *info_linear; + struct bpf_prog_info_node *info_node; + struct btf *btf = NULL; + u64 arrays; + u32 btf_id; +- int fd; ++ int fd, err = 0; + + fd = bpf_prog_get_fd_by_id(id); + if (fd < 0) +- return; ++ return -EINVAL; + + arrays = 1UL << BPF_PROG_INFO_JITED_KSYMS; + arrays |= 1UL << BPF_PROG_INFO_JITED_FUNC_LENS; +@@ -483,6 +489,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_linear = bpf_program__get_prog_info_linear(fd, arrays); + if (IS_ERR_OR_NULL(info_linear)) { + pr_debug("%s: failed to get BPF program info. aborting\n", __func__); ++ err = PTR_ERR(info_linear); + goto out; + } + +@@ -492,38 +499,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + if (info_node) { + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ pr_debug("%s: duplicate add bpf info request for id %u\n", ++ __func__, btf_id); + free(info_linear); + free(info_node); ++ goto out; + } +- } else ++ } else { + free(info_linear); ++ err = -ENOMEM; ++ goto out; ++ } + + if (btf_id == 0) + goto out; + + btf = btf__load_from_kernel_by_id(btf_id); +- if (libbpf_get_error(btf)) { +- pr_debug("%s: failed to get BTF of id %u, aborting\n", +- __func__, btf_id); +- goto out; ++ if (!btf) { ++ err = -errno; ++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err); ++ } else { ++ perf_env__fetch_btf(env, btf_id, btf); + } +- perf_env__fetch_btf(env, btf_id, btf); + + out: + btf__free(btf); + close(fd); ++ return err; + } + + static int bpf_event__sb_cb(union perf_event *event, void *data) + { + struct perf_env *env = data; ++ int ret = 0; + + if (event->header.type != PERF_RECORD_BPF_EVENT) + return -1; + + switch (event->bpf.type) { + case PERF_BPF_EVENT_PROG_LOAD: +- perf_env__add_bpf_info(env, event->bpf.id); ++ ret = perf_env__add_bpf_info(env, event->bpf.id); + + case PERF_BPF_EVENT_PROG_UNLOAD: + /* +@@ -537,7 +552,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data) + break; + } + +- return 0; ++ return ret; + } + + int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index a6da30761b..d852f39cb3 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -53,3 +53,9 @@ randstruct-gcc-plugin-remove-bogus-void-member.patch randstruct-gcc-plugin-fix-attribute-addition.patch mm-slub-avoid-accessing-metadata-when-pointer-is-invalid-in-object_err.patch alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch +perf-bpf-event-fix-use-after-free-in-synthesis.patch diff --git a/queue-5.15/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-5.15/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..9d62b26e20 --- /dev/null +++ b/queue-5.15/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 0ed010deb13010de90948e60465e7333bcc27f6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index bf3f600bdd2c8..7ece48667f52d 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-5.15/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-5.15/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..baf8d26043 --- /dev/null +++ b/queue-5.15/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From e3def29096a5a67b29293a0d3026ed43f9645e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index ab096368a1fd5..319cd96bd201b 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-5.15/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-5.15/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..415fcd9dd7 --- /dev/null +++ b/queue-5.15/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From f6e62bcd76184318dfe7a9ec0027bec7faea4519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 7ece48667f52d..ab096368a1fd5 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -71,7 +72,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_MASTER BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-5.4/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-5.4/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..f318b2db10 --- /dev/null +++ b/queue-5.4/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From 604775594aa9203f7f0d40cbb7ab678243ddb25c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 6b311d6f8bf02..12bcbeca4a448 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index f5aad3d79f..6dc9ed1859 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -37,3 +37,7 @@ vmxnet3-update-mtu-after-device-quiesce.patch randstruct-gcc-plugin-remove-bogus-void-member.patch randstruct-gcc-plugin-fix-attribute-addition.patch alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch diff --git a/queue-5.4/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-5.4/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..45bf47d211 --- /dev/null +++ b/queue-5.4/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 555aa44e206c5b471d5b83ae7c7d7853d6517d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 2708bf15e1263..8a4925469dfb9 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -772,7 +772,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-5.4/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-5.4/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..cc065a2c91 --- /dev/null +++ b/queue-5.4/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From 978e8cc7e4ccb74f8d4b7120b9c418fc258ac977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 6cabad2923aec..789cdb001eb64 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -722,12 +722,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-5.4/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-5.4/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..ab019cbc6f --- /dev/null +++ b/queue-5.4/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From c9baab8936605e290dd262982d33cb1f2996b4b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 8a4925469dfb9..6cabad2923aec 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -74,7 +75,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_MASTER BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -415,7 +416,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch b/queue-6.1/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch new file mode 100644 index 0000000000..476d607e2a --- /dev/null +++ b/queue-6.1/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch @@ -0,0 +1,39 @@ +From 8faed373c4d8b83beffbf55f7082d01104dec7b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:40:50 +0100 +Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure + +From: Colin Ian King + +[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ] + +Currently the kzalloc failure check just sets reports the failure +and sets the variable ret to -ENOMEM, which is not checked later +for this specific error. Fix this by just returning -ENOMEM rather +than setting ret. + +Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index df38eb9604ec3..0bc21106d9e87 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -373,7 +373,7 @@ static int psp_sw_init(void *handle) + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { + dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); +- ret = -ENOMEM; ++ return -ENOMEM; + } + + if (amdgpu_sriov_vf(adev)) +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-amdgpu-fix-style-problems-in-amdgpu_psp.c.patch b/queue-6.1/drm-amd-amdgpu-fix-style-problems-in-amdgpu_psp.c.patch new file mode 100644 index 0000000000..00000f99d9 --- /dev/null +++ b/queue-6.1/drm-amd-amdgpu-fix-style-problems-in-amdgpu_psp.c.patch @@ -0,0 +1,222 @@ +From d70803644c507806bf16733a1cb5d0e91c43c1b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 17:22:20 +0530 +Subject: drm/amd/amdgpu: Fix style problems in amdgpu_psp.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit f14c8c3e1fc9e10c6d54999a96acb2b5087374df ] + +Fix the following checkpatch warnings & error in amdgpu_psp.c + +WARNING: Comparisons should place the constant on the right side of the test +WARNING: braces {} are not necessary for single statement blocks +WARNING: please, no space before tabs +WARNING: braces {} are not necessary for single statement blocks +ERROR: that open brace { should be on the previous line + +Suggested-by: Christian König +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 51 ++++++++++--------------- + 1 file changed, 20 insertions(+), 31 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index ff3678a1c0296..459a5af3a99ac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -392,7 +392,7 @@ static int psp_sw_init(void *handle) + if ((psp_get_runtime_db_entry(adev, + PSP_RUNTIME_ENTRY_TYPE_PPTABLE_ERR_STATUS, + &scpm_entry)) && +- (SCPM_DISABLE != scpm_entry.scpm_status)) { ++ (scpm_entry.scpm_status != SCPM_DISABLE)) { + adev->scpm_enabled = true; + adev->scpm_status = scpm_entry.scpm_status; + } else { +@@ -439,10 +439,9 @@ static int psp_sw_init(void *handle) + + if (adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 0) || + adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 7)) { +- ret= psp_sysfs_init(adev); +- if (ret) { ++ ret = psp_sysfs_init(adev); ++ if (ret) + return ret; +- } + } + + ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +@@ -641,7 +640,7 @@ psp_cmd_submit_buf(struct psp_context *psp, + skip_unsupport = (psp->cmd_buf_mem->resp.status == TEE_ERROR_NOT_SUPPORTED || + psp->cmd_buf_mem->resp.status == PSP_ERR_UNKNOWN_COMMAND) && amdgpu_sriov_vf(psp->adev); + +- memcpy((void*)&cmd->resp, (void*)&psp->cmd_buf_mem->resp, sizeof(struct psp_gfx_resp)); ++ memcpy(&cmd->resp, &psp->cmd_buf_mem->resp, sizeof(struct psp_gfx_resp)); + + /* In some cases, psp response status is not 0 even there is no + * problem while the command is submitted. Some version of PSP FW +@@ -823,7 +822,7 @@ static int psp_tmr_load(struct psp_context *psp) + } + + static void psp_prep_tmr_unload_cmd_buf(struct psp_context *psp, +- struct psp_gfx_cmd_resp *cmd) ++ struct psp_gfx_cmd_resp *cmd) + { + if (amdgpu_sriov_vf(psp->adev)) + cmd->cmd_id = GFX_CMD_ID_DESTROY_VMR; +@@ -1052,7 +1051,7 @@ static void psp_prep_ta_load_cmd_buf(struct psp_gfx_cmd_resp *cmd, + struct ta_context *context) + { + cmd->cmd_id = context->ta_load_type; +- cmd->cmd.cmd_load_ta.app_phy_addr_lo = lower_32_bits(ta_bin_mc); ++ cmd->cmd.cmd_load_ta.app_phy_addr_lo = lower_32_bits(ta_bin_mc); + cmd->cmd.cmd_load_ta.app_phy_addr_hi = upper_32_bits(ta_bin_mc); + cmd->cmd.cmd_load_ta.app_len = context->bin_desc.size_bytes; + +@@ -1158,9 +1157,8 @@ int psp_ta_load(struct psp_context *psp, struct ta_context *context) + + context->resp_status = cmd->resp.status; + +- if (!ret) { ++ if (!ret) + context->session_id = cmd->resp.session_id; +- } + + release_psp_cmd_buf(psp); + +@@ -1490,8 +1488,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id) + if (amdgpu_ras_intr_triggered()) + return ret; + +- if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) +- { ++ if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) { + DRM_WARN("RAS: Unsupported Interface"); + return -EINVAL; + } +@@ -1501,8 +1498,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id) + dev_warn(psp->adev->dev, "ECC switch disabled\n"); + + ras_cmd->ras_status = TA_RAS_STATUS__ERROR_RAS_NOT_AVAILABLE; +- } +- else if (ras_cmd->ras_out_message.flags.reg_access_failure_flag) ++ } else if (ras_cmd->ras_out_message.flags.reg_access_failure_flag) + dev_warn(psp->adev->dev, + "RAS internal register access blocked\n"); + +@@ -1598,11 +1594,10 @@ static int psp_ras_initialize(struct psp_context *psp) + if (ret) + dev_warn(adev->dev, "PSP set boot config failed\n"); + else +- dev_warn(adev->dev, "GECC will be disabled in next boot cycle " +- "if set amdgpu_ras_enable and/or amdgpu_ras_mask to 0x0\n"); ++ dev_warn(adev->dev, "GECC will be disabled in next boot cycle if set amdgpu_ras_enable and/or amdgpu_ras_mask to 0x0\n"); + } + } else { +- if (1 == boot_cfg) { ++ if (boot_cfg == 1) { + dev_info(adev->dev, "GECC is enabled\n"); + } else { + /* enable GECC in next boot cycle if it is disabled +@@ -2389,7 +2384,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, + } + + static int psp_execute_non_psp_fw_load(struct psp_context *psp, +- struct amdgpu_firmware_info *ucode) ++ struct amdgpu_firmware_info *ucode) + { + int ret = 0; + struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp); +@@ -2428,9 +2423,8 @@ static int psp_load_smu_fw(struct psp_context *psp) + (adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 4) || + adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) { + ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD); +- if (ret) { ++ if (ret) + DRM_WARN("Failed to set MP1 state prepare for reload\n"); +- } + } + + ret = psp_execute_non_psp_fw_load(psp, ucode); +@@ -2740,9 +2734,8 @@ static int psp_suspend(void *handle) + } + + ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); +- if (ret) { ++ if (ret) + DRM_ERROR("PSP ring stop failed\n"); +- } + + out: + return ret; +@@ -3015,7 +3008,7 @@ static int parse_sos_bin_descriptor(struct psp_context *psp, + psp->sos.fw_version = le32_to_cpu(desc->fw_version); + psp->sos.feature_version = le32_to_cpu(desc->fw_version); + psp->sos.size_bytes = le32_to_cpu(desc->size_bytes); +- psp->sos.start_addr = ucode_start_addr; ++ psp->sos.start_addr = ucode_start_addr; + break; + case PSP_FW_TYPE_PSP_SYS_DRV: + psp->sys.fw_version = le32_to_cpu(desc->fw_version); +@@ -3501,7 +3494,7 @@ void psp_copy_fw(struct psp_context *psp, uint8_t *start_addr, uint32_t bin_size + drm_dev_exit(idx); + } + +-static DEVICE_ATTR(usbc_pd_fw, S_IRUGO | S_IWUSR, ++static DEVICE_ATTR(usbc_pd_fw, 0644, + psp_usbc_pd_fw_sysfs_read, + psp_usbc_pd_fw_sysfs_write); + +@@ -3686,8 +3679,7 @@ static void psp_sysfs_fini(struct amdgpu_device *adev) + device_remove_file(adev->dev, &dev_attr_usbc_pd_fw); + } + +-const struct amdgpu_ip_block_version psp_v3_1_ip_block = +-{ ++const struct amdgpu_ip_block_version psp_v3_1_ip_block = { + .type = AMD_IP_BLOCK_TYPE_PSP, + .major = 3, + .minor = 1, +@@ -3695,8 +3687,7 @@ const struct amdgpu_ip_block_version psp_v3_1_ip_block = + .funcs = &psp_ip_funcs, + }; + +-const struct amdgpu_ip_block_version psp_v10_0_ip_block = +-{ ++const struct amdgpu_ip_block_version psp_v10_0_ip_block = { + .type = AMD_IP_BLOCK_TYPE_PSP, + .major = 10, + .minor = 0, +@@ -3704,8 +3695,7 @@ const struct amdgpu_ip_block_version psp_v10_0_ip_block = + .funcs = &psp_ip_funcs, + }; + +-const struct amdgpu_ip_block_version psp_v11_0_ip_block = +-{ ++const struct amdgpu_ip_block_version psp_v11_0_ip_block = { + .type = AMD_IP_BLOCK_TYPE_PSP, + .major = 11, + .minor = 0, +@@ -3721,8 +3711,7 @@ const struct amdgpu_ip_block_version psp_v11_0_8_ip_block = { + .funcs = &psp_ip_funcs, + }; + +-const struct amdgpu_ip_block_version psp_v12_0_ip_block = +-{ ++const struct amdgpu_ip_block_version psp_v12_0_ip_block = { + .type = AMD_IP_BLOCK_TYPE_PSP, + .major = 12, + .minor = 0, +-- +2.51.0 + diff --git a/queue-6.1/drm-amd-make-flashing-messages-quieter.patch b/queue-6.1/drm-amd-make-flashing-messages-quieter.patch new file mode 100644 index 0000000000..2b6310c650 --- /dev/null +++ b/queue-6.1/drm-amd-make-flashing-messages-quieter.patch @@ -0,0 +1,63 @@ +From a353edecf8821c87c0f111141a7c842a43a1d47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 10:04:05 -0500 +Subject: drm/amd: Make flashing messages quieter + +From: Mario Limonciello + +[ Upstream commit 1cc506f08b4c4688c729e48d7c665910ed330724 ] + +Debug messages related to the kernel process of flashing an updated +IFWI are needlessly noisy and also confusing. + +Downgrade them to debug instead and clarify what they are actually +doing. + +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index cbee5c6cdb369..f720aa06fb3d6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -3552,7 +3552,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size += count; + mutex_unlock(&adev->psp.mutex); + +- dev_info(adev->dev, "VBIOS flash write PSP done"); ++ dev_dbg(adev->dev, "IFWI staged for update"); + + return count; + } +@@ -3572,7 +3572,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + if (adev->psp.vbflash_image_size == 0) + return -EINVAL; + +- dev_info(adev->dev, "VBIOS flash to PSP started"); ++ dev_dbg(adev->dev, "PSP IFWI flash process initiated"); + + ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size, + AMDGPU_GPU_PAGE_SIZE, +@@ -3597,11 +3597,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size = 0; + + if (ret) { +- dev_err(adev->dev, "Failed to load VBIOS FW, err = %d", ret); ++ dev_err(adev->dev, "Failed to load IFWI, err = %d", ret); + return ret; + } + +- dev_info(adev->dev, "VBIOS flash to PSP done"); ++ dev_dbg(adev->dev, "PSP IFWI flash process done"); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-optimize-ras-ta-initialization-and-ta-unl.patch b/queue-6.1/drm-amdgpu-optimize-ras-ta-initialization-and-ta-unl.patch new file mode 100644 index 0000000000..9f186bcce1 --- /dev/null +++ b/queue-6.1/drm-amdgpu-optimize-ras-ta-initialization-and-ta-unl.patch @@ -0,0 +1,67 @@ +From 5e2a2f104b05e35e328c7a07cb30848923a299fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 18:07:44 +0800 +Subject: drm/amdgpu: Optimize RAS TA initialization and TA unload funcs + +From: Candice Li + +[ Upstream commit bf7d777289d106963fd2080d298e6b88b7263b66 ] + +1. Save TA unload psp response status +2. Add RAS TA loading status check for initializaiton +3. Drop RAS context teardown to allow RAS TA to be reloaded + +Reviewed-by: Hawking Zhang +Signed-off-by: Candice Li +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index ae6643c8ade6c..d101333fe3a57 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -994,6 +994,8 @@ int psp_ta_unload(struct psp_context *psp, struct ta_context *context) + + ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr); + ++ context->resp_status = cmd->resp.status; ++ + release_psp_cmd_buf(psp); + + return ret; +@@ -1569,6 +1571,11 @@ static int psp_ras_initialize(struct psp_context *psp) + if (amdgpu_sriov_vf(adev)) + return 0; + ++ if (psp->ras_context.context.initialized) { ++ dev_warn(adev->dev, "RAS WARN: TA has already been loaded\n"); ++ return 0; ++ } ++ + if (!adev->psp.ras_context.context.bin_desc.size_bytes || + !adev->psp.ras_context.context.bin_desc.start_addr) { + dev_info(adev->dev, "RAS: optional ras ta ucode is not available\n"); +@@ -1619,7 +1626,7 @@ static int psp_ras_initialize(struct psp_context *psp) + psp->ras_context.context.mem_context.shared_mem_size = PSP_RAS_SHARED_MEM_SIZE; + psp->ras_context.context.ta_load_type = GFX_CMD_ID_LOAD_TA; + +- if (!psp->ras_context.context.initialized) { ++ if (!psp->ras_context.context.mem_context.shared_buf) { + ret = psp_ta_init_shared_buf(psp, &psp->ras_context.context.mem_context); + if (ret) + return ret; +@@ -1640,7 +1647,6 @@ static int psp_ras_initialize(struct psp_context *psp) + else { + if (ras_cmd->ras_status) + dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); +- amdgpu_ras_fini(psp->adev); + } + + return ret; +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-remove-the-check-of-init-status-in-psp_ra.patch b/queue-6.1/drm-amdgpu-remove-the-check-of-init-status-in-psp_ra.patch new file mode 100644 index 0000000000..728461267b --- /dev/null +++ b/queue-6.1/drm-amdgpu-remove-the-check-of-init-status-in-psp_ra.patch @@ -0,0 +1,51 @@ +From 36d157f41f0502f28d45f03623fbaf943d5293c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 14:37:08 +0800 +Subject: drm/amdgpu: remove the check of init status in psp_ras_initialize + +From: Tao Zhou + +[ Upstream commit 3e931368091f7d5d7902cee9d410eb6db2eea419 ] + +The initialized status indicates RAS TA is loaded, but in some cases +(such as RAS fatal error) RAS TA could be destroyed although it's not +unloaded. Hence we load RAS TA unconditionally here. + +Signed-off-by: Tao Zhou +Reviewed-by: Candice Li +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index d101333fe3a57..ff3678a1c0296 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1571,11 +1571,6 @@ static int psp_ras_initialize(struct psp_context *psp) + if (amdgpu_sriov_vf(adev)) + return 0; + +- if (psp->ras_context.context.initialized) { +- dev_warn(adev->dev, "RAS WARN: TA has already been loaded\n"); +- return 0; +- } +- + if (!adev->psp.ras_context.context.bin_desc.size_bytes || + !adev->psp.ras_context.context.bin_desc.start_addr) { + dev_info(adev->dev, "RAS: optional ras ta ucode is not available\n"); +@@ -1647,6 +1642,9 @@ static int psp_ras_initialize(struct psp_context *psp) + else { + if (ras_cmd->ras_status) + dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); ++ ++ /* fail to load RAS TA */ ++ psp->ras_context.context.initialized = false; + } + + return ret; +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch b/queue-6.1/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch new file mode 100644 index 0000000000..f14f1a1813 --- /dev/null +++ b/queue-6.1/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch @@ -0,0 +1,563 @@ +From edccf14314436c72dae90c0673908c7cb267e92a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Dec 2023 18:14:23 +0800 +Subject: drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c + +From: Hawking Zhang + +[ Upstream commit ac3ff8a90637e813005404a0110802aa384af4aa ] + +So kernel message has the device pcie bdf information, +which helps issue debugging especially in multiple GPU +system. + +Signed-off-by: Hawking Zhang +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 144 ++++++++++++------------ + 1 file changed, 75 insertions(+), 69 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index f720aa06fb3d6..df38eb9604ec3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -222,21 +222,22 @@ static int psp_memory_training_init(struct psp_context *psp) + struct psp_memory_training_context *ctx = &psp->mem_train_ctx; + + if (ctx->init != PSP_MEM_TRAIN_RESERVE_SUCCESS) { +- DRM_DEBUG("memory training is not supported!\n"); ++ dev_dbg(psp->adev->dev, "memory training is not supported!\n"); + return 0; + } + + ctx->sys_cache = kzalloc(ctx->train_data_size, GFP_KERNEL); + if (ctx->sys_cache == NULL) { +- DRM_ERROR("alloc mem_train_ctx.sys_cache failed!\n"); ++ dev_err(psp->adev->dev, "alloc mem_train_ctx.sys_cache failed!\n"); + ret = -ENOMEM; + goto Err_out; + } + +- DRM_DEBUG("train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", +- ctx->train_data_size, +- ctx->p2c_train_data_offset, +- ctx->c2p_train_data_offset); ++ dev_dbg(psp->adev->dev, ++ "train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", ++ ctx->train_data_size, ++ ctx->p2c_train_data_offset, ++ ctx->c2p_train_data_offset); + ctx->init = PSP_MEM_TRAIN_INIT_SUCCESS; + return 0; + +@@ -371,7 +372,7 @@ static int psp_sw_init(void *handle) + + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { +- DRM_ERROR("Failed to allocate memory to command buffer!\n"); ++ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); + ret = -ENOMEM; + } + +@@ -426,13 +427,13 @@ static int psp_sw_init(void *handle) + if (mem_training_ctx->enable_mem_training) { + ret = psp_memory_training_init(psp); + if (ret) { +- DRM_ERROR("Failed to initialize memory training!\n"); ++ dev_err(adev->dev, "Failed to initialize memory training!\n"); + return ret; + } + + ret = psp_mem_training(psp, PSP_MEM_TRAIN_COLD_BOOT); + if (ret) { +- DRM_ERROR("Failed to process memory training!\n"); ++ dev_err(adev->dev, "Failed to process memory training!\n"); + return ret; + } + } +@@ -651,9 +652,11 @@ psp_cmd_submit_buf(struct psp_context *psp, + */ + if (!skip_unsupport && (psp->cmd_buf_mem->resp.status || !timeout) && !ras_intr) { + if (ucode) +- DRM_WARN("failed to load ucode %s(0x%X) ", +- amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); +- DRM_WARN("psp gfx command %s(0x%X) failed and response status is (0x%X)\n", ++ dev_warn(psp->adev->dev, ++ "failed to load ucode %s(0x%X) ", ++ amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); ++ dev_warn(psp->adev->dev, ++ "psp gfx command %s(0x%X) failed and response status is (0x%X)\n", + psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id, + psp->cmd_buf_mem->resp.status); + /* If any firmware (including CAP) load fails under SRIOV, it should +@@ -783,7 +786,7 @@ static int psp_tmr_init(struct psp_context *psp) + psp->fw_pri_buf) { + ret = psp_load_toc(psp, &tmr_size); + if (ret) { +- DRM_ERROR("Failed to load toc\n"); ++ dev_err(psp->adev->dev, "Failed to load toc\n"); + return ret; + } + } +@@ -826,7 +829,7 @@ static int psp_tmr_load(struct psp_context *psp) + + psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo); + if (psp->tmr_bo) +- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n", ++ dev_info(psp->adev->dev, "reserve 0x%lx from 0x%llx for PSP TMR\n", + amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr); + + ret = psp_cmd_submit_buf(psp, NULL, cmd, +@@ -1055,7 +1058,7 @@ int psp_reg_program(struct psp_context *psp, enum psp_reg_prog_id reg, + psp_prep_reg_prog_cmd_buf(cmd, reg, value); + ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr); + if (ret) +- DRM_ERROR("PSP failed to program reg id %d", reg); ++ dev_err(psp->adev->dev, "PSP failed to program reg id %d\n", reg); + + release_psp_cmd_buf(psp); + +@@ -1466,22 +1469,22 @@ static void psp_ras_ta_check_status(struct psp_context *psp) + switch (ras_cmd->ras_status) { + case TA_RAS_STATUS__ERROR_UNSUPPORTED_IP: + dev_warn(psp->adev->dev, +- "RAS WARNING: cmd failed due to unsupported ip\n"); ++ "RAS WARNING: cmd failed due to unsupported ip\n"); + break; + case TA_RAS_STATUS__ERROR_UNSUPPORTED_ERROR_INJ: + dev_warn(psp->adev->dev, +- "RAS WARNING: cmd failed due to unsupported error injection\n"); ++ "RAS WARNING: cmd failed due to unsupported error injection\n"); + break; + case TA_RAS_STATUS__SUCCESS: + break; + case TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED: + if (ras_cmd->cmd_id == TA_RAS_COMMAND__TRIGGER_ERROR) + dev_warn(psp->adev->dev, +- "RAS WARNING: Inject error to critical region is not allowed\n"); ++ "RAS WARNING: Inject error to critical region is not allowed\n"); + break; + default: + dev_warn(psp->adev->dev, +- "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); ++ "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); + break; + } + } +@@ -1505,7 +1508,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id) + return ret; + + if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) { +- DRM_WARN("RAS: Unsupported Interface"); ++ dev_warn(psp->adev->dev, "RAS: Unsupported Interface\n"); + return -EINVAL; + } + +@@ -1652,7 +1655,7 @@ static int psp_ras_initialize(struct psp_context *psp) + psp->ras_context.context.initialized = true; + else { + if (ras_cmd->ras_status) +- dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); ++ dev_warn(adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); + + /* fail to load RAS TA */ + psp->ras_context.context.initialized = false; +@@ -2036,7 +2039,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_kdb != NULL)) { + ret = psp_bootloader_load_kdb(psp); + if (ret) { +- DRM_ERROR("PSP load kdb failed!\n"); ++ dev_err(adev->dev, "PSP load kdb failed!\n"); + return ret; + } + } +@@ -2045,7 +2048,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_spl != NULL)) { + ret = psp_bootloader_load_spl(psp); + if (ret) { +- DRM_ERROR("PSP load spl failed!\n"); ++ dev_err(adev->dev, "PSP load spl failed!\n"); + return ret; + } + } +@@ -2054,7 +2057,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_sysdrv != NULL)) { + ret = psp_bootloader_load_sysdrv(psp); + if (ret) { +- DRM_ERROR("PSP load sys drv failed!\n"); ++ dev_err(adev->dev, "PSP load sys drv failed!\n"); + return ret; + } + } +@@ -2063,7 +2066,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_soc_drv != NULL)) { + ret = psp_bootloader_load_soc_drv(psp); + if (ret) { +- DRM_ERROR("PSP load soc drv failed!\n"); ++ dev_err(adev->dev, "PSP load soc drv failed!\n"); + return ret; + } + } +@@ -2072,7 +2075,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_intf_drv != NULL)) { + ret = psp_bootloader_load_intf_drv(psp); + if (ret) { +- DRM_ERROR("PSP load intf drv failed!\n"); ++ dev_err(adev->dev, "PSP load intf drv failed!\n"); + return ret; + } + } +@@ -2081,7 +2084,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_dbg_drv != NULL)) { + ret = psp_bootloader_load_dbg_drv(psp); + if (ret) { +- DRM_ERROR("PSP load dbg drv failed!\n"); ++ dev_err(adev->dev, "PSP load dbg drv failed!\n"); + return ret; + } + } +@@ -2090,7 +2093,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_ras_drv != NULL)) { + ret = psp_bootloader_load_ras_drv(psp); + if (ret) { +- DRM_ERROR("PSP load ras_drv failed!\n"); ++ dev_err(adev->dev, "PSP load ras_drv failed!\n"); + return ret; + } + } +@@ -2099,7 +2102,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_sos != NULL)) { + ret = psp_bootloader_load_sos(psp); + if (ret) { +- DRM_ERROR("PSP load sos failed!\n"); ++ dev_err(adev->dev, "PSP load sos failed!\n"); + return ret; + } + } +@@ -2107,7 +2110,7 @@ static int psp_hw_start(struct psp_context *psp) + + ret = psp_ring_create(psp, PSP_RING_TYPE__KM); + if (ret) { +- DRM_ERROR("PSP create ring failed!\n"); ++ dev_err(adev->dev, "PSP create ring failed!\n"); + return ret; + } + +@@ -2117,7 +2120,7 @@ static int psp_hw_start(struct psp_context *psp) + if (!psp_boottime_tmr(psp)) { + ret = psp_tmr_init(psp); + if (ret) { +- DRM_ERROR("PSP tmr init failed!\n"); ++ dev_err(adev->dev, "PSP tmr init failed!\n"); + return ret; + } + } +@@ -2136,7 +2139,7 @@ static int psp_hw_start(struct psp_context *psp) + + ret = psp_tmr_load(psp); + if (ret) { +- DRM_ERROR("PSP load tmr failed!\n"); ++ dev_err(adev->dev, "PSP load tmr failed!\n"); + return ret; + } + +@@ -2383,7 +2386,8 @@ static void psp_print_fw_hdr(struct psp_context *psp, + } + } + +-static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, ++static int psp_prep_load_ip_fw_cmd_buf(struct psp_context *psp, ++ struct amdgpu_firmware_info *ucode, + struct psp_gfx_cmd_resp *cmd) + { + int ret; +@@ -2396,7 +2400,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, + + ret = psp_get_fw_type(ucode, &cmd->cmd.cmd_load_ip_fw.fw_type); + if (ret) +- DRM_ERROR("Unknown firmware type\n"); ++ dev_err(psp->adev->dev, "Unknown firmware type\n"); + + return ret; + } +@@ -2407,7 +2411,7 @@ static int psp_execute_non_psp_fw_load(struct psp_context *psp, + int ret = 0; + struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp); + +- ret = psp_prep_load_ip_fw_cmd_buf(ucode, cmd); ++ ret = psp_prep_load_ip_fw_cmd_buf(psp, ucode, cmd); + if (!ret) { + ret = psp_cmd_submit_buf(psp, ucode, cmd, + psp->fence_buf_mc_addr); +@@ -2442,13 +2446,13 @@ static int psp_load_smu_fw(struct psp_context *psp) + adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) { + ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD); + if (ret) +- DRM_WARN("Failed to set MP1 state prepare for reload\n"); ++ dev_err(adev->dev, "Failed to set MP1 state prepare for reload\n"); + } + + ret = psp_execute_non_psp_fw_load(psp, ucode); + + if (ret) +- DRM_ERROR("PSP load smu failed!\n"); ++ dev_err(adev->dev, "PSP load smu failed!\n"); + + return ret; + } +@@ -2543,7 +2547,7 @@ static int psp_load_non_psp_fw(struct psp_context *psp) + adev->virt.autoload_ucode_id : AMDGPU_UCODE_ID_RLC_G)) { + ret = psp_rlc_autoload_start(psp); + if (ret) { +- DRM_ERROR("Failed to start rlc autoload\n"); ++ dev_err(adev->dev, "Failed to start rlc autoload\n"); + return ret; + } + } +@@ -2565,7 +2569,7 @@ static int psp_load_fw(struct amdgpu_device *adev) + + ret = psp_ring_init(psp, PSP_RING_TYPE__KM); + if (ret) { +- DRM_ERROR("PSP ring init failed!\n"); ++ dev_err(adev->dev, "PSP ring init failed!\n"); + goto failed; + } + } +@@ -2580,13 +2584,13 @@ static int psp_load_fw(struct amdgpu_device *adev) + + ret = psp_asd_initialize(psp); + if (ret) { +- DRM_ERROR("PSP load asd failed!\n"); ++ dev_err(adev->dev, "PSP load asd failed!\n"); + goto failed1; + } + + ret = psp_rl_load(adev); + if (ret) { +- DRM_ERROR("PSP load RL failed!\n"); ++ dev_err(adev->dev, "PSP load RL failed!\n"); + goto failed1; + } + +@@ -2606,7 +2610,7 @@ static int psp_load_fw(struct amdgpu_device *adev) + ret = psp_ras_initialize(psp); + if (ret) + dev_err(psp->adev->dev, +- "RAS: Failed to initialize RAS\n"); ++ "RAS: Failed to initialize RAS\n"); + + ret = psp_hdcp_initialize(psp); + if (ret) +@@ -2659,7 +2663,7 @@ static int psp_hw_init(void *handle) + + ret = psp_load_fw(adev); + if (ret) { +- DRM_ERROR("PSP firmware loading failed\n"); ++ dev_err(adev->dev, "PSP firmware loading failed\n"); + goto failed; + } + +@@ -2706,7 +2710,7 @@ static int psp_suspend(void *handle) + psp->xgmi_context.context.initialized) { + ret = psp_xgmi_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate xgmi ta\n"); ++ dev_err(adev->dev, "Failed to terminate xgmi ta\n"); + goto out; + } + } +@@ -2714,46 +2718,46 @@ static int psp_suspend(void *handle) + if (psp->ta_fw) { + ret = psp_ras_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate ras ta\n"); ++ dev_err(adev->dev, "Failed to terminate ras ta\n"); + goto out; + } + ret = psp_hdcp_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate hdcp ta\n"); ++ dev_err(adev->dev, "Failed to terminate hdcp ta\n"); + goto out; + } + ret = psp_dtm_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate dtm ta\n"); ++ dev_err(adev->dev, "Failed to terminate dtm ta\n"); + goto out; + } + ret = psp_rap_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate rap ta\n"); ++ dev_err(adev->dev, "Failed to terminate rap ta\n"); + goto out; + } + ret = psp_securedisplay_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate securedisplay ta\n"); ++ dev_err(adev->dev, "Failed to terminate securedisplay ta\n"); + goto out; + } + } + + ret = psp_asd_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate asd\n"); ++ dev_err(adev->dev, "Failed to terminate asd\n"); + goto out; + } + + ret = psp_tmr_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate tmr\n"); ++ dev_err(adev->dev, "Failed to terminate tmr\n"); + goto out; + } + + ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); + if (ret) +- DRM_ERROR("PSP ring stop failed\n"); ++ dev_err(adev->dev, "PSP ring stop failed\n"); + + out: + return ret; +@@ -2765,12 +2769,12 @@ static int psp_resume(void *handle) + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct psp_context *psp = &adev->psp; + +- DRM_INFO("PSP is resuming...\n"); ++ dev_info(adev->dev, "PSP is resuming...\n"); + + if (psp->mem_train_ctx.enable_mem_training) { + ret = psp_mem_training(psp, PSP_MEM_TRAIN_RESUME); + if (ret) { +- DRM_ERROR("Failed to process memory training!\n"); ++ dev_err(adev->dev, "Failed to process memory training!\n"); + return ret; + } + } +@@ -2787,7 +2791,7 @@ static int psp_resume(void *handle) + + ret = psp_asd_initialize(psp); + if (ret) { +- DRM_ERROR("PSP load asd failed!\n"); ++ dev_err(adev->dev, "PSP load asd failed!\n"); + goto failed; + } + +@@ -2811,7 +2815,7 @@ static int psp_resume(void *handle) + ret = psp_ras_initialize(psp); + if (ret) + dev_err(psp->adev->dev, +- "RAS: Failed to initialize RAS\n"); ++ "RAS: Failed to initialize RAS\n"); + + ret = psp_hdcp_initialize(psp); + if (ret) +@@ -2839,7 +2843,7 @@ static int psp_resume(void *handle) + return 0; + + failed: +- DRM_ERROR("PSP resume failed\n"); ++ dev_err(adev->dev, "PSP resume failed\n"); + mutex_unlock(&adev->firmware.mutex); + return ret; + } +@@ -2913,9 +2917,11 @@ int psp_ring_cmd_submit(struct psp_context *psp, + write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw); + /* Check invalid write_frame ptr address */ + if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) { +- DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", +- ring_buffer_start, ring_buffer_end, write_frame); +- DRM_ERROR("write_frame is pointing to address out of bounds\n"); ++ dev_err(adev->dev, ++ "ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", ++ ring_buffer_start, ring_buffer_end, write_frame); ++ dev_err(adev->dev, ++ "write_frame is pointing to address out of bounds\n"); + return -EINVAL; + } + +@@ -3427,7 +3433,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, + int ret; + + if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { +- DRM_INFO("PSP block is not ready yet."); ++ dev_info(adev->dev, "PSP block is not ready yet\n."); + return -EBUSY; + } + +@@ -3436,7 +3442,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, + mutex_unlock(&adev->psp.mutex); + + if (ret) { +- DRM_ERROR("Failed to read USBC PD FW, err = %d", ret); ++ dev_err(adev->dev, "Failed to read USBC PD FW, err = %d\n", ret); + return ret; + } + +@@ -3458,7 +3464,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, + void *fw_pri_cpu_addr; + + if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { +- DRM_INFO("PSP block is not ready yet."); ++ dev_err(adev->dev, "PSP block is not ready yet."); + return -EBUSY; + } + +@@ -3491,7 +3497,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, + release_firmware(usbc_pd_fw); + fail: + if (ret) { +- DRM_ERROR("Failed to load USBC PD FW, err = %d", ret); ++ dev_err(adev->dev, "Failed to load USBC PD FW, err = %d", ret); + count = ret; + } + +@@ -3533,7 +3539,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, + + /* Safeguard against memory drain */ + if (adev->psp.vbflash_image_size > AMD_VBIOS_FILE_MAX_SIZE_B) { +- dev_err(adev->dev, "File size cannot exceed %u", AMD_VBIOS_FILE_MAX_SIZE_B); ++ dev_err(adev->dev, "File size cannot exceed %u\n", AMD_VBIOS_FILE_MAX_SIZE_B); + kvfree(adev->psp.vbflash_tmp_buf); + adev->psp.vbflash_tmp_buf = NULL; + adev->psp.vbflash_image_size = 0; +@@ -3552,7 +3558,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size += count; + mutex_unlock(&adev->psp.mutex); + +- dev_dbg(adev->dev, "IFWI staged for update"); ++ dev_dbg(adev->dev, "IFWI staged for update\n"); + + return count; + } +@@ -3572,7 +3578,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + if (adev->psp.vbflash_image_size == 0) + return -EINVAL; + +- dev_dbg(adev->dev, "PSP IFWI flash process initiated"); ++ dev_dbg(adev->dev, "PSP IFWI flash process initiated\n"); + + ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size, + AMDGPU_GPU_PAGE_SIZE, +@@ -3597,11 +3603,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size = 0; + + if (ret) { +- dev_err(adev->dev, "Failed to load IFWI, err = %d", ret); ++ dev_err(adev->dev, "Failed to load IFWI, err = %d\n", ret); + return ret; + } + +- dev_dbg(adev->dev, "PSP IFWI flash process done"); ++ dev_dbg(adev->dev, "PSP IFWI flash process done\n"); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/drm-amdgpu-skip-tmr-allocation-if-not-required.patch b/queue-6.1/drm-amdgpu-skip-tmr-allocation-if-not-required.patch new file mode 100644 index 0000000000..9478c4c847 --- /dev/null +++ b/queue-6.1/drm-amdgpu-skip-tmr-allocation-if-not-required.patch @@ -0,0 +1,91 @@ +From b2fe0c8a37ff1e52551736067338af947caa9335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:23:58 +0530 +Subject: drm/amdgpu: Skip TMR allocation if not required + +From: Lijo Lazar + +[ Upstream commit 5b03127d4745d6848f208463390e6a76d489eb03 ] + +On ASICs with PSPv13.0.6, TMR is reserved at boot time. There is no need +to allocate TMR region by driver. However, it's still required to send +SETUP_TMR command to PSP. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 34 +++++++++++++++++++------ + 1 file changed, 26 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 459a5af3a99ac..cbee5c6cdb369 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -697,8 +697,13 @@ static void psp_prep_tmr_cmd_buf(struct psp_context *psp, + uint64_t tmr_mc, struct amdgpu_bo *tmr_bo) + { + struct amdgpu_device *adev = psp->adev; +- uint32_t size = amdgpu_bo_size(tmr_bo); +- uint64_t tmr_pa = amdgpu_gmc_vram_pa(adev, tmr_bo); ++ uint32_t size = 0; ++ uint64_t tmr_pa = 0; ++ ++ if (tmr_bo) { ++ size = amdgpu_bo_size(tmr_bo); ++ tmr_pa = amdgpu_gmc_vram_pa(adev, tmr_bo); ++ } + + if (amdgpu_sriov_vf(psp->adev)) + cmd->cmd_id = GFX_CMD_ID_SETUP_VMR; +@@ -743,6 +748,16 @@ static int psp_load_toc(struct psp_context *psp, + return ret; + } + ++static bool psp_boottime_tmr(struct psp_context *psp) ++{ ++ switch (psp->adev->ip_versions[MP0_HWIP][0]) { ++ case IP_VERSION(13, 0, 6): ++ return true; ++ default: ++ return false; ++ } ++} ++ + /* Set up Trusted Memory Region */ + static int psp_tmr_init(struct psp_context *psp) + { +@@ -810,8 +825,9 @@ static int psp_tmr_load(struct psp_context *psp) + cmd = acquire_psp_cmd_buf(psp); + + psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo); +- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n", +- amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr); ++ if (psp->tmr_bo) ++ DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n", ++ amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr); + + ret = psp_cmd_submit_buf(psp, NULL, cmd, + psp->fence_buf_mc_addr); +@@ -2098,10 +2114,12 @@ static int psp_hw_start(struct psp_context *psp) + if (amdgpu_sriov_vf(adev) && amdgpu_in_reset(adev)) + goto skip_pin_bo; + +- ret = psp_tmr_init(psp); +- if (ret) { +- DRM_ERROR("PSP tmr init failed!\n"); +- return ret; ++ if (!psp_boottime_tmr(psp)) { ++ ret = psp_tmr_init(psp); ++ if (ret) { ++ DRM_ERROR("PSP tmr init failed!\n"); ++ return ret; ++ } + } + + skip_pin_bo: +-- +2.51.0 + diff --git a/queue-6.1/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch b/queue-6.1/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch new file mode 100644 index 0000000000..46b005e615 --- /dev/null +++ b/queue-6.1/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch @@ -0,0 +1,55 @@ +From 13b54d745f10ae45a42f42d79f30ad40881fe00f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:23:41 +0200 +Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting + +From: Michael Walle + +[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ] + +The bridge has three bootstrap pins which are sampled to determine the +frequency of the external reference clock. The driver will also +(over)write that setting. But it seems this is racy after the bridge is +enabled. It was observed that although the driver write the correct +value (by sniffing on the I2C bus), the register has the wrong value. +The datasheet states that the GPIO lines have to be stable for at least +5us after asserting the EN signal. Thus, there seems to be some logic +which samples the GPIO lines and this logic appears to overwrite the +register value which was set by the driver. Waiting 20us after +asserting the EN line resolves this issue. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Michael Walle +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 6595f954135ad..d31bb9153f4fb 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + + gpiod_set_value(pdata->enable_gpio, 1); + ++ /* ++ * After EN is deasserted and an external clock is detected, the bridge ++ * will sample GPIO3:1 to determine its frequency. The driver will ++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is ++ * racy. Thus we have to wait a couple of us. According to the datasheet ++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that ++ * is not enough and the refclk frequency value is still lost or ++ * overwritten by the bridge itself. Waiting for 20us seems to work. ++ */ ++ usleep_range(20, 30); ++ + /* + * If we have a reference clock we can enable communication w/ the + * panel (including the aux channel) w/out any need for an input clock +-- +2.51.0 + diff --git a/queue-6.1/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch b/queue-6.1/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch new file mode 100644 index 0000000000..09690d8b51 --- /dev/null +++ b/queue-6.1/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch @@ -0,0 +1,56 @@ +From d4cfc3c947923b2b492b296488db47aad7431763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 23:17:15 +0300 +Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM + +From: Vadim Pasternak + +[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ] + +The fans controlled by the driver can get stuck at 0 RPM if they are +configured below a 20% duty cycle. The driver tries to avoid this by +enforcing a minimum duty cycle of 20%, but this is done after the fans +are registered with the thermal subsystem. This is too late as the +thermal subsystem can set their current state before the driver is able +to enforce the minimum duty cycle. + +Fix by setting the minimum duty cycle before registering the fans with +the thermal subsystem. + +Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") +Reported-by: Nikolay Aleksandrov +Tested-by: Nikolay Aleksandrov +Signed-off-by: Ido Schimmel +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index 96017cc8da7ec..7514d57661048 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -551,15 +551,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) + if (!pwm->connected) + continue; + pwm->fan = fan; ++ /* Set minimal PWM speed. */ ++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i], + pwm, &mlxreg_fan_cooling_ops); + if (IS_ERR(pwm->cdev)) { + dev_err(dev, "Failed to register cooling device\n"); + return PTR_ERR(pwm->cdev); + } +- +- /* Set minimal PWM speed. */ +- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.1/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-6.1/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..2f8b43ac97 --- /dev/null +++ b/queue-6.1/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From c914d128e49bc98ce1f62727b7dde9d35715f5a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 8bda75990bce5..0a4e439d46094 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-6.1/pcmcia-omap-add-missing-check-for-platform_get_resou.patch b/queue-6.1/pcmcia-omap-add-missing-check-for-platform_get_resou.patch new file mode 100644 index 0000000000..a345f533c4 --- /dev/null +++ b/queue-6.1/pcmcia-omap-add-missing-check-for-platform_get_resou.patch @@ -0,0 +1,36 @@ +From 2c5033f52e63524b5c8075e0422f16a9f4fd0f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 14:39:56 +0800 +Subject: pcmcia: omap: Add missing check for platform_get_resource + +From: Chen Ni + +[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ] + +Add missing check for platform_get_resource() and return error if it fails +to catch the error. + +Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file") +Signed-off-by: Chen Ni +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/omap_cf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c +index d3f827d4224a3..e22a752052f2f 100644 +--- a/drivers/pcmcia/omap_cf.c ++++ b/drivers/pcmcia/omap_cf.c +@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev) + return -EINVAL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + + cf = kzalloc(sizeof *cf, GFP_KERNEL); + if (!cf) +-- +2.51.0 + diff --git a/queue-6.1/perf-bpf-utils-constify-bpil_array_desc.patch b/queue-6.1/perf-bpf-utils-constify-bpil_array_desc.patch new file mode 100644 index 0000000000..e217a50c16 --- /dev/null +++ b/queue-6.1/perf-bpf-utils-constify-bpil_array_desc.patch @@ -0,0 +1,112 @@ +From 099ebc1711fb9c4c2a9658e12af98f7eb4168d06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:12 -0700 +Subject: perf bpf-utils: Constify bpil_array_desc + +From: Ian Rogers + +[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ] + +The array's contents is a compile time constant. Constify to make the +code more intention revealing and avoid unintended errors. + +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com +Signed-off-by: Namhyung Kim +Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear") +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 80b1d2b3729ba..64a5583446964 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -20,7 +20,7 @@ struct bpil_array_desc { + */ + }; + +-static struct bpil_array_desc bpil_array_desc[] = { ++static const struct bpil_array_desc bpil_array_desc[] = { + [PERF_BPIL_JITED_INSNS] = { + offsetof(struct bpf_prog_info, jited_prog_insns), + offsetof(struct bpf_prog_info, jited_prog_len), +@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + bool include_array = (arrays & (1UL << i)) > 0; +- struct bpil_array_desc *desc; + __u32 count, size; + +- desc = bpil_array_desc + i; +- + /* kernel is too old to support this field */ + if (info_len < desc->array_offset + sizeof(__u32) || + info_len < desc->count_offset + sizeof(__u32) || +@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + ptr = info_linear->data; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 count, size; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + count = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + size = bpf_prog_info_read_offset_u32(&info, desc->size_offset); + bpf_prog_info_set_offset_u32(&info_linear->info, +@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 6: verify the data */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 v1, v2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + v2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + addr = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + offs = addr - ptr_to_u64(info_linear->data); +@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + offs = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + addr = offs + ptr_to_u64(info_linear->data); +-- +2.51.0 + diff --git a/queue-6.1/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch b/queue-6.1/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch new file mode 100644 index 0000000000..401a9e30e1 --- /dev/null +++ b/queue-6.1/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch @@ -0,0 +1,120 @@ +From b868c41330df913dd57463a94ec2adea26b88a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:13 -0700 +Subject: perf bpf-utils: Harden get_bpf_prog_info_linear + +From: Ian Rogers + +[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ] + +In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are +made, the first to compute memory requirements for a struct perf_bpil +and the second to fill it in. Previously the code would warn when the +second call didn't match the first. Such races can be common place in +things like perf test, whose perf trace tests will frequently load BPF +programs. Rather than a debug message, return actual errors for this +case. Out of paranoia also validate the read bpf_prog_info array +value. Change the type of ptr to avoid mismatched pointer type +compiler warnings. Add some additional debug print outs and sanity +asserts. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 64a5583446964..5a66dc8594aa8 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + __u32 info_len = sizeof(info); + __u32 data_len = 0; + int i, err; +- void *ptr; ++ __u8 *ptr; + + if (arrays >> PERF_BPIL_LAST_ARRAY) + return ERR_PTR(-EINVAL); +@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + pr_debug("can't get prog info: %s", strerror(errno)); + return ERR_PTR(-EFAULT); + } ++ if (info.type >= __MAX_BPF_PROG_TYPE) ++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type); + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + desc->count_offset, count); + bpf_prog_info_set_offset_u32(&info_linear->info, + desc->size_offset, size); ++ assert(ptr >= info_linear->data); ++ assert(ptr < &info_linear->data[data_len]); + bpf_prog_info_set_offset_u64(&info_linear->info, + desc->array_offset, + ptr_to_u64(ptr)); +@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + free(info_linear); + return ERR_PTR(-EFAULT); + } ++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) { ++ pr_debug("%s:%d: unexpected program type %u\n", ++ __func__, __LINE__, info_linear->info.type); ++ } + + /* step 6: verify the data */ ++ ptr = info_linear->data; + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { + const struct bpil_array_desc *desc = &bpil_array_desc[i]; +- __u32 v1, v2; ++ __u32 count1, count2, size1, size2; ++ __u64 ptr2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); ++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in element count\n", __func__); ++ if (count1 != count2) { ++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); ++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->size_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in rec size\n", __func__); ++ if (size1 != size2) { ++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset); ++ if (ptr_to_u64(ptr) != ptr2) { ++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr += roundup(count1 * size1, sizeof(__u64)); + } + + /* step 7: update info_len and data_len */ +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 8b6ba6a120..6688d2bf90 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -76,3 +76,21 @@ drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch revert-drm-amdgpu-avoid-extra-evict-restore-process.patch +pcmcia-omap-add-missing-check-for-platform_get_resou.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch +perf-bpf-utils-constify-bpil_array_desc.patch +perf-bpf-utils-harden-get_bpf_prog_info_linear.patch +drm-amdgpu-optimize-ras-ta-initialization-and-ta-unl.patch +drm-amdgpu-remove-the-check-of-init-status-in-psp_ra.patch +drm-amd-amdgpu-fix-style-problems-in-amdgpu_psp.c.patch +drm-amdgpu-skip-tmr-allocation-if-not-required.patch +drm-amd-make-flashing-messages-quieter.patch +drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch +drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch +tools-gpio-rm-.-.cmd-on-make-clean.patch +tools-gpio-remove-the-include-directory-on-make-clea.patch diff --git a/queue-6.1/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-6.1/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..de0e9ac386 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 571189a100157ca3184777bb60aee5766e361a2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 246d133238822..e8d915a8914c7 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-6.1/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-6.1/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..06387c6676 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From 2595163be372877b098b882deffc8380ac4d404b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index ca773ca9ed77b..c0e15d8a913df 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-6.1/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-6.1/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..c3c7bd5dd7 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From 54951f174b5efa767c53b70d349761ad2c9ce37c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index e8d915a8914c7..ca773ca9ed77b 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -71,7 +72,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_MASTER BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-6.1/tools-gpio-remove-the-include-directory-on-make-clea.patch b/queue-6.1/tools-gpio-remove-the-include-directory-on-make-clea.patch new file mode 100644 index 0000000000..e9fa0dfbd0 --- /dev/null +++ b/queue-6.1/tools-gpio-remove-the-include-directory-on-make-clea.patch @@ -0,0 +1,37 @@ +From 5d441944e4c823a09ce2a33a677aeb139afc1dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 14:36:20 +0800 +Subject: tools: gpio: remove the include directory on make clean + +From: zhang jiao + +[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ] + +Remove the generated include directory when running make clean. + +Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem") +Signed-off-by: Zhang Jiao +Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com +[Bartosz: add Fixes tag, improve the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index ed565eb52275f..342e056c8c665 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + + clean: + rm -f $(ALL_PROGRAMS) +- rm -f $(OUTPUT)include/linux/gpio.h ++ rm -rf $(OUTPUT)include + find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) +-- +2.51.0 + diff --git a/queue-6.1/tools-gpio-rm-.-.cmd-on-make-clean.patch b/queue-6.1/tools-gpio-rm-.-.cmd-on-make-clean.patch new file mode 100644 index 0000000000..9e973424ee --- /dev/null +++ b/queue-6.1/tools-gpio-rm-.-.cmd-on-make-clean.patch @@ -0,0 +1,36 @@ +From 1cd58360d79e97c5af0d45b2c4caad0b800daa42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 14:29:42 +0800 +Subject: tools: gpio: rm .*.cmd on make clean + +From: zhangjiao + +[ Upstream commit 931a36c4138ac418d487bd4db0d03780b46a77ba ] + +rm .*.cmd when calling make clean + +Signed-off-by: zhangjiao +Link: https://lore.kernel.org/r/20240829062942.11487-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: ed42d80f3bae ("tools: gpio: remove the include directory on make clean") +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index d29c9c49e2512..ed565eb52275f 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -78,7 +78,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + clean: + rm -f $(ALL_PROGRAMS) + rm -f $(OUTPUT)include/linux/gpio.h +- find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete ++ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) + install -d -m 755 $(DESTDIR)$(bindir); \ +-- +2.51.0 + diff --git a/queue-6.12/block-add-a-queue_limits_commit_update_frozen-helper.patch b/queue-6.12/block-add-a-queue_limits_commit_update_frozen-helper.patch new file mode 100644 index 0000000000..5918c2ee56 --- /dev/null +++ b/queue-6.12/block-add-a-queue_limits_commit_update_frozen-helper.patch @@ -0,0 +1,205 @@ +From 428ca91faf5ab4a8a337f8ddc5bd1ce5bca45cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:47:10 +0100 +Subject: block: add a queue_limits_commit_update_frozen helper + +From: Christoph Hellwig + +[ Upstream commit aa427d7b73b196f657d6d2cf0e94eff6b883fdef ] + +Add a helper that freezes the queue, updates the queue limits and +unfreezes the queue and convert all open coded versions of that to the +new helper. + +Signed-off-by: Christoph Hellwig +Reviewed-by: John Garry +Reviewed-by: Ming Lei +Reviewed-by: Damien Le Moal +Reviewed-by: Martin K. Petersen +Reviewed-by: Nilay Shroff +Reviewed-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/20250110054726.1499538-3-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 708e2371f77a ("scsi: sr: Reinstate rotational media flag") +Signed-off-by: Sasha Levin +--- + block/blk-integrity.c | 4 +--- + block/blk-settings.c | 24 ++++++++++++++++++++++++ + block/blk-zoned.c | 7 +------ + drivers/block/virtio_blk.c | 4 +--- + drivers/scsi/sd.c | 17 +++++------------ + drivers/scsi/sr.c | 5 +---- + include/linux/blkdev.h | 2 ++ + 7 files changed, 35 insertions(+), 28 deletions(-) + +diff --git a/block/blk-integrity.c b/block/blk-integrity.c +index 83b696ba0cac3..3fe0681399f6e 100644 +--- a/block/blk-integrity.c ++++ b/block/blk-integrity.c +@@ -218,9 +218,7 @@ static ssize_t flag_store(struct device *dev, const char *page, size_t count, + else + lim.integrity.flags |= flag; + +- blk_mq_freeze_queue(q); +- err = queue_limits_commit_update(q, &lim); +- blk_mq_unfreeze_queue(q); ++ err = queue_limits_commit_update_frozen(q, &lim); + if (err) + return err; + return count; +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 9ae3eee4b5ae5..f24fffdb6c294 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -444,6 +444,30 @@ int queue_limits_commit_update(struct request_queue *q, + } + EXPORT_SYMBOL_GPL(queue_limits_commit_update); + ++/** ++ * queue_limits_commit_update_frozen - commit an atomic update of queue limits ++ * @q: queue to update ++ * @lim: limits to apply ++ * ++ * Apply the limits in @lim that were obtained from queue_limits_start_update() ++ * and updated with the new values by the caller to @q. Freezes the queue ++ * before the update and unfreezes it after. ++ * ++ * Returns 0 if successful, else a negative error code. ++ */ ++int queue_limits_commit_update_frozen(struct request_queue *q, ++ struct queue_limits *lim) ++{ ++ int ret; ++ ++ blk_mq_freeze_queue(q); ++ ret = queue_limits_commit_update(q, lim); ++ blk_mq_unfreeze_queue(q); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(queue_limits_commit_update_frozen); ++ + /** + * queue_limits_set - apply queue limits to queue + * @q: queue to update +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index 5915fb98ffdce..f1160cc2cf85d 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -1510,7 +1510,6 @@ static int disk_update_zone_resources(struct gendisk *disk, + unsigned int nr_seq_zones, nr_conv_zones; + unsigned int pool_size; + struct queue_limits lim; +- int ret; + + disk->nr_zones = args->nr_zones; + disk->zone_capacity = args->zone_capacity; +@@ -1561,11 +1560,7 @@ static int disk_update_zone_resources(struct gendisk *disk, + } + + commit: +- blk_mq_freeze_queue(q); +- ret = queue_limits_commit_update(q, &lim); +- blk_mq_unfreeze_queue(q); +- +- return ret; ++ return queue_limits_commit_update_frozen(q, &lim); + } + + static int blk_revalidate_conv_zone(struct blk_zone *zone, unsigned int idx, +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index fd6c565f8a507..4bedcb49a73a7 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1106,9 +1106,7 @@ cache_type_store(struct device *dev, struct device_attribute *attr, + lim.features |= BLK_FEAT_WRITE_CACHE; + else + lim.features &= ~BLK_FEAT_WRITE_CACHE; +- blk_mq_freeze_queue(disk->queue); +- i = queue_limits_commit_update(disk->queue, &lim); +- blk_mq_unfreeze_queue(disk->queue); ++ i = queue_limits_commit_update_frozen(disk->queue, &lim); + if (i) + return i; + return count; +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index e1b06f803a94b..ee1d5dec3bc60 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -177,9 +177,8 @@ cache_type_store(struct device *dev, struct device_attribute *attr, + + lim = queue_limits_start_update(sdkp->disk->queue); + sd_set_flush_flag(sdkp, &lim); +- blk_mq_freeze_queue(sdkp->disk->queue); +- ret = queue_limits_commit_update(sdkp->disk->queue, &lim); +- blk_mq_unfreeze_queue(sdkp->disk->queue); ++ ret = queue_limits_commit_update_frozen(sdkp->disk->queue, ++ &lim); + if (ret) + return ret; + return count; +@@ -483,9 +482,7 @@ provisioning_mode_store(struct device *dev, struct device_attribute *attr, + + lim = queue_limits_start_update(sdkp->disk->queue); + sd_config_discard(sdkp, &lim, mode); +- blk_mq_freeze_queue(sdkp->disk->queue); +- err = queue_limits_commit_update(sdkp->disk->queue, &lim); +- blk_mq_unfreeze_queue(sdkp->disk->queue); ++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim); + if (err) + return err; + return count; +@@ -594,9 +591,7 @@ max_write_same_blocks_store(struct device *dev, struct device_attribute *attr, + + lim = queue_limits_start_update(sdkp->disk->queue); + sd_config_write_same(sdkp, &lim); +- blk_mq_freeze_queue(sdkp->disk->queue); +- err = queue_limits_commit_update(sdkp->disk->queue, &lim); +- blk_mq_unfreeze_queue(sdkp->disk->queue); ++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim); + if (err) + return err; + return count; +@@ -3803,9 +3798,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + sd_config_write_same(sdkp, &lim); + kfree(buffer); + +- blk_mq_freeze_queue(sdkp->disk->queue); +- err = queue_limits_commit_update(sdkp->disk->queue, &lim); +- blk_mq_unfreeze_queue(sdkp->disk->queue); ++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim); + if (err) + return err; + +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 198bec87bb8e7..b17796d5ee665 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -797,10 +797,7 @@ static int get_sectorsize(struct scsi_cd *cd) + + lim = queue_limits_start_update(q); + lim.logical_block_size = sector_size; +- blk_mq_freeze_queue(q); +- err = queue_limits_commit_update(q, &lim); +- blk_mq_unfreeze_queue(q); +- return err; ++ return queue_limits_commit_update_frozen(q, &lim); + } + + static int get_capabilities(struct scsi_cd *cd) +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index a901aed77141f..cd9c97f6f9484 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -990,6 +990,8 @@ queue_limits_start_update(struct request_queue *q) + mutex_lock(&q->limits_lock); + return q->limits; + } ++int queue_limits_commit_update_frozen(struct request_queue *q, ++ struct queue_limits *lim); + int queue_limits_commit_update(struct request_queue *q, + struct queue_limits *lim); + int queue_limits_set(struct request_queue *q, struct queue_limits *lim); +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch b/queue-6.12/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch new file mode 100644 index 0000000000..729bedfc2c --- /dev/null +++ b/queue-6.12/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch @@ -0,0 +1,39 @@ +From 719f645e0aeb203de503ed35a63fd871720d39f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:40:50 +0100 +Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure + +From: Colin Ian King + +[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ] + +Currently the kzalloc failure check just sets reports the failure +and sets the variable ret to -ENOMEM, which is not checked later +for this specific error. Fix this by just returning -ENOMEM rather +than setting ret. + +Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 3d42f6c3308ed..8553ac4c0ad3f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -433,7 +433,7 @@ static int psp_sw_init(void *handle) + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { + dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); +- ret = -ENOMEM; ++ return -ENOMEM; + } + + adev->psp.xgmi_context.supports_extended_data = +-- +2.51.0 + diff --git a/queue-6.12/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch b/queue-6.12/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch new file mode 100644 index 0000000000..6bcf494a83 --- /dev/null +++ b/queue-6.12/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch @@ -0,0 +1,55 @@ +From 684968e8abd0f6856eb55d989c11c6e4c02a450d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:23:41 +0200 +Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting + +From: Michael Walle + +[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ] + +The bridge has three bootstrap pins which are sampled to determine the +frequency of the external reference clock. The driver will also +(over)write that setting. But it seems this is racy after the bridge is +enabled. It was observed that although the driver write the correct +value (by sniffing on the I2C bus), the register has the wrong value. +The datasheet states that the GPIO lines have to be stable for at least +5us after asserting the EN signal. Thus, there seems to be some logic +which samples the GPIO lines and this logic appears to overwrite the +register value which was set by the driver. Waiting 20us after +asserting the EN line resolves this issue. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Michael Walle +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 4d17d1e1c38b4..9859ec688e567 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + + gpiod_set_value_cansleep(pdata->enable_gpio, 1); + ++ /* ++ * After EN is deasserted and an external clock is detected, the bridge ++ * will sample GPIO3:1 to determine its frequency. The driver will ++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is ++ * racy. Thus we have to wait a couple of us. According to the datasheet ++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that ++ * is not enough and the refclk frequency value is still lost or ++ * overwritten by the bridge itself. Waiting for 20us seems to work. ++ */ ++ usleep_range(20, 30); ++ + /* + * If we have a reference clock we can enable communication w/ the + * panel (including the aux channel) w/out any need for an input clock +-- +2.51.0 + diff --git a/queue-6.12/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch b/queue-6.12/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch new file mode 100644 index 0000000000..764309750d --- /dev/null +++ b/queue-6.12/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch @@ -0,0 +1,56 @@ +From 9eb0f4df7b68677bf4c050fc0a7305e65ca830a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 23:17:15 +0300 +Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM + +From: Vadim Pasternak + +[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ] + +The fans controlled by the driver can get stuck at 0 RPM if they are +configured below a 20% duty cycle. The driver tries to avoid this by +enforcing a minimum duty cycle of 20%, but this is done after the fans +are registered with the thermal subsystem. This is too late as the +thermal subsystem can set their current state before the driver is able +to enforce the minimum duty cycle. + +Fix by setting the minimum duty cycle before registering the fans with +the thermal subsystem. + +Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") +Reported-by: Nikolay Aleksandrov +Tested-by: Nikolay Aleksandrov +Signed-off-by: Ido Schimmel +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index a5f89aab3fb4d..c25a54d5b39ad 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) + if (!pwm->connected) + continue; + pwm->fan = fan; ++ /* Set minimal PWM speed. */ ++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i], + pwm, &mlxreg_fan_cooling_ops); + if (IS_ERR(pwm->cdev)) { + dev_err(dev, "Failed to register cooling device\n"); + return PTR_ERR(pwm->cdev); + } +- +- /* Set minimal PWM speed. */ +- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/md-prevent-incorrect-update-of-resync-recovery-offse.patch b/queue-6.12/md-prevent-incorrect-update-of-resync-recovery-offse.patch new file mode 100644 index 0000000000..2a0b5d2990 --- /dev/null +++ b/queue-6.12/md-prevent-incorrect-update-of-resync-recovery-offse.patch @@ -0,0 +1,46 @@ +From 339ec34840777937fc0e2e9a6452ac91edc41eff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:34:52 +0800 +Subject: md: prevent incorrect update of resync/recovery offset + +From: Li Nan + +[ Upstream commit 7202082b7b7a256d04ec96131c7f859df0a79f64 ] + +In md_do_sync(), when md_sync_action returns ACTION_FROZEN, subsequent +call to md_sync_position() will return MaxSector. This causes +'curr_resync' (and later 'recovery_offset') to be set to MaxSector too, +which incorrectly signals that recovery/resync has completed, even though +disk data has not actually been updated. + +To fix this issue, skip updating any offset values when the sync action +is FROZEN. The same holds true for IDLE. + +Fixes: 7d9f107a4e94 ("md: use new helpers in md_do_sync()") +Signed-off-by: Li Nan +Link: https://lore.kernel.org/linux-raid/20250904073452.3408516-1-linan666@huaweicloud.com +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 4b32917236703..d263076442924 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8996,6 +8996,11 @@ void md_do_sync(struct md_thread *thread) + } + + action = md_sync_action(mddev); ++ if (action == ACTION_FROZEN || action == ACTION_IDLE) { ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); ++ goto skip; ++ } ++ + desc = md_sync_action_name(action); + mddev->last_sync_action = action; + +-- +2.51.0 + diff --git a/queue-6.12/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-6.12/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..30d7c2a192 --- /dev/null +++ b/queue-6.12/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From 9a9c24d7db6b526c6ec70a0f618a7d62cbff781a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index bf9d070a44966..da494fe451baf 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-6.12/pcmcia-omap-add-missing-check-for-platform_get_resou.patch b/queue-6.12/pcmcia-omap-add-missing-check-for-platform_get_resou.patch new file mode 100644 index 0000000000..a3f2bd7fcb --- /dev/null +++ b/queue-6.12/pcmcia-omap-add-missing-check-for-platform_get_resou.patch @@ -0,0 +1,36 @@ +From 8da52c3cf42ee738d3954516750f39e4c8c21653 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 14:39:56 +0800 +Subject: pcmcia: omap: Add missing check for platform_get_resource + +From: Chen Ni + +[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ] + +Add missing check for platform_get_resource() and return error if it fails +to catch the error. + +Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file") +Signed-off-by: Chen Ni +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/omap_cf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c +index 80137c7afe0d9..5b639c942f17a 100644 +--- a/drivers/pcmcia/omap_cf.c ++++ b/drivers/pcmcia/omap_cf.c +@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev) + return -EINVAL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + + cf = kzalloc(sizeof *cf, GFP_KERNEL); + if (!cf) +-- +2.51.0 + diff --git a/queue-6.12/perf-bpf-event-fix-use-after-free-in-synthesis.patch b/queue-6.12/perf-bpf-event-fix-use-after-free-in-synthesis.patch new file mode 100644 index 0000000000..fa59a79bdc --- /dev/null +++ b/queue-6.12/perf-bpf-event-fix-use-after-free-in-synthesis.patch @@ -0,0 +1,147 @@ +From 761a3b784bf54359ad7425b885a06fdcf2019303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:11 -0700 +Subject: perf bpf-event: Fix use-after-free in synthesis + +From: Ian Rogers + +[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ] + +Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread +may already have inserted the bpf_prog_info. Such failures may yield +info_linear being freed which then causes use-after-free issues with +the internal bpf_prog_info info struct. Make it so that +perf_env__insert_bpf_prog_info trigger early non-error paths and fix +the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper +return error handling to perf_env__add_bpf_info (that calls +perf_env__insert_bpf_prog_info) and propagate the return value in its +callers. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index c81444059ad07..d9123c9637baa 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -290,9 +290,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { +- free(info_linear); ++ /* ++ * Insert failed, likely because of a duplicate event ++ * made by the sideband thread. Ignore synthesizing the ++ * metadata. ++ */ + free(info_node); ++ goto out; + } ++ /* info_linear is now owned by info_node and shouldn't be freed below. */ + info_linear = NULL; + + /* +@@ -451,18 +457,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session, + return err; + } + +-static void perf_env__add_bpf_info(struct perf_env *env, u32 id) ++static int perf_env__add_bpf_info(struct perf_env *env, u32 id) + { + struct bpf_prog_info_node *info_node; + struct perf_bpil *info_linear; + struct btf *btf = NULL; + u64 arrays; + u32 btf_id; +- int fd; ++ int fd, err = 0; + + fd = bpf_prog_get_fd_by_id(id); + if (fd < 0) +- return; ++ return -EINVAL; + + arrays = 1UL << PERF_BPIL_JITED_KSYMS; + arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS; +@@ -475,6 +481,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_linear = get_bpf_prog_info_linear(fd, arrays); + if (IS_ERR_OR_NULL(info_linear)) { + pr_debug("%s: failed to get BPF program info. aborting\n", __func__); ++ err = PTR_ERR(info_linear); + goto out; + } + +@@ -484,38 +491,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + if (info_node) { + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ pr_debug("%s: duplicate add bpf info request for id %u\n", ++ __func__, btf_id); + free(info_linear); + free(info_node); ++ goto out; + } +- } else ++ } else { + free(info_linear); ++ err = -ENOMEM; ++ goto out; ++ } + + if (btf_id == 0) + goto out; + + btf = btf__load_from_kernel_by_id(btf_id); +- if (libbpf_get_error(btf)) { +- pr_debug("%s: failed to get BTF of id %u, aborting\n", +- __func__, btf_id); +- goto out; ++ if (!btf) { ++ err = -errno; ++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err); ++ } else { ++ perf_env__fetch_btf(env, btf_id, btf); + } +- perf_env__fetch_btf(env, btf_id, btf); + + out: + btf__free(btf); + close(fd); ++ return err; + } + + static int bpf_event__sb_cb(union perf_event *event, void *data) + { + struct perf_env *env = data; ++ int ret = 0; + + if (event->header.type != PERF_RECORD_BPF_EVENT) + return -1; + + switch (event->bpf.type) { + case PERF_BPF_EVENT_PROG_LOAD: +- perf_env__add_bpf_info(env, event->bpf.id); ++ ret = perf_env__add_bpf_info(env, event->bpf.id); + + case PERF_BPF_EVENT_PROG_UNLOAD: + /* +@@ -529,7 +544,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data) + break; + } + +- return 0; ++ return ret; + } + + int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) +-- +2.51.0 + diff --git a/queue-6.12/perf-bpf-utils-constify-bpil_array_desc.patch b/queue-6.12/perf-bpf-utils-constify-bpil_array_desc.patch new file mode 100644 index 0000000000..05a762a23d --- /dev/null +++ b/queue-6.12/perf-bpf-utils-constify-bpil_array_desc.patch @@ -0,0 +1,112 @@ +From 206745c6f048651ec100ab253520f3dc092cbd10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:12 -0700 +Subject: perf bpf-utils: Constify bpil_array_desc + +From: Ian Rogers + +[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ] + +The array's contents is a compile time constant. Constify to make the +code more intention revealing and avoid unintended errors. + +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com +Signed-off-by: Namhyung Kim +Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear") +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 80b1d2b3729ba..64a5583446964 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -20,7 +20,7 @@ struct bpil_array_desc { + */ + }; + +-static struct bpil_array_desc bpil_array_desc[] = { ++static const struct bpil_array_desc bpil_array_desc[] = { + [PERF_BPIL_JITED_INSNS] = { + offsetof(struct bpf_prog_info, jited_prog_insns), + offsetof(struct bpf_prog_info, jited_prog_len), +@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + bool include_array = (arrays & (1UL << i)) > 0; +- struct bpil_array_desc *desc; + __u32 count, size; + +- desc = bpil_array_desc + i; +- + /* kernel is too old to support this field */ + if (info_len < desc->array_offset + sizeof(__u32) || + info_len < desc->count_offset + sizeof(__u32) || +@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + ptr = info_linear->data; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 count, size; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + count = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + size = bpf_prog_info_read_offset_u32(&info, desc->size_offset); + bpf_prog_info_set_offset_u32(&info_linear->info, +@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 6: verify the data */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 v1, v2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + v2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + addr = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + offs = addr - ptr_to_u64(info_linear->data); +@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + offs = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + addr = offs + ptr_to_u64(info_linear->data); +-- +2.51.0 + diff --git a/queue-6.12/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch b/queue-6.12/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch new file mode 100644 index 0000000000..7c2a9e99fb --- /dev/null +++ b/queue-6.12/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch @@ -0,0 +1,120 @@ +From c12872e189eefe9d7bcfdb5edfef2dfee3ceeded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:13 -0700 +Subject: perf bpf-utils: Harden get_bpf_prog_info_linear + +From: Ian Rogers + +[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ] + +In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are +made, the first to compute memory requirements for a struct perf_bpil +and the second to fill it in. Previously the code would warn when the +second call didn't match the first. Such races can be common place in +things like perf test, whose perf trace tests will frequently load BPF +programs. Rather than a debug message, return actual errors for this +case. Out of paranoia also validate the read bpf_prog_info array +value. Change the type of ptr to avoid mismatched pointer type +compiler warnings. Add some additional debug print outs and sanity +asserts. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 64a5583446964..5a66dc8594aa8 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + __u32 info_len = sizeof(info); + __u32 data_len = 0; + int i, err; +- void *ptr; ++ __u8 *ptr; + + if (arrays >> PERF_BPIL_LAST_ARRAY) + return ERR_PTR(-EINVAL); +@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + pr_debug("can't get prog info: %s", strerror(errno)); + return ERR_PTR(-EFAULT); + } ++ if (info.type >= __MAX_BPF_PROG_TYPE) ++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type); + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + desc->count_offset, count); + bpf_prog_info_set_offset_u32(&info_linear->info, + desc->size_offset, size); ++ assert(ptr >= info_linear->data); ++ assert(ptr < &info_linear->data[data_len]); + bpf_prog_info_set_offset_u64(&info_linear->info, + desc->array_offset, + ptr_to_u64(ptr)); +@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + free(info_linear); + return ERR_PTR(-EFAULT); + } ++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) { ++ pr_debug("%s:%d: unexpected program type %u\n", ++ __func__, __LINE__, info_linear->info.type); ++ } + + /* step 6: verify the data */ ++ ptr = info_linear->data; + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { + const struct bpil_array_desc *desc = &bpil_array_desc[i]; +- __u32 v1, v2; ++ __u32 count1, count2, size1, size2; ++ __u64 ptr2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); ++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in element count\n", __func__); ++ if (count1 != count2) { ++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); ++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->size_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in rec size\n", __func__); ++ if (size1 != size2) { ++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset); ++ if (ptr_to_u64(ptr) != ptr2) { ++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr += roundup(count1 * size1, sizeof(__u64)); + } + + /* step 7: update info_len and data_len */ +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch b/queue-6.12/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch new file mode 100644 index 0000000000..3302c3dc97 --- /dev/null +++ b/queue-6.12/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch @@ -0,0 +1,46 @@ +From dd731f45df7f3f4481f43ca46ef04b87d981a954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 17:47:09 +0200 +Subject: platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit cf3940ac737d05c85395f343fe33a3cfcadb47db ] + +Currently, the ignore_key_wlan quirk applies to keycodes 0x5D, 0x5E, and +0x5F. However, the relevant code for the Asus Zenbook Duo is only 0x5F. +Since this code is emitted by other Asus devices, such as from the Z13 +for its ROG button, remove the extra codes before expanding the quirk. + +For the Duo devices, which are the only ones that use this quirk, there +should be no effect. + +Fixes: 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA") +Signed-off-by: Antheas Kapenekakis +Link: https://lore.kernel.org/r/20250808154710.8981-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 90ad0045fec5f..8f06adf828361 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -654,8 +654,6 @@ static void asus_nb_wmi_key_filter(struct asus_wmi_driver *asus_wmi, int *code, + if (atkbd_reports_vol_keys) + *code = ASUS_WMI_KEY_IGNORE; + break; +- case 0x5D: /* Wireless console Toggle */ +- case 0x5E: /* Wireless console Enable */ + case 0x5F: /* Wireless console Disable */ + if (quirks->ignore_key_wlan) + *code = ASUS_WMI_KEY_IGNORE; +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-intel-power-domains-use-topology_logica.patch b/queue-6.12/platform-x86-intel-power-domains-use-topology_logica.patch new file mode 100644 index 0000000000..4b000405fc --- /dev/null +++ b/queue-6.12/platform-x86-intel-power-domains-use-topology_logica.patch @@ -0,0 +1,47 @@ +From 33261cd0a8b1621d9bdd7536a57475823a562d50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 07:38:59 -0400 +Subject: platform/x86/intel: power-domains: Use topology_logical_package_id() + for package ID +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Arcari + +[ Upstream commit aa28991fd5dc4c01a40caab2bd9af8c5e06f9899 ] + +Currently, tpmi_get_logical_id() calls topology_physical_package_id() +to set the pkg_id of the info structure. Since some VM hosts assign non +contiguous package IDs, topology_physical_package_id() can return a +larger value than topology_max_packages(). This will result in an +invalid reference into tpmi_power_domain_mask[] as that is allocatead +based on topology_max_packages() as the maximum package ID. + +Fixes: 17ca2780458c ("platform/x86/intel: TPMI domain id and CPU mapping") +Signed-off-by: David Arcari +Acked-by: Srinivas Pandruvada +Link: https://lore.kernel.org/r/20250829113859.1772827-1-darcari@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/tpmi_power_domains.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c +index 12fb0943b5dc3..7e0b86535d02c 100644 +--- a/drivers/platform/x86/intel/tpmi_power_domains.c ++++ b/drivers/platform/x86/intel/tpmi_power_domains.c +@@ -167,7 +167,7 @@ static int tpmi_get_logical_id(unsigned int cpu, struct tpmi_cpu_info *info) + + info->punit_thread_id = FIELD_GET(LP_ID_MASK, data); + info->punit_core_id = FIELD_GET(MODULE_ID_MASK, data); +- info->pkg_id = topology_physical_package_id(cpu); ++ info->pkg_id = topology_logical_package_id(cpu); + info->linux_cpu = cpu; + + return 0; +-- +2.51.0 + diff --git a/queue-6.12/scsi-sr-reinstate-rotational-media-flag.patch b/queue-6.12/scsi-sr-reinstate-rotational-media-flag.patch new file mode 100644 index 0000000000..de22bc5038 --- /dev/null +++ b/queue-6.12/scsi-sr-reinstate-rotational-media-flag.patch @@ -0,0 +1,78 @@ +From 1b100d93085c2f3045427baa6d9587fd845212b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 19:35:50 +0800 +Subject: scsi: sr: Reinstate rotational media flag + +From: Ming Lei + +[ Upstream commit 708e2371f77a9d3f2f1d54d1ec835d71b9d0dafe ] + +Reinstate the rotational media flag for the CD-ROM driver. The flag has +been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to +queue_limits") and this breaks some applications. + +Move queue limit configuration from get_sectorsize() to +sr_revalidate_disk() and set the rotational flag. + +Cc: Christoph Hellwig +Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sr.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index b17796d5ee665..add13e3068983 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -475,13 +475,21 @@ static blk_status_t sr_init_command(struct scsi_cmnd *SCpnt) + + static int sr_revalidate_disk(struct scsi_cd *cd) + { ++ struct request_queue *q = cd->device->request_queue; + struct scsi_sense_hdr sshdr; ++ struct queue_limits lim; ++ int sector_size; + + /* if the unit is not ready, nothing more to do */ + if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr)) + return 0; + sr_cd_check(&cd->cdi); +- return get_sectorsize(cd); ++ sector_size = get_sectorsize(cd); ++ ++ lim = queue_limits_start_update(q); ++ lim.logical_block_size = sector_size; ++ lim.features |= BLK_FEAT_ROTATIONAL; ++ return queue_limits_commit_update_frozen(q, &lim); + } + + static int sr_block_open(struct gendisk *disk, blk_mode_t mode) +@@ -721,10 +729,8 @@ static int sr_probe(struct device *dev) + + static int get_sectorsize(struct scsi_cd *cd) + { +- struct request_queue *q = cd->device->request_queue; + static const u8 cmd[10] = { READ_CAPACITY }; + unsigned char buffer[8] = { }; +- struct queue_limits lim; + int err; + int sector_size; + struct scsi_failure failure_defs[] = { +@@ -795,9 +801,7 @@ static int get_sectorsize(struct scsi_cd *cd) + set_capacity(cd->disk, cd->capacity); + } + +- lim = queue_limits_start_update(q); +- lim.logical_block_size = sector_size; +- return queue_limits_commit_update_frozen(q, &lim); ++ return sector_size; + } + + static int get_capabilities(struct scsi_cd *cd) +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 8e016a322c..2c26883269 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -147,3 +147,21 @@ rust-support-rust-1.91.0-target-spec.patch alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch revert-drm-amdgpu-avoid-extra-evict-restore-process.patch +pcmcia-omap-add-missing-check-for-platform_get_resou.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch +platform-x86-intel-power-domains-use-topology_logica.patch +hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch +block-add-a-queue_limits_commit_update_frozen-helper.patch +scsi-sr-reinstate-rotational-media-flag.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch +drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch +perf-bpf-event-fix-use-after-free-in-synthesis.patch +perf-bpf-utils-constify-bpil_array_desc.patch +perf-bpf-utils-harden-get_bpf_prog_info_linear.patch +drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch +tools-gpio-remove-the-include-directory-on-make-clea.patch +md-prevent-incorrect-update-of-resync-recovery-offse.patch diff --git a/queue-6.12/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch b/queue-6.12/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch new file mode 100644 index 0000000000..c2435e0a3e --- /dev/null +++ b/queue-6.12/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch @@ -0,0 +1,65 @@ +From 1d390f8d080ec585a5477958f3ad529e7075f5d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:43 +0100 +Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module + +From: Larisa Grigore + +[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ] + +Clear the error flags after disabling the module to avoid the case when +a flag is set again between flag clear and module disable. And use +SR_CLEAR_MASK to replace hardcoded value for improved readability. + +Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa +("spi: lpspi: Fix CLK pin becomes low before one transfer"), the +original driver only reset SR in the interrupt handler, making it +vulnerable to the same issue. Therefore the fixes commit is set at the +introduction of the driver. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: Ciprian Marian Costea +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 2843b559e9413..5e96913fd9466 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -83,6 +83,8 @@ + #define TCR_RXMSK BIT(19) + #define TCR_TXMSK BIT(18) + ++#define SR_CLEAR_MASK GENMASK(13, 8) ++ + struct fsl_lpspi_devtype_data { + u8 prescale_max; + }; +@@ -532,14 +534,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi) + fsl_lpspi_intctrl(fsl_lpspi, 0); + } + +- /* W1C for all flags in SR */ +- temp = 0x3F << 8; +- writel(temp, fsl_lpspi->base + IMX7ULP_SR); +- + /* Clear FIFO and disable module */ + temp = CR_RRF | CR_RTF; + writel(temp, fsl_lpspi->base + IMX7ULP_CR); + ++ /* W1C for all flags in SR */ ++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-6.12/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..e07191a8fb --- /dev/null +++ b/queue-6.12/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 53dbd9828d5e4486481fe64746778a82dd8c7b95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index f8cacb9c7408f..50633115e83dd 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -780,7 +780,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-6.12/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-6.12/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..b48111ceeb --- /dev/null +++ b/queue-6.12/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From f1b6916607045493ca6ca79ce1388d395ea34fe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 9d05d18451c6d..2843b559e9413 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -730,12 +730,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-6.12/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-6.12/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..449d83a214 --- /dev/null +++ b/queue-6.12/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From fbadc6ce62f34f08771a0961e22c578a130a82ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 50633115e83dd..9d05d18451c6d 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -70,7 +71,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_HOST BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -420,7 +421,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-6.12/tools-gpio-remove-the-include-directory-on-make-clea.patch b/queue-6.12/tools-gpio-remove-the-include-directory-on-make-clea.patch new file mode 100644 index 0000000000..dd05b3b451 --- /dev/null +++ b/queue-6.12/tools-gpio-remove-the-include-directory-on-make-clea.patch @@ -0,0 +1,37 @@ +From ab54bc3ea045c3d0826972232bda30a472f6db5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 14:36:20 +0800 +Subject: tools: gpio: remove the include directory on make clean + +From: zhang jiao + +[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ] + +Remove the generated include directory when running make clean. + +Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem") +Signed-off-by: Zhang Jiao +Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com +[Bartosz: add Fixes tag, improve the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index ed565eb52275f..342e056c8c665 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + + clean: + rm -f $(ALL_PROGRAMS) +- rm -f $(OUTPUT)include/linux/gpio.h ++ rm -rf $(OUTPUT)include + find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) +-- +2.51.0 + diff --git a/queue-6.16/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch b/queue-6.16/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch new file mode 100644 index 0000000000..477e3faf48 --- /dev/null +++ b/queue-6.16/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch @@ -0,0 +1,39 @@ +From 2a68f439cee1f366f69c761a8eaebf11cce2299c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:40:50 +0100 +Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure + +From: Colin Ian King + +[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ] + +Currently the kzalloc failure check just sets reports the failure +and sets the variable ret to -ENOMEM, which is not checked later +for this specific error. Fix this by just returning -ENOMEM rather +than setting ret. + +Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 7d8b98aa5271c..f9ceda7861f1b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -447,7 +447,7 @@ static int psp_sw_init(struct amdgpu_ip_block *ip_block) + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { + dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); +- ret = -ENOMEM; ++ return -ENOMEM; + } + + adev->psp.xgmi_context.supports_extended_data = +-- +2.51.0 + diff --git a/queue-6.16/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch b/queue-6.16/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch new file mode 100644 index 0000000000..feb45baf1e --- /dev/null +++ b/queue-6.16/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch @@ -0,0 +1,55 @@ +From 9dc8c01c43d3352012b09a4eda3ec2990c0e9490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:23:41 +0200 +Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting + +From: Michael Walle + +[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ] + +The bridge has three bootstrap pins which are sampled to determine the +frequency of the external reference clock. The driver will also +(over)write that setting. But it seems this is racy after the bridge is +enabled. It was observed that although the driver write the correct +value (by sniffing on the I2C bus), the register has the wrong value. +The datasheet states that the GPIO lines have to be stable for at least +5us after asserting the EN signal. Thus, there seems to be some logic +which samples the GPIO lines and this logic appears to overwrite the +register value which was set by the driver. Waiting 20us after +asserting the EN line resolves this issue. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Michael Walle +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 834b42a4d31f8..4545ac42778ab 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -392,6 +392,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + + gpiod_set_value_cansleep(pdata->enable_gpio, 1); + ++ /* ++ * After EN is deasserted and an external clock is detected, the bridge ++ * will sample GPIO3:1 to determine its frequency. The driver will ++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is ++ * racy. Thus we have to wait a couple of us. According to the datasheet ++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that ++ * is not enough and the refclk frequency value is still lost or ++ * overwritten by the bridge itself. Waiting for 20us seems to work. ++ */ ++ usleep_range(20, 30); ++ + /* + * If we have a reference clock we can enable communication w/ the + * panel (including the aux channel) w/out any need for an input clock +-- +2.51.0 + diff --git a/queue-6.16/drm-i915-gem-allow-exec_capture-on-recoverable-conte.patch b/queue-6.16/drm-i915-gem-allow-exec_capture-on-recoverable-conte.patch new file mode 100644 index 0000000000..3eef35ed22 --- /dev/null +++ b/queue-6.16/drm-i915-gem-allow-exec_capture-on-recoverable-conte.patch @@ -0,0 +1,49 @@ +From 1bbad472fe51a31f2977ab920ccb4f1bde236ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 21:22:15 +0200 +Subject: drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit d6e020819612a4a06207af858e0978be4d3e3140 ] + +The intel-media-driver is currently broken on DG1 because +it uses EXEC_CAPTURE with recovarable contexts. Relax the +check to allow that. + +I've also submitted a fix for the intel-media-driver: +https://github.com/intel/media-driver/pull/1920 + +Cc: stable@vger.kernel.org # v6.0+ +Cc: Matthew Auld +Cc: Thomas Hellström +Testcase: igt/gem_exec_capture/capture-invisible +Fixes: 71b1669ea9bd ("drm/i915/uapi: tweak error capture on recoverable contexts") +Reviewed-by: Andi Shyti +Signed-off-by: Ville Syrjälä +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250411144313.11660-2-ville.syrjala@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +index ca7e9216934a7..ea9d5063ce78c 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +@@ -2013,7 +2013,7 @@ static int eb_capture_stage(struct i915_execbuffer *eb) + continue; + + if (i915_gem_context_is_recoverable(eb->gem_context) && +- (IS_DGFX(eb->i915) || GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 0))) ++ GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 10)) + return -EINVAL; + + for_each_batch_create_order(eb, j) { +-- +2.51.0 + diff --git a/queue-6.16/hwmon-ina238-correctly-clamp-power-limits.patch b/queue-6.16/hwmon-ina238-correctly-clamp-power-limits.patch new file mode 100644 index 0000000000..81045eb5fd --- /dev/null +++ b/queue-6.16/hwmon-ina238-correctly-clamp-power-limits.patch @@ -0,0 +1,42 @@ +From fb2e15e3ff917f56bd5e386be0b8ef6a546fd212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 11:51:20 -0700 +Subject: hwmon: (ina238) Correctly clamp power limits + +From: Guenter Roeck + +[ Upstream commit c2623573178bab32990695fb729e9b69710ed66d ] + +ina238_write_power() was attempting to clamp the user input but was +throwing away the result. Ensure that we clamp the value to the +appropriate range before it is converted into a register value. + +Fixes: 0d9f596b1fe34 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips") +Cc: Wenliang Yan +Cc: Chris Packham +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ina238.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c +index 0562f9a4dcf12..5c90c3e59f80c 100644 +--- a/drivers/hwmon/ina238.c ++++ b/drivers/hwmon/ina238.c +@@ -426,9 +426,10 @@ static int ina238_write_power(struct device *dev, u32 attr, long val) + * Unsigned postive values. Compared against the 24-bit power register, + * lower 8-bits are truncated. Same conversion to/from uW as POWER + * register. ++ * The first clamp_val() is to establish a baseline to avoid overflows. + */ +- regval = clamp_val(val, 0, LONG_MAX); +- regval = div_u64(val * 4 * 100 * data->rshunt, data->config->power_calculate_factor * ++ regval = clamp_val(val, 0, LONG_MAX / 2); ++ regval = div_u64(regval * 4 * 100 * data->rshunt, data->config->power_calculate_factor * + 1000ULL * INA238_FIXED_SHUNT * data->gain); + regval = clamp_val(regval >> 8, 0, U16_MAX); + +-- +2.51.0 + diff --git a/queue-6.16/hwmon-ina238-correctly-clamp-shunt-voltage-limit.patch b/queue-6.16/hwmon-ina238-correctly-clamp-shunt-voltage-limit.patch new file mode 100644 index 0000000000..25aa388149 --- /dev/null +++ b/queue-6.16/hwmon-ina238-correctly-clamp-shunt-voltage-limit.patch @@ -0,0 +1,39 @@ +From c74393a2905820430e2be306b9a3e4e2089f2d2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 06:49:51 -0700 +Subject: hwmon: (ina238) Correctly clamp shunt voltage limit + +From: Guenter Roeck + +[ Upstream commit bd7e7bc2cc2024035dfbc8239c9f4d8675793445 ] + +When clamping a register value, the result needs to be masked against the +register size. This was missing, resulting in errors when trying to write +negative limits. Fix by masking the clamping result against the register +size. + +Fixes: eacb52f010a80 ("hwmon: Driver for Texas Instruments INA238") +Cc: Nathan Rossi +Cc: Chris Packham +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ina238.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c +index a2cb615fa2789..0562f9a4dcf12 100644 +--- a/drivers/hwmon/ina238.c ++++ b/drivers/hwmon/ina238.c +@@ -300,7 +300,7 @@ static int ina238_write_in(struct device *dev, u32 attr, int channel, + regval = clamp_val(val, -163, 163); + regval = (regval * 1000 * 4) / + (INA238_SHUNT_VOLTAGE_LSB * data->gain); +- regval = clamp_val(regval, S16_MIN, S16_MAX); ++ regval = clamp_val(regval, S16_MIN, S16_MAX) & 0xffff; + + switch (attr) { + case hwmon_in_max: +-- +2.51.0 + diff --git a/queue-6.16/hwmon-ina238-correctly-clamp-temperature.patch b/queue-6.16/hwmon-ina238-correctly-clamp-temperature.patch new file mode 100644 index 0000000000..56985590f9 --- /dev/null +++ b/queue-6.16/hwmon-ina238-correctly-clamp-temperature.patch @@ -0,0 +1,38 @@ +From ace49179ecbdb79d21973db7e0ce8465823864e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:05:10 +1200 +Subject: hwmon: (ina238) Correctly clamp temperature + +From: Chris Packham + +[ Upstream commit 98fd069dd87386d87eaf439e3c7b5767618926d2 ] + +ina238_write_temp() was attempting to clamp the user input but was +throwing away the result. Ensure that we clamp the value to the +appropriate range before it is converted into a register value. + +Fixes: 0d9f596b1fe3 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips") +Signed-off-by: Chris Packham +Link: https://lore.kernel.org/r/20250829030512.1179998-3-chris.packham@alliedtelesis.co.nz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ina238.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c +index 9a5fd16a4ec2a..a2cb615fa2789 100644 +--- a/drivers/hwmon/ina238.c ++++ b/drivers/hwmon/ina238.c +@@ -481,7 +481,7 @@ static int ina238_write_temp(struct device *dev, u32 attr, long val) + return -EOPNOTSUPP; + + /* Signed */ +- regval = clamp_val(val, -40000, 125000); ++ val = clamp_val(val, -40000, 125000); + regval = div_s64(val * 10000, data->config->temp_lsb) << data->config->temp_shift; + regval = clamp_val(regval, S16_MIN, S16_MAX) & (0xffff << data->config->temp_shift); + +-- +2.51.0 + diff --git a/queue-6.16/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch b/queue-6.16/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch new file mode 100644 index 0000000000..4a1567a9c1 --- /dev/null +++ b/queue-6.16/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch @@ -0,0 +1,56 @@ +From 7d731c107747a9bec17bf269e137e8ce0f96d1d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 23:17:15 +0300 +Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM + +From: Vadim Pasternak + +[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ] + +The fans controlled by the driver can get stuck at 0 RPM if they are +configured below a 20% duty cycle. The driver tries to avoid this by +enforcing a minimum duty cycle of 20%, but this is done after the fans +are registered with the thermal subsystem. This is too late as the +thermal subsystem can set their current state before the driver is able +to enforce the minimum duty cycle. + +Fix by setting the minimum duty cycle before registering the fans with +the thermal subsystem. + +Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") +Reported-by: Nikolay Aleksandrov +Tested-by: Nikolay Aleksandrov +Signed-off-by: Ido Schimmel +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index a5f89aab3fb4d..c25a54d5b39ad 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) + if (!pwm->connected) + continue; + pwm->fan = fan; ++ /* Set minimal PWM speed. */ ++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i], + pwm, &mlxreg_fan_cooling_ops); + if (IS_ERR(pwm->cdev)) { + dev_err(dev, "Failed to register cooling device\n"); + return PTR_ERR(pwm->cdev); + } +- +- /* Set minimal PWM speed. */ +- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/md-prevent-incorrect-update-of-resync-recovery-offse.patch b/queue-6.16/md-prevent-incorrect-update-of-resync-recovery-offse.patch new file mode 100644 index 0000000000..4aa1b27ce0 --- /dev/null +++ b/queue-6.16/md-prevent-incorrect-update-of-resync-recovery-offse.patch @@ -0,0 +1,46 @@ +From 04c99469b7884bedc565d75a65d37472ca73b85f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:34:52 +0800 +Subject: md: prevent incorrect update of resync/recovery offset + +From: Li Nan + +[ Upstream commit 7202082b7b7a256d04ec96131c7f859df0a79f64 ] + +In md_do_sync(), when md_sync_action returns ACTION_FROZEN, subsequent +call to md_sync_position() will return MaxSector. This causes +'curr_resync' (and later 'recovery_offset') to be set to MaxSector too, +which incorrectly signals that recovery/resync has completed, even though +disk data has not actually been updated. + +To fix this issue, skip updating any offset values when the sync action +is FROZEN. The same holds true for IDLE. + +Fixes: 7d9f107a4e94 ("md: use new helpers in md_do_sync()") +Signed-off-by: Li Nan +Link: https://lore.kernel.org/linux-raid/20250904073452.3408516-1-linan666@huaweicloud.com +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 8746b22060a7c..3f355bb85797f 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9089,6 +9089,11 @@ void md_do_sync(struct md_thread *thread) + } + + action = md_sync_action(mddev); ++ if (action == ACTION_FROZEN || action == ACTION_IDLE) { ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); ++ goto skip; ++ } ++ + desc = md_sync_action_name(action); + mddev->last_sync_action = action; + +-- +2.51.0 + diff --git a/queue-6.16/md-raid1-fix-data-lost-for-writemostly-rdev.patch b/queue-6.16/md-raid1-fix-data-lost-for-writemostly-rdev.patch new file mode 100644 index 0000000000..d79cff3b75 --- /dev/null +++ b/queue-6.16/md-raid1-fix-data-lost-for-writemostly-rdev.patch @@ -0,0 +1,44 @@ +From 67ad16feec1671bc71afe83a65089ef017efc8c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 09:41:40 +0800 +Subject: md/raid1: fix data lost for writemostly rdev + +From: Yu Kuai + +[ Upstream commit 93dec51e716db88f32d770dc9ab268964fff320b ] + +If writemostly is enabled, alloc_behind_master_bio() will allocate a new +bio for rdev, with bi_opf set to 0. Later, raid1_write_request() will +clone from this bio, hence bi_opf is still 0 for the cloned bio. Submit +this cloned bio will end up to be read, causing write data lost. + +Fix this problem by inheriting bi_opf from original bio for +behind_mast_bio. + +Fixes: e879a0d9cb08 ("md/raid1,raid10: don't ignore IO flags") +Reported-and-tested-by: Ian Dall +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220507 +Link: https://lore.kernel.org/linux-raid/20250903014140.3690499-1-yukuai1@huaweicloud.com +Signed-off-by: Yu Kuai +Reviewed-by: Li Nan +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 6cee738a645ff..6d52336057946 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1226,7 +1226,7 @@ static void alloc_behind_master_bio(struct r1bio *r1_bio, + int i = 0; + struct bio *behind_bio = NULL; + +- behind_bio = bio_alloc_bioset(NULL, vcnt, 0, GFP_NOIO, ++ behind_bio = bio_alloc_bioset(NULL, vcnt, bio->bi_opf, GFP_NOIO, + &r1_bio->mddev->bio_set); + + /* discard op, we don't support writezero/writesame yet */ +-- +2.51.0 + diff --git a/queue-6.16/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-6.16/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..9acbd0c64d --- /dev/null +++ b/queue-6.16/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From 116686c2743fb50d551dc6af69ff4ecbf7d1ac3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index bf9d070a44966..da494fe451baf 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-6.16/pcmcia-omap-add-missing-check-for-platform_get_resou.patch b/queue-6.16/pcmcia-omap-add-missing-check-for-platform_get_resou.patch new file mode 100644 index 0000000000..23c23a8522 --- /dev/null +++ b/queue-6.16/pcmcia-omap-add-missing-check-for-platform_get_resou.patch @@ -0,0 +1,36 @@ +From 336c93cf06c48a76d8a976c2ba89eae268ac8712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 14:39:56 +0800 +Subject: pcmcia: omap: Add missing check for platform_get_resource + +From: Chen Ni + +[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ] + +Add missing check for platform_get_resource() and return error if it fails +to catch the error. + +Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file") +Signed-off-by: Chen Ni +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/omap_cf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c +index 1b1dff56ec7b1..441cdf83f5a44 100644 +--- a/drivers/pcmcia/omap_cf.c ++++ b/drivers/pcmcia/omap_cf.c +@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev) + return -EINVAL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + + cf = kzalloc(sizeof *cf, GFP_KERNEL); + if (!cf) +-- +2.51.0 + diff --git a/queue-6.16/perf-bpf-event-fix-use-after-free-in-synthesis.patch b/queue-6.16/perf-bpf-event-fix-use-after-free-in-synthesis.patch new file mode 100644 index 0000000000..65e17f109a --- /dev/null +++ b/queue-6.16/perf-bpf-event-fix-use-after-free-in-synthesis.patch @@ -0,0 +1,147 @@ +From 52045be13093db3df91e90bc927b451e58c33e6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:11 -0700 +Subject: perf bpf-event: Fix use-after-free in synthesis + +From: Ian Rogers + +[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ] + +Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread +may already have inserted the bpf_prog_info. Such failures may yield +info_linear being freed which then causes use-after-free issues with +the internal bpf_prog_info info struct. Make it so that +perf_env__insert_bpf_prog_info trigger early non-error paths and fix +the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper +return error handling to perf_env__add_bpf_info (that calls +perf_env__insert_bpf_prog_info) and propagate the return value in its +callers. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index c81444059ad07..d9123c9637baa 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -290,9 +290,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { +- free(info_linear); ++ /* ++ * Insert failed, likely because of a duplicate event ++ * made by the sideband thread. Ignore synthesizing the ++ * metadata. ++ */ + free(info_node); ++ goto out; + } ++ /* info_linear is now owned by info_node and shouldn't be freed below. */ + info_linear = NULL; + + /* +@@ -451,18 +457,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session, + return err; + } + +-static void perf_env__add_bpf_info(struct perf_env *env, u32 id) ++static int perf_env__add_bpf_info(struct perf_env *env, u32 id) + { + struct bpf_prog_info_node *info_node; + struct perf_bpil *info_linear; + struct btf *btf = NULL; + u64 arrays; + u32 btf_id; +- int fd; ++ int fd, err = 0; + + fd = bpf_prog_get_fd_by_id(id); + if (fd < 0) +- return; ++ return -EINVAL; + + arrays = 1UL << PERF_BPIL_JITED_KSYMS; + arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS; +@@ -475,6 +481,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_linear = get_bpf_prog_info_linear(fd, arrays); + if (IS_ERR_OR_NULL(info_linear)) { + pr_debug("%s: failed to get BPF program info. aborting\n", __func__); ++ err = PTR_ERR(info_linear); + goto out; + } + +@@ -484,38 +491,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + if (info_node) { + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ pr_debug("%s: duplicate add bpf info request for id %u\n", ++ __func__, btf_id); + free(info_linear); + free(info_node); ++ goto out; + } +- } else ++ } else { + free(info_linear); ++ err = -ENOMEM; ++ goto out; ++ } + + if (btf_id == 0) + goto out; + + btf = btf__load_from_kernel_by_id(btf_id); +- if (libbpf_get_error(btf)) { +- pr_debug("%s: failed to get BTF of id %u, aborting\n", +- __func__, btf_id); +- goto out; ++ if (!btf) { ++ err = -errno; ++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err); ++ } else { ++ perf_env__fetch_btf(env, btf_id, btf); + } +- perf_env__fetch_btf(env, btf_id, btf); + + out: + btf__free(btf); + close(fd); ++ return err; + } + + static int bpf_event__sb_cb(union perf_event *event, void *data) + { + struct perf_env *env = data; ++ int ret = 0; + + if (event->header.type != PERF_RECORD_BPF_EVENT) + return -1; + + switch (event->bpf.type) { + case PERF_BPF_EVENT_PROG_LOAD: +- perf_env__add_bpf_info(env, event->bpf.id); ++ ret = perf_env__add_bpf_info(env, event->bpf.id); + + case PERF_BPF_EVENT_PROG_UNLOAD: + /* +@@ -529,7 +544,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data) + break; + } + +- return 0; ++ return ret; + } + + int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) +-- +2.51.0 + diff --git a/queue-6.16/perf-bpf-utils-constify-bpil_array_desc.patch b/queue-6.16/perf-bpf-utils-constify-bpil_array_desc.patch new file mode 100644 index 0000000000..78b27afdff --- /dev/null +++ b/queue-6.16/perf-bpf-utils-constify-bpil_array_desc.patch @@ -0,0 +1,112 @@ +From 937ebef2a7a7791e3dfc2ece8eda8013c085c626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:12 -0700 +Subject: perf bpf-utils: Constify bpil_array_desc + +From: Ian Rogers + +[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ] + +The array's contents is a compile time constant. Constify to make the +code more intention revealing and avoid unintended errors. + +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com +Signed-off-by: Namhyung Kim +Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear") +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 80b1d2b3729ba..64a5583446964 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -20,7 +20,7 @@ struct bpil_array_desc { + */ + }; + +-static struct bpil_array_desc bpil_array_desc[] = { ++static const struct bpil_array_desc bpil_array_desc[] = { + [PERF_BPIL_JITED_INSNS] = { + offsetof(struct bpf_prog_info, jited_prog_insns), + offsetof(struct bpf_prog_info, jited_prog_len), +@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + bool include_array = (arrays & (1UL << i)) > 0; +- struct bpil_array_desc *desc; + __u32 count, size; + +- desc = bpil_array_desc + i; +- + /* kernel is too old to support this field */ + if (info_len < desc->array_offset + sizeof(__u32) || + info_len < desc->count_offset + sizeof(__u32) || +@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + ptr = info_linear->data; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 count, size; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + count = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + size = bpf_prog_info_read_offset_u32(&info, desc->size_offset); + bpf_prog_info_set_offset_u32(&info_linear->info, +@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 6: verify the data */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 v1, v2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + v2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + addr = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + offs = addr - ptr_to_u64(info_linear->data); +@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + offs = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + addr = offs + ptr_to_u64(info_linear->data); +-- +2.51.0 + diff --git a/queue-6.16/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch b/queue-6.16/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch new file mode 100644 index 0000000000..b86a366a7d --- /dev/null +++ b/queue-6.16/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch @@ -0,0 +1,120 @@ +From d6a123b071d2efc9c4c6c06cc59e660212c95759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:13 -0700 +Subject: perf bpf-utils: Harden get_bpf_prog_info_linear + +From: Ian Rogers + +[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ] + +In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are +made, the first to compute memory requirements for a struct perf_bpil +and the second to fill it in. Previously the code would warn when the +second call didn't match the first. Such races can be common place in +things like perf test, whose perf trace tests will frequently load BPF +programs. Rather than a debug message, return actual errors for this +case. Out of paranoia also validate the read bpf_prog_info array +value. Change the type of ptr to avoid mismatched pointer type +compiler warnings. Add some additional debug print outs and sanity +asserts. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 64a5583446964..5a66dc8594aa8 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + __u32 info_len = sizeof(info); + __u32 data_len = 0; + int i, err; +- void *ptr; ++ __u8 *ptr; + + if (arrays >> PERF_BPIL_LAST_ARRAY) + return ERR_PTR(-EINVAL); +@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + pr_debug("can't get prog info: %s", strerror(errno)); + return ERR_PTR(-EFAULT); + } ++ if (info.type >= __MAX_BPF_PROG_TYPE) ++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type); + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + desc->count_offset, count); + bpf_prog_info_set_offset_u32(&info_linear->info, + desc->size_offset, size); ++ assert(ptr >= info_linear->data); ++ assert(ptr < &info_linear->data[data_len]); + bpf_prog_info_set_offset_u64(&info_linear->info, + desc->array_offset, + ptr_to_u64(ptr)); +@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + free(info_linear); + return ERR_PTR(-EFAULT); + } ++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) { ++ pr_debug("%s:%d: unexpected program type %u\n", ++ __func__, __LINE__, info_linear->info.type); ++ } + + /* step 6: verify the data */ ++ ptr = info_linear->data; + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { + const struct bpil_array_desc *desc = &bpil_array_desc[i]; +- __u32 v1, v2; ++ __u32 count1, count2, size1, size2; ++ __u64 ptr2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); ++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in element count\n", __func__); ++ if (count1 != count2) { ++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); ++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->size_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in rec size\n", __func__); ++ if (size1 != size2) { ++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset); ++ if (ptr_to_u64(ptr) != ptr2) { ++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr += roundup(count1 * size1, sizeof(__u64)); + } + + /* step 7: update info_len and data_len */ +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-acer-wmi-stop-using-acpi-bitmap-for-pla.patch b/queue-6.16/platform-x86-acer-wmi-stop-using-acpi-bitmap-for-pla.patch new file mode 100644 index 0000000000..4b40dc2d76 --- /dev/null +++ b/queue-6.16/platform-x86-acer-wmi-stop-using-acpi-bitmap-for-pla.patch @@ -0,0 +1,162 @@ +From eeeb2949c26b671462c7b011417ecf63c1fb3339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Aug 2025 22:40:07 +0200 +Subject: platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile + choices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit b0908e03fdd488a5ffd5b80d86dcfc77207464e7 ] + +It turns out that the platform firmware on some models does not return +valid data when reading the bitmap of supported platform profiles. +This prevents the driver from loading on said models, even when the +platform profile interface itself works. + +Fix this by stop using said bitmap until we have figured out how +the OEM software itself detects available platform profiles. + +Tested-by: Lynne Megido +Reported-by: Lynne Megido +Closes: https://lore.kernel.org/platform-driver-x86/3f56e68f-85df-4c0a-982c-43f9d635be38@bune.city/ +Fixes: 191e21f1a4c3 ("platform/x86: acer-wmi: use an ACPI bitmap to set the platform profile choices") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20250826204007.5088-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 71 ++++++--------------------------- + 1 file changed, 12 insertions(+), 59 deletions(-) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 69336bd778eea..13eb22b35aa8f 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -129,6 +129,7 @@ enum acer_wmi_predator_v4_oc { + enum acer_wmi_gaming_misc_setting { + ACER_WMID_MISC_SETTING_OC_1 = 0x0005, + ACER_WMID_MISC_SETTING_OC_2 = 0x0007, ++ /* Unreliable on some models */ + ACER_WMID_MISC_SETTING_SUPPORTED_PROFILES = 0x000A, + ACER_WMID_MISC_SETTING_PLATFORM_PROFILE = 0x000B, + }; +@@ -794,9 +795,6 @@ static bool platform_profile_support; + */ + static int last_non_turbo_profile = INT_MIN; + +-/* The most performant supported profile */ +-static int acer_predator_v4_max_perf; +- + enum acer_predator_v4_thermal_profile { + ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET = 0x00, + ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED = 0x01, +@@ -2014,7 +2012,7 @@ acer_predator_v4_platform_profile_set(struct device *dev, + if (err) + return err; + +- if (tp != acer_predator_v4_max_perf) ++ if (tp != ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO) + last_non_turbo_profile = tp; + + return 0; +@@ -2023,55 +2021,14 @@ acer_predator_v4_platform_profile_set(struct device *dev, + static int + acer_predator_v4_platform_profile_probe(void *drvdata, unsigned long *choices) + { +- unsigned long supported_profiles; +- int err; ++ set_bit(PLATFORM_PROFILE_PERFORMANCE, choices); ++ set_bit(PLATFORM_PROFILE_BALANCED_PERFORMANCE, choices); ++ set_bit(PLATFORM_PROFILE_BALANCED, choices); ++ set_bit(PLATFORM_PROFILE_QUIET, choices); ++ set_bit(PLATFORM_PROFILE_LOW_POWER, choices); + +- err = WMID_gaming_get_misc_setting(ACER_WMID_MISC_SETTING_SUPPORTED_PROFILES, +- (u8 *)&supported_profiles); +- if (err) +- return err; +- +- /* Iterate through supported profiles in order of increasing performance */ +- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_ECO, &supported_profiles)) { +- set_bit(PLATFORM_PROFILE_LOW_POWER, choices); +- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_ECO; +- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_ECO; +- } +- +- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET, &supported_profiles)) { +- set_bit(PLATFORM_PROFILE_QUIET, choices); +- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET; +- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET; +- } +- +- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED, &supported_profiles)) { +- set_bit(PLATFORM_PROFILE_BALANCED, choices); +- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED; +- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED; +- } +- +- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE, &supported_profiles)) { +- set_bit(PLATFORM_PROFILE_BALANCED_PERFORMANCE, choices); +- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE; +- +- /* We only use this profile as a fallback option in case no prior +- * profile is supported. +- */ +- if (last_non_turbo_profile < 0) +- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE; +- } +- +- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO, &supported_profiles)) { +- set_bit(PLATFORM_PROFILE_PERFORMANCE, choices); +- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO; +- +- /* We need to handle the hypothetical case where only the turbo profile +- * is supported. In this case the turbo toggle will essentially be a +- * no-op. +- */ +- if (last_non_turbo_profile < 0) +- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO; +- } ++ /* Set default non-turbo profile */ ++ last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED; + + return 0; + } +@@ -2108,19 +2065,15 @@ static int acer_thermal_profile_change(void) + if (cycle_gaming_thermal_profile) { + platform_profile_cycle(); + } else { +- /* Do nothing if no suitable platform profiles where found */ +- if (last_non_turbo_profile < 0) +- return 0; +- + err = WMID_gaming_get_misc_setting( + ACER_WMID_MISC_SETTING_PLATFORM_PROFILE, ¤t_tp); + if (err) + return err; + +- if (current_tp == acer_predator_v4_max_perf) ++ if (current_tp == ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO) + tp = last_non_turbo_profile; + else +- tp = acer_predator_v4_max_perf; ++ tp = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO; + + err = WMID_gaming_set_misc_setting( + ACER_WMID_MISC_SETTING_PLATFORM_PROFILE, tp); +@@ -2128,7 +2081,7 @@ static int acer_thermal_profile_change(void) + return err; + + /* Store last profile for toggle */ +- if (current_tp != acer_predator_v4_max_perf) ++ if (current_tp != ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO) + last_non_turbo_profile = current_tp; + + platform_profile_notify(platform_profile_device); +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-asus-wmi-fix-racy-registrations.patch b/queue-6.16/platform-x86-asus-wmi-fix-racy-registrations.patch new file mode 100644 index 0000000000..03ffa2ae18 --- /dev/null +++ b/queue-6.16/platform-x86-asus-wmi-fix-racy-registrations.patch @@ -0,0 +1,73 @@ +From be32abf3e37cb11e5ed02387839dbe61781dcdd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 07:24:33 +0200 +Subject: platform/x86: asus-wmi: Fix racy registrations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +[ Upstream commit 5549202b9c02c2ecbc8634768a3da8d9e82d548d ] + +asus_wmi_register_driver() may be called from multiple drivers +concurrently, which can lead to the racy list operations, eventually +corrupting the memory and hitting Oops on some ASUS machines. +Also, the error handling is missing, and it forgot to unregister ACPI +lps0 dev ops in the error case. + +This patch covers those issues by introducing a simple mutex at +acpi_wmi_register_driver() & *_unregister_driver, and adding the +proper call of asus_s2idle_check_unregister() in the error path. + +Fixes: feea7bd6b02d ("platform/x86: asus-wmi: Refactor Ally suspend/resume") +Link: https://bugzilla.suse.com/show_bug.cgi?id=1246924 +Link: https://lore.kernel.org/07815053-0e31-4e8e-8049-b652c929323b@kernel.org +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20250827052441.23382-1-tiwai@suse.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index f7191fdded14d..e72a2b5d158e9 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -5088,16 +5088,22 @@ static int asus_wmi_probe(struct platform_device *pdev) + + asus_s2idle_check_register(); + +- return asus_wmi_add(pdev); ++ ret = asus_wmi_add(pdev); ++ if (ret) ++ asus_s2idle_check_unregister(); ++ ++ return ret; + } + + static bool used; ++static DEFINE_MUTEX(register_mutex); + + int __init_or_module asus_wmi_register_driver(struct asus_wmi_driver *driver) + { + struct platform_driver *platform_driver; + struct platform_device *platform_device; + ++ guard(mutex)(®ister_mutex); + if (used) + return -EBUSY; + +@@ -5120,6 +5126,7 @@ EXPORT_SYMBOL_GPL(asus_wmi_register_driver); + + void asus_wmi_unregister_driver(struct asus_wmi_driver *driver) + { ++ guard(mutex)(®ister_mutex); + asus_s2idle_check_unregister(); + + platform_device_unregister(driver->platform_device); +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch b/queue-6.16/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch new file mode 100644 index 0000000000..0f2dd70d1b --- /dev/null +++ b/queue-6.16/platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch @@ -0,0 +1,46 @@ +From bad2d68fd880f75031e53aab1762abbf9a20fe7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 17:47:09 +0200 +Subject: platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit cf3940ac737d05c85395f343fe33a3cfcadb47db ] + +Currently, the ignore_key_wlan quirk applies to keycodes 0x5D, 0x5E, and +0x5F. However, the relevant code for the Asus Zenbook Duo is only 0x5F. +Since this code is emitted by other Asus devices, such as from the Z13 +for its ROG button, remove the extra codes before expanding the quirk. + +For the Duo devices, which are the only ones that use this quirk, there +should be no effect. + +Fixes: 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA") +Signed-off-by: Antheas Kapenekakis +Link: https://lore.kernel.org/r/20250808154710.8981-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index f84c3d03c1de7..e6726be5890e7 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -655,8 +655,6 @@ static void asus_nb_wmi_key_filter(struct asus_wmi_driver *asus_wmi, int *code, + if (atkbd_reports_vol_keys) + *code = ASUS_WMI_KEY_IGNORE; + break; +- case 0x5D: /* Wireless console Toggle */ +- case 0x5E: /* Wireless console Enable */ + case 0x5F: /* Wireless console Disable */ + if (quirks->ignore_key_wlan) + *code = ASUS_WMI_KEY_IGNORE; +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-intel-power-domains-use-topology_logica.patch b/queue-6.16/platform-x86-intel-power-domains-use-topology_logica.patch new file mode 100644 index 0000000000..66ecc7e5cf --- /dev/null +++ b/queue-6.16/platform-x86-intel-power-domains-use-topology_logica.patch @@ -0,0 +1,47 @@ +From b779261adebce0478d6dbd6d84bb7606855f2546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 07:38:59 -0400 +Subject: platform/x86/intel: power-domains: Use topology_logical_package_id() + for package ID +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Arcari + +[ Upstream commit aa28991fd5dc4c01a40caab2bd9af8c5e06f9899 ] + +Currently, tpmi_get_logical_id() calls topology_physical_package_id() +to set the pkg_id of the info structure. Since some VM hosts assign non +contiguous package IDs, topology_physical_package_id() can return a +larger value than topology_max_packages(). This will result in an +invalid reference into tpmi_power_domain_mask[] as that is allocatead +based on topology_max_packages() as the maximum package ID. + +Fixes: 17ca2780458c ("platform/x86/intel: TPMI domain id and CPU mapping") +Signed-off-by: David Arcari +Acked-by: Srinivas Pandruvada +Link: https://lore.kernel.org/r/20250829113859.1772827-1-darcari@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/tpmi_power_domains.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c +index 9d8247bb9cfa5..8641353b2e061 100644 +--- a/drivers/platform/x86/intel/tpmi_power_domains.c ++++ b/drivers/platform/x86/intel/tpmi_power_domains.c +@@ -178,7 +178,7 @@ static int tpmi_get_logical_id(unsigned int cpu, struct tpmi_cpu_info *info) + + info->punit_thread_id = FIELD_GET(LP_ID_MASK, data); + info->punit_core_id = FIELD_GET(MODULE_ID_MASK, data); +- info->pkg_id = topology_physical_package_id(cpu); ++ info->pkg_id = topology_logical_package_id(cpu); + info->linux_cpu = cpu; + + return 0; +-- +2.51.0 + diff --git a/queue-6.16/scsi-sr-reinstate-rotational-media-flag.patch b/queue-6.16/scsi-sr-reinstate-rotational-media-flag.patch new file mode 100644 index 0000000000..27fc5c7cca --- /dev/null +++ b/queue-6.16/scsi-sr-reinstate-rotational-media-flag.patch @@ -0,0 +1,78 @@ +From a7ecaf4a24e5b222976cc5301f2c88ab101f56ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 19:35:50 +0800 +Subject: scsi: sr: Reinstate rotational media flag + +From: Ming Lei + +[ Upstream commit 708e2371f77a9d3f2f1d54d1ec835d71b9d0dafe ] + +Reinstate the rotational media flag for the CD-ROM driver. The flag has +been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to +queue_limits") and this breaks some applications. + +Move queue limit configuration from get_sectorsize() to +sr_revalidate_disk() and set the rotational flag. + +Cc: Christoph Hellwig +Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sr.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index b17796d5ee665..add13e3068983 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -475,13 +475,21 @@ static blk_status_t sr_init_command(struct scsi_cmnd *SCpnt) + + static int sr_revalidate_disk(struct scsi_cd *cd) + { ++ struct request_queue *q = cd->device->request_queue; + struct scsi_sense_hdr sshdr; ++ struct queue_limits lim; ++ int sector_size; + + /* if the unit is not ready, nothing more to do */ + if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr)) + return 0; + sr_cd_check(&cd->cdi); +- return get_sectorsize(cd); ++ sector_size = get_sectorsize(cd); ++ ++ lim = queue_limits_start_update(q); ++ lim.logical_block_size = sector_size; ++ lim.features |= BLK_FEAT_ROTATIONAL; ++ return queue_limits_commit_update_frozen(q, &lim); + } + + static int sr_block_open(struct gendisk *disk, blk_mode_t mode) +@@ -721,10 +729,8 @@ static int sr_probe(struct device *dev) + + static int get_sectorsize(struct scsi_cd *cd) + { +- struct request_queue *q = cd->device->request_queue; + static const u8 cmd[10] = { READ_CAPACITY }; + unsigned char buffer[8] = { }; +- struct queue_limits lim; + int err; + int sector_size; + struct scsi_failure failure_defs[] = { +@@ -795,9 +801,7 @@ static int get_sectorsize(struct scsi_cd *cd) + set_capacity(cd->disk, cd->capacity); + } + +- lim = queue_limits_start_update(q); +- lim.logical_block_size = sector_size; +- return queue_limits_commit_update_frozen(q, &lim); ++ return sector_size; + } + + static int get_capabilities(struct scsi_cd *cd) +-- +2.51.0 + diff --git a/queue-6.16/series b/queue-6.16/series index 743d5e4c01..421861ff13 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -145,3 +145,28 @@ alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch alsa-hda-tas2781-fix-tas2563-efi-data-endianness.patch alsa-hda-tas2781-reorder-tas2563-calibration-variables.patch +pcmcia-omap-add-missing-check-for-platform_get_resou.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch +platform-x86-asus-wmi-fix-racy-registrations.patch +platform-x86-acer-wmi-stop-using-acpi-bitmap-for-pla.patch +platform-x86-intel-power-domains-use-topology_logica.patch +hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch +hwmon-ina238-correctly-clamp-temperature.patch +scsi-sr-reinstate-rotational-media-flag.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch +hwmon-ina238-correctly-clamp-shunt-voltage-limit.patch +hwmon-ina238-correctly-clamp-power-limits.patch +drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch +perf-bpf-event-fix-use-after-free-in-synthesis.patch +perf-bpf-utils-constify-bpil_array_desc.patch +perf-bpf-utils-harden-get_bpf_prog_info_linear.patch +spi-spi-qpic-snand-unregister-ecc-engine-on-probe-er.patch +drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch +tools-gpio-remove-the-include-directory-on-make-clea.patch +md-raid1-fix-data-lost-for-writemostly-rdev.patch +md-prevent-incorrect-update-of-resync-recovery-offse.patch +drm-i915-gem-allow-exec_capture-on-recoverable-conte.patch diff --git a/queue-6.16/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch b/queue-6.16/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch new file mode 100644 index 0000000000..d9cbb53bb1 --- /dev/null +++ b/queue-6.16/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch @@ -0,0 +1,65 @@ +From 2f660c9efa85d20b3b3513fd93998d610c977dab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:43 +0100 +Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module + +From: Larisa Grigore + +[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ] + +Clear the error flags after disabling the module to avoid the case when +a flag is set again between flag clear and module disable. And use +SR_CLEAR_MASK to replace hardcoded value for improved readability. + +Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa +("spi: lpspi: Fix CLK pin becomes low before one transfer"), the +original driver only reset SR in the interrupt handler, making it +vulnerable to the same issue. Therefore the fixes commit is set at the +introduction of the driver. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: Ciprian Marian Costea +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 0bb25b473271c..90e4028ca14fc 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -83,6 +83,8 @@ + #define TCR_RXMSK BIT(19) + #define TCR_TXMSK BIT(18) + ++#define SR_CLEAR_MASK GENMASK(13, 8) ++ + struct fsl_lpspi_devtype_data { + u8 prescale_max; + }; +@@ -536,14 +538,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi) + fsl_lpspi_intctrl(fsl_lpspi, 0); + } + +- /* W1C for all flags in SR */ +- temp = 0x3F << 8; +- writel(temp, fsl_lpspi->base + IMX7ULP_SR); +- + /* Clear FIFO and disable module */ + temp = CR_RRF | CR_RTF; + writel(temp, fsl_lpspi->base + IMX7ULP_CR); + ++ /* W1C for all flags in SR */ ++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-6.16/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..c52bfcafc8 --- /dev/null +++ b/queue-6.16/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 496dd08f37d6248a78b54877b7199e9d819b3e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 1a22d356a73d9..fbe58cbf33864 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -786,7 +786,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-6.16/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-6.16/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..00058b76b0 --- /dev/null +++ b/queue-6.16/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From a51db581285dd744127eb750942620d8a8b2567d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 55570c814dcdd..0bb25b473271c 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -734,12 +734,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-6.16/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-6.16/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..26cdd4344f --- /dev/null +++ b/queue-6.16/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From 09615b42c36048e07e15d7ae5f2ef1a9d4951406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index fbe58cbf33864..55570c814dcdd 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -70,7 +71,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_HOST BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -424,7 +425,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-6.16/spi-spi-qpic-snand-unregister-ecc-engine-on-probe-er.patch b/queue-6.16/spi-spi-qpic-snand-unregister-ecc-engine-on-probe-er.patch new file mode 100644 index 0000000000..c258691f7b --- /dev/null +++ b/queue-6.16/spi-spi-qpic-snand-unregister-ecc-engine-on-probe-er.patch @@ -0,0 +1,58 @@ +From b68201a09a624dd1a85f8c4bd303edd35de5583e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 13:56:24 +0200 +Subject: spi: spi-qpic-snand: unregister ECC engine on probe error and device + remove + +From: Gabor Juhos + +[ Upstream commit 1991a458528588ff34e98b6365362560d208710f ] + +The on-host hardware ECC engine remains registered both when +the spi_register_controller() function returns with an error +and also on device removal. + +Change the qcom_spi_probe() function to unregister the engine +on the error path, and add the missing unregistering call to +qcom_spi_remove() to avoid possible use-after-free issues. + +Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") +Signed-off-by: Gabor Juhos +Message-ID: <20250903-qpic-snand-unregister-ecceng-v1-1-ef5387b0abdc@gmail.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qpic-snand.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c +index e98e997680c75..cfc81327f7a44 100644 +--- a/drivers/spi/spi-qpic-snand.c ++++ b/drivers/spi/spi-qpic-snand.c +@@ -1615,11 +1615,13 @@ static int qcom_spi_probe(struct platform_device *pdev) + ret = spi_register_controller(ctlr); + if (ret) { + dev_err(&pdev->dev, "spi_register_controller failed.\n"); +- goto err_spi_init; ++ goto err_register_controller; + } + + return 0; + ++err_register_controller: ++ nand_ecc_unregister_on_host_hw_engine(&snandc->qspi->ecc_eng); + err_spi_init: + qcom_nandc_unalloc(snandc); + err_snand_alloc: +@@ -1641,7 +1643,7 @@ static void qcom_spi_remove(struct platform_device *pdev) + struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + + spi_unregister_controller(ctlr); +- ++ nand_ecc_unregister_on_host_hw_engine(&snandc->qspi->ecc_eng); + qcom_nandc_unalloc(snandc); + + clk_disable_unprepare(snandc->aon_clk); +-- +2.51.0 + diff --git a/queue-6.16/tools-gpio-remove-the-include-directory-on-make-clea.patch b/queue-6.16/tools-gpio-remove-the-include-directory-on-make-clea.patch new file mode 100644 index 0000000000..e80af597f1 --- /dev/null +++ b/queue-6.16/tools-gpio-remove-the-include-directory-on-make-clea.patch @@ -0,0 +1,37 @@ +From 4f64f7de1601771bb5fd159756cae16d321dea31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 14:36:20 +0800 +Subject: tools: gpio: remove the include directory on make clean + +From: zhang jiao + +[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ] + +Remove the generated include directory when running make clean. + +Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem") +Signed-off-by: Zhang Jiao +Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com +[Bartosz: add Fixes tag, improve the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index ed565eb52275f..342e056c8c665 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + + clean: + rm -f $(ALL_PROGRAMS) +- rm -f $(OUTPUT)include/linux/gpio.h ++ rm -rf $(OUTPUT)include + find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) +-- +2.51.0 + diff --git a/queue-6.6/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch b/queue-6.6/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch new file mode 100644 index 0000000000..46343b29a3 --- /dev/null +++ b/queue-6.6/drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch @@ -0,0 +1,39 @@ +From d0420667c9d67d75aa17a275e972b321eec017aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:40:50 +0100 +Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure + +From: Colin Ian King + +[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ] + +Currently the kzalloc failure check just sets reports the failure +and sets the variable ret to -ENOMEM, which is not checked later +for this specific error. Fix this by just returning -ENOMEM rather +than setting ret. + +Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index e9a83865ae012..c83445c2e37f3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -409,7 +409,7 @@ static int psp_sw_init(void *handle) + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { + dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); +- ret = -ENOMEM; ++ return -ENOMEM; + } + + adev->psp.xgmi_context.supports_extended_data = +-- +2.51.0 + diff --git a/queue-6.6/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch b/queue-6.6/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch new file mode 100644 index 0000000000..594deedd66 --- /dev/null +++ b/queue-6.6/drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch @@ -0,0 +1,563 @@ +From ebad0221338175633b59238bc49f93650b5610c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Dec 2023 18:14:23 +0800 +Subject: drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c + +From: Hawking Zhang + +[ Upstream commit ac3ff8a90637e813005404a0110802aa384af4aa ] + +So kernel message has the device pcie bdf information, +which helps issue debugging especially in multiple GPU +system. + +Signed-off-by: Hawking Zhang +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 144 ++++++++++++------------ + 1 file changed, 75 insertions(+), 69 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index ffa5e72a84ebc..e9a83865ae012 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -291,21 +291,22 @@ static int psp_memory_training_init(struct psp_context *psp) + struct psp_memory_training_context *ctx = &psp->mem_train_ctx; + + if (ctx->init != PSP_MEM_TRAIN_RESERVE_SUCCESS) { +- DRM_DEBUG("memory training is not supported!\n"); ++ dev_dbg(psp->adev->dev, "memory training is not supported!\n"); + return 0; + } + + ctx->sys_cache = kzalloc(ctx->train_data_size, GFP_KERNEL); + if (ctx->sys_cache == NULL) { +- DRM_ERROR("alloc mem_train_ctx.sys_cache failed!\n"); ++ dev_err(psp->adev->dev, "alloc mem_train_ctx.sys_cache failed!\n"); + ret = -ENOMEM; + goto Err_out; + } + +- DRM_DEBUG("train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", +- ctx->train_data_size, +- ctx->p2c_train_data_offset, +- ctx->c2p_train_data_offset); ++ dev_dbg(psp->adev->dev, ++ "train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n", ++ ctx->train_data_size, ++ ctx->p2c_train_data_offset, ++ ctx->c2p_train_data_offset); + ctx->init = PSP_MEM_TRAIN_INIT_SUCCESS; + return 0; + +@@ -407,7 +408,7 @@ static int psp_sw_init(void *handle) + + psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); + if (!psp->cmd) { +- DRM_ERROR("Failed to allocate memory to command buffer!\n"); ++ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n"); + ret = -ENOMEM; + } + +@@ -454,13 +455,13 @@ static int psp_sw_init(void *handle) + if (mem_training_ctx->enable_mem_training) { + ret = psp_memory_training_init(psp); + if (ret) { +- DRM_ERROR("Failed to initialize memory training!\n"); ++ dev_err(adev->dev, "Failed to initialize memory training!\n"); + return ret; + } + + ret = psp_mem_training(psp, PSP_MEM_TRAIN_COLD_BOOT); + if (ret) { +- DRM_ERROR("Failed to process memory training!\n"); ++ dev_err(adev->dev, "Failed to process memory training!\n"); + return ret; + } + } +@@ -674,9 +675,11 @@ psp_cmd_submit_buf(struct psp_context *psp, + */ + if (!skip_unsupport && (psp->cmd_buf_mem->resp.status || !timeout) && !ras_intr) { + if (ucode) +- DRM_WARN("failed to load ucode %s(0x%X) ", +- amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); +- DRM_WARN("psp gfx command %s(0x%X) failed and response status is (0x%X)\n", ++ dev_warn(psp->adev->dev, ++ "failed to load ucode %s(0x%X) ", ++ amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id); ++ dev_warn(psp->adev->dev, ++ "psp gfx command %s(0x%X) failed and response status is (0x%X)\n", + psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id, + psp->cmd_buf_mem->resp.status); + /* If any firmware (including CAP) load fails under SRIOV, it should +@@ -806,7 +809,7 @@ static int psp_tmr_init(struct psp_context *psp) + psp->fw_pri_buf) { + ret = psp_load_toc(psp, &tmr_size); + if (ret) { +- DRM_ERROR("Failed to load toc\n"); ++ dev_err(psp->adev->dev, "Failed to load toc\n"); + return ret; + } + } +@@ -854,7 +857,7 @@ static int psp_tmr_load(struct psp_context *psp) + + psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo); + if (psp->tmr_bo) +- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n", ++ dev_info(psp->adev->dev, "reserve 0x%lx from 0x%llx for PSP TMR\n", + amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr); + + ret = psp_cmd_submit_buf(psp, NULL, cmd, +@@ -1112,7 +1115,7 @@ int psp_reg_program(struct psp_context *psp, enum psp_reg_prog_id reg, + psp_prep_reg_prog_cmd_buf(cmd, reg, value); + ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr); + if (ret) +- DRM_ERROR("PSP failed to program reg id %d", reg); ++ dev_err(psp->adev->dev, "PSP failed to program reg id %d\n", reg); + + release_psp_cmd_buf(psp); + +@@ -1492,22 +1495,22 @@ static void psp_ras_ta_check_status(struct psp_context *psp) + switch (ras_cmd->ras_status) { + case TA_RAS_STATUS__ERROR_UNSUPPORTED_IP: + dev_warn(psp->adev->dev, +- "RAS WARNING: cmd failed due to unsupported ip\n"); ++ "RAS WARNING: cmd failed due to unsupported ip\n"); + break; + case TA_RAS_STATUS__ERROR_UNSUPPORTED_ERROR_INJ: + dev_warn(psp->adev->dev, +- "RAS WARNING: cmd failed due to unsupported error injection\n"); ++ "RAS WARNING: cmd failed due to unsupported error injection\n"); + break; + case TA_RAS_STATUS__SUCCESS: + break; + case TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED: + if (ras_cmd->cmd_id == TA_RAS_COMMAND__TRIGGER_ERROR) + dev_warn(psp->adev->dev, +- "RAS WARNING: Inject error to critical region is not allowed\n"); ++ "RAS WARNING: Inject error to critical region is not allowed\n"); + break; + default: + dev_warn(psp->adev->dev, +- "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); ++ "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status); + break; + } + } +@@ -1531,7 +1534,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id) + return ret; + + if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) { +- DRM_WARN("RAS: Unsupported Interface"); ++ dev_warn(psp->adev->dev, "RAS: Unsupported Interface\n"); + return -EINVAL; + } + +@@ -1681,7 +1684,7 @@ int psp_ras_initialize(struct psp_context *psp) + psp->ras_context.context.initialized = true; + else { + if (ras_cmd->ras_status) +- dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); ++ dev_warn(adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status); + + /* fail to load RAS TA */ + psp->ras_context.context.initialized = false; +@@ -2101,7 +2104,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_kdb != NULL)) { + ret = psp_bootloader_load_kdb(psp); + if (ret) { +- DRM_ERROR("PSP load kdb failed!\n"); ++ dev_err(adev->dev, "PSP load kdb failed!\n"); + return ret; + } + } +@@ -2110,7 +2113,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_spl != NULL)) { + ret = psp_bootloader_load_spl(psp); + if (ret) { +- DRM_ERROR("PSP load spl failed!\n"); ++ dev_err(adev->dev, "PSP load spl failed!\n"); + return ret; + } + } +@@ -2119,7 +2122,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_sysdrv != NULL)) { + ret = psp_bootloader_load_sysdrv(psp); + if (ret) { +- DRM_ERROR("PSP load sys drv failed!\n"); ++ dev_err(adev->dev, "PSP load sys drv failed!\n"); + return ret; + } + } +@@ -2128,7 +2131,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_soc_drv != NULL)) { + ret = psp_bootloader_load_soc_drv(psp); + if (ret) { +- DRM_ERROR("PSP load soc drv failed!\n"); ++ dev_err(adev->dev, "PSP load soc drv failed!\n"); + return ret; + } + } +@@ -2137,7 +2140,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_intf_drv != NULL)) { + ret = psp_bootloader_load_intf_drv(psp); + if (ret) { +- DRM_ERROR("PSP load intf drv failed!\n"); ++ dev_err(adev->dev, "PSP load intf drv failed!\n"); + return ret; + } + } +@@ -2146,7 +2149,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_dbg_drv != NULL)) { + ret = psp_bootloader_load_dbg_drv(psp); + if (ret) { +- DRM_ERROR("PSP load dbg drv failed!\n"); ++ dev_err(adev->dev, "PSP load dbg drv failed!\n"); + return ret; + } + } +@@ -2155,7 +2158,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_ras_drv != NULL)) { + ret = psp_bootloader_load_ras_drv(psp); + if (ret) { +- DRM_ERROR("PSP load ras_drv failed!\n"); ++ dev_err(adev->dev, "PSP load ras_drv failed!\n"); + return ret; + } + } +@@ -2164,7 +2167,7 @@ static int psp_hw_start(struct psp_context *psp) + (psp->funcs->bootloader_load_sos != NULL)) { + ret = psp_bootloader_load_sos(psp); + if (ret) { +- DRM_ERROR("PSP load sos failed!\n"); ++ dev_err(adev->dev, "PSP load sos failed!\n"); + return ret; + } + } +@@ -2172,7 +2175,7 @@ static int psp_hw_start(struct psp_context *psp) + + ret = psp_ring_create(psp, PSP_RING_TYPE__KM); + if (ret) { +- DRM_ERROR("PSP create ring failed!\n"); ++ dev_err(adev->dev, "PSP create ring failed!\n"); + return ret; + } + +@@ -2182,7 +2185,7 @@ static int psp_hw_start(struct psp_context *psp) + if (!psp_boottime_tmr(psp)) { + ret = psp_tmr_init(psp); + if (ret) { +- DRM_ERROR("PSP tmr init failed!\n"); ++ dev_err(adev->dev, "PSP tmr init failed!\n"); + return ret; + } + } +@@ -2201,7 +2204,7 @@ static int psp_hw_start(struct psp_context *psp) + + ret = psp_tmr_load(psp); + if (ret) { +- DRM_ERROR("PSP load tmr failed!\n"); ++ dev_err(adev->dev, "PSP load tmr failed!\n"); + return ret; + } + +@@ -2448,7 +2451,8 @@ static void psp_print_fw_hdr(struct psp_context *psp, + } + } + +-static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, ++static int psp_prep_load_ip_fw_cmd_buf(struct psp_context *psp, ++ struct amdgpu_firmware_info *ucode, + struct psp_gfx_cmd_resp *cmd) + { + int ret; +@@ -2461,7 +2465,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode, + + ret = psp_get_fw_type(ucode, &cmd->cmd.cmd_load_ip_fw.fw_type); + if (ret) +- DRM_ERROR("Unknown firmware type\n"); ++ dev_err(psp->adev->dev, "Unknown firmware type\n"); + + return ret; + } +@@ -2472,7 +2476,7 @@ int psp_execute_ip_fw_load(struct psp_context *psp, + int ret = 0; + struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp); + +- ret = psp_prep_load_ip_fw_cmd_buf(ucode, cmd); ++ ret = psp_prep_load_ip_fw_cmd_buf(psp, ucode, cmd); + if (!ret) { + ret = psp_cmd_submit_buf(psp, ucode, cmd, + psp->fence_buf_mc_addr); +@@ -2507,13 +2511,13 @@ static int psp_load_smu_fw(struct psp_context *psp) + adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) { + ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD); + if (ret) +- DRM_WARN("Failed to set MP1 state prepare for reload\n"); ++ dev_err(adev->dev, "Failed to set MP1 state prepare for reload\n"); + } + + ret = psp_execute_ip_fw_load(psp, ucode); + + if (ret) +- DRM_ERROR("PSP load smu failed!\n"); ++ dev_err(adev->dev, "PSP load smu failed!\n"); + + return ret; + } +@@ -2609,7 +2613,7 @@ static int psp_load_non_psp_fw(struct psp_context *psp) + adev->virt.autoload_ucode_id : AMDGPU_UCODE_ID_RLC_G)) { + ret = psp_rlc_autoload_start(psp); + if (ret) { +- DRM_ERROR("Failed to start rlc autoload\n"); ++ dev_err(adev->dev, "Failed to start rlc autoload\n"); + return ret; + } + } +@@ -2631,7 +2635,7 @@ static int psp_load_fw(struct amdgpu_device *adev) + + ret = psp_ring_init(psp, PSP_RING_TYPE__KM); + if (ret) { +- DRM_ERROR("PSP ring init failed!\n"); ++ dev_err(adev->dev, "PSP ring init failed!\n"); + goto failed; + } + } +@@ -2646,13 +2650,13 @@ static int psp_load_fw(struct amdgpu_device *adev) + + ret = psp_asd_initialize(psp); + if (ret) { +- DRM_ERROR("PSP load asd failed!\n"); ++ dev_err(adev->dev, "PSP load asd failed!\n"); + goto failed1; + } + + ret = psp_rl_load(adev); + if (ret) { +- DRM_ERROR("PSP load RL failed!\n"); ++ dev_err(adev->dev, "PSP load RL failed!\n"); + goto failed1; + } + +@@ -2672,7 +2676,7 @@ static int psp_load_fw(struct amdgpu_device *adev) + ret = psp_ras_initialize(psp); + if (ret) + dev_err(psp->adev->dev, +- "RAS: Failed to initialize RAS\n"); ++ "RAS: Failed to initialize RAS\n"); + + ret = psp_hdcp_initialize(psp); + if (ret) +@@ -2725,7 +2729,7 @@ static int psp_hw_init(void *handle) + + ret = psp_load_fw(adev); + if (ret) { +- DRM_ERROR("PSP firmware loading failed\n"); ++ dev_err(adev->dev, "PSP firmware loading failed\n"); + goto failed; + } + +@@ -2772,7 +2776,7 @@ static int psp_suspend(void *handle) + psp->xgmi_context.context.initialized) { + ret = psp_xgmi_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate xgmi ta\n"); ++ dev_err(adev->dev, "Failed to terminate xgmi ta\n"); + goto out; + } + } +@@ -2780,46 +2784,46 @@ static int psp_suspend(void *handle) + if (psp->ta_fw) { + ret = psp_ras_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate ras ta\n"); ++ dev_err(adev->dev, "Failed to terminate ras ta\n"); + goto out; + } + ret = psp_hdcp_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate hdcp ta\n"); ++ dev_err(adev->dev, "Failed to terminate hdcp ta\n"); + goto out; + } + ret = psp_dtm_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate dtm ta\n"); ++ dev_err(adev->dev, "Failed to terminate dtm ta\n"); + goto out; + } + ret = psp_rap_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate rap ta\n"); ++ dev_err(adev->dev, "Failed to terminate rap ta\n"); + goto out; + } + ret = psp_securedisplay_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate securedisplay ta\n"); ++ dev_err(adev->dev, "Failed to terminate securedisplay ta\n"); + goto out; + } + } + + ret = psp_asd_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate asd\n"); ++ dev_err(adev->dev, "Failed to terminate asd\n"); + goto out; + } + + ret = psp_tmr_terminate(psp); + if (ret) { +- DRM_ERROR("Failed to terminate tmr\n"); ++ dev_err(adev->dev, "Failed to terminate tmr\n"); + goto out; + } + + ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); + if (ret) +- DRM_ERROR("PSP ring stop failed\n"); ++ dev_err(adev->dev, "PSP ring stop failed\n"); + + out: + return ret; +@@ -2831,12 +2835,12 @@ static int psp_resume(void *handle) + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct psp_context *psp = &adev->psp; + +- DRM_INFO("PSP is resuming...\n"); ++ dev_info(adev->dev, "PSP is resuming...\n"); + + if (psp->mem_train_ctx.enable_mem_training) { + ret = psp_mem_training(psp, PSP_MEM_TRAIN_RESUME); + if (ret) { +- DRM_ERROR("Failed to process memory training!\n"); ++ dev_err(adev->dev, "Failed to process memory training!\n"); + return ret; + } + } +@@ -2853,7 +2857,7 @@ static int psp_resume(void *handle) + + ret = psp_asd_initialize(psp); + if (ret) { +- DRM_ERROR("PSP load asd failed!\n"); ++ dev_err(adev->dev, "PSP load asd failed!\n"); + goto failed; + } + +@@ -2877,7 +2881,7 @@ static int psp_resume(void *handle) + ret = psp_ras_initialize(psp); + if (ret) + dev_err(psp->adev->dev, +- "RAS: Failed to initialize RAS\n"); ++ "RAS: Failed to initialize RAS\n"); + + ret = psp_hdcp_initialize(psp); + if (ret) +@@ -2905,7 +2909,7 @@ static int psp_resume(void *handle) + return 0; + + failed: +- DRM_ERROR("PSP resume failed\n"); ++ dev_err(adev->dev, "PSP resume failed\n"); + mutex_unlock(&adev->firmware.mutex); + return ret; + } +@@ -2966,9 +2970,11 @@ int psp_ring_cmd_submit(struct psp_context *psp, + write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw); + /* Check invalid write_frame ptr address */ + if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) { +- DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", +- ring_buffer_start, ring_buffer_end, write_frame); +- DRM_ERROR("write_frame is pointing to address out of bounds\n"); ++ dev_err(adev->dev, ++ "ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n", ++ ring_buffer_start, ring_buffer_end, write_frame); ++ dev_err(adev->dev, ++ "write_frame is pointing to address out of bounds\n"); + return -EINVAL; + } + +@@ -3495,7 +3501,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, + int ret; + + if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { +- DRM_INFO("PSP block is not ready yet."); ++ dev_info(adev->dev, "PSP block is not ready yet\n."); + return -EBUSY; + } + +@@ -3504,7 +3510,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev, + mutex_unlock(&adev->psp.mutex); + + if (ret) { +- DRM_ERROR("Failed to read USBC PD FW, err = %d", ret); ++ dev_err(adev->dev, "Failed to read USBC PD FW, err = %d\n", ret); + return ret; + } + +@@ -3526,7 +3532,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, + void *fw_pri_cpu_addr; + + if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) { +- DRM_INFO("PSP block is not ready yet."); ++ dev_err(adev->dev, "PSP block is not ready yet."); + return -EBUSY; + } + +@@ -3559,7 +3565,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev, + release_firmware(usbc_pd_fw); + fail: + if (ret) { +- DRM_ERROR("Failed to load USBC PD FW, err = %d", ret); ++ dev_err(adev->dev, "Failed to load USBC PD FW, err = %d", ret); + count = ret; + } + +@@ -3606,7 +3612,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, + + /* Safeguard against memory drain */ + if (adev->psp.vbflash_image_size > AMD_VBIOS_FILE_MAX_SIZE_B) { +- dev_err(adev->dev, "File size cannot exceed %u", AMD_VBIOS_FILE_MAX_SIZE_B); ++ dev_err(adev->dev, "File size cannot exceed %u\n", AMD_VBIOS_FILE_MAX_SIZE_B); + kvfree(adev->psp.vbflash_tmp_buf); + adev->psp.vbflash_tmp_buf = NULL; + adev->psp.vbflash_image_size = 0; +@@ -3625,7 +3631,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size += count; + mutex_unlock(&adev->psp.mutex); + +- dev_dbg(adev->dev, "IFWI staged for update"); ++ dev_dbg(adev->dev, "IFWI staged for update\n"); + + return count; + } +@@ -3645,7 +3651,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + if (adev->psp.vbflash_image_size == 0) + return -EINVAL; + +- dev_dbg(adev->dev, "PSP IFWI flash process initiated"); ++ dev_dbg(adev->dev, "PSP IFWI flash process initiated\n"); + + ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size, + AMDGPU_GPU_PAGE_SIZE, +@@ -3670,11 +3676,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj, + adev->psp.vbflash_image_size = 0; + + if (ret) { +- dev_err(adev->dev, "Failed to load IFWI, err = %d", ret); ++ dev_err(adev->dev, "Failed to load IFWI, err = %d\n", ret); + return ret; + } + +- dev_dbg(adev->dev, "PSP IFWI flash process done"); ++ dev_dbg(adev->dev, "PSP IFWI flash process done\n"); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch b/queue-6.6/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch new file mode 100644 index 0000000000..c82e75144d --- /dev/null +++ b/queue-6.6/drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch @@ -0,0 +1,55 @@ +From b4e89c2a5059ff01627fa0b8491cdb198d44377a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:23:41 +0200 +Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting + +From: Michael Walle + +[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ] + +The bridge has three bootstrap pins which are sampled to determine the +frequency of the external reference clock. The driver will also +(over)write that setting. But it seems this is racy after the bridge is +enabled. It was observed that although the driver write the correct +value (by sniffing on the I2C bus), the register has the wrong value. +The datasheet states that the GPIO lines have to be stable for at least +5us after asserting the EN signal. Thus, there seems to be some logic +which samples the GPIO lines and this logic appears to overwrite the +register value which was set by the driver. Waiting 20us after +asserting the EN line resolves this issue. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Michael Walle +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 59cbff209acd6..560935f2e8cbe 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + + gpiod_set_value_cansleep(pdata->enable_gpio, 1); + ++ /* ++ * After EN is deasserted and an external clock is detected, the bridge ++ * will sample GPIO3:1 to determine its frequency. The driver will ++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is ++ * racy. Thus we have to wait a couple of us. According to the datasheet ++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that ++ * is not enough and the refclk frequency value is still lost or ++ * overwritten by the bridge itself. Waiting for 20us seems to work. ++ */ ++ usleep_range(20, 30); ++ + /* + * If we have a reference clock we can enable communication w/ the + * panel (including the aux channel) w/out any need for an input clock +-- +2.51.0 + diff --git a/queue-6.6/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch b/queue-6.6/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch new file mode 100644 index 0000000000..9dc620227b --- /dev/null +++ b/queue-6.6/hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch @@ -0,0 +1,56 @@ +From c08217bcf10b8af09299c427773e7297ce50c649 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 23:17:15 +0300 +Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM + +From: Vadim Pasternak + +[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ] + +The fans controlled by the driver can get stuck at 0 RPM if they are +configured below a 20% duty cycle. The driver tries to avoid this by +enforcing a minimum duty cycle of 20%, but this is done after the fans +are registered with the thermal subsystem. This is too late as the +thermal subsystem can set their current state before the driver is able +to enforce the minimum duty cycle. + +Fix by setting the minimum duty cycle before registering the fans with +the thermal subsystem. + +Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") +Reported-by: Nikolay Aleksandrov +Tested-by: Nikolay Aleksandrov +Signed-off-by: Ido Schimmel +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index a5f89aab3fb4d..c25a54d5b39ad 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan) + if (!pwm->connected) + continue; + pwm->fan = fan; ++ /* Set minimal PWM speed. */ ++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i], + pwm, &mlxreg_fan_cooling_ops); + if (IS_ERR(pwm->cdev)) { + dev_err(dev, "Failed to register cooling device\n"); + return PTR_ERR(pwm->cdev); + } +- +- /* Set minimal PWM speed. */ +- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY); + } + + return 0; +-- +2.51.0 + diff --git a/queue-6.6/pcmcia-add-error-handling-for-add_interval-in-do_val.patch b/queue-6.6/pcmcia-add-error-handling-for-add_interval-in-do_val.patch new file mode 100644 index 0000000000..7631c4509e --- /dev/null +++ b/queue-6.6/pcmcia-add-error-handling-for-add_interval-in-do_val.patch @@ -0,0 +1,45 @@ +From 005dabe333427aeb250c14f76482893563c3ddcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 21:10:06 +0800 +Subject: pcmcia: Add error handling for add_interval() in do_validate_mem() + +From: Wentao Liang + +[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ] + +In the do_validate_mem(), the call to add_interval() does not +handle errors. If kmalloc() fails in add_interval(), it could +result in a null pointer being inserted into the linked list, +leading to illegal memory access when sub_interval() is called +next. + +This patch adds an error handling for the add_interval(). If +add_interval() returns an error, the function will return early +with the error code. + +Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") +Signed-off-by: Wentao Liang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index bf9d070a44966..da494fe451baf 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s, + + if (validate && !s->fake_cis) { + /* move it to the validated data set */ +- add_interval(&s_data->mem_db_valid, base, size); ++ ret = add_interval(&s_data->mem_db_valid, base, size); ++ if (ret) ++ return ret; + sub_interval(&s_data->mem_db, base, size); + } + +-- +2.51.0 + diff --git a/queue-6.6/pcmcia-omap-add-missing-check-for-platform_get_resou.patch b/queue-6.6/pcmcia-omap-add-missing-check-for-platform_get_resou.patch new file mode 100644 index 0000000000..dbe5d849c8 --- /dev/null +++ b/queue-6.6/pcmcia-omap-add-missing-check-for-platform_get_resou.patch @@ -0,0 +1,36 @@ +From 0907d7688e94c594f96c09fb72adc5d1e8e61139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 14:39:56 +0800 +Subject: pcmcia: omap: Add missing check for platform_get_resource + +From: Chen Ni + +[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ] + +Add missing check for platform_get_resource() and return error if it fails +to catch the error. + +Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file") +Signed-off-by: Chen Ni +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/omap_cf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c +index e613818dc0bc9..25382612e48ac 100644 +--- a/drivers/pcmcia/omap_cf.c ++++ b/drivers/pcmcia/omap_cf.c +@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev) + return -EINVAL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + + cf = kzalloc(sizeof *cf, GFP_KERNEL); + if (!cf) +-- +2.51.0 + diff --git a/queue-6.6/perf-bpf-event-fix-use-after-free-in-synthesis.patch b/queue-6.6/perf-bpf-event-fix-use-after-free-in-synthesis.patch new file mode 100644 index 0000000000..98c21894e4 --- /dev/null +++ b/queue-6.6/perf-bpf-event-fix-use-after-free-in-synthesis.patch @@ -0,0 +1,147 @@ +From f5a9e2f96fd45e3bfe0e40289303ae91b49cb1b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:11 -0700 +Subject: perf bpf-event: Fix use-after-free in synthesis + +From: Ian Rogers + +[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ] + +Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread +may already have inserted the bpf_prog_info. Such failures may yield +info_linear being freed which then causes use-after-free issues with +the internal bpf_prog_info info struct. Make it so that +perf_env__insert_bpf_prog_info trigger early non-error paths and fix +the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper +return error handling to perf_env__add_bpf_info (that calls +perf_env__insert_bpf_prog_info) and propagate the return value in its +callers. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index b94b4f16a60a5..1573d6b6478d2 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -289,9 +289,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { +- free(info_linear); ++ /* ++ * Insert failed, likely because of a duplicate event ++ * made by the sideband thread. Ignore synthesizing the ++ * metadata. ++ */ + free(info_node); ++ goto out; + } ++ /* info_linear is now owned by info_node and shouldn't be freed below. */ + info_linear = NULL; + + /* +@@ -447,18 +453,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session, + return err; + } + +-static void perf_env__add_bpf_info(struct perf_env *env, u32 id) ++static int perf_env__add_bpf_info(struct perf_env *env, u32 id) + { + struct bpf_prog_info_node *info_node; + struct perf_bpil *info_linear; + struct btf *btf = NULL; + u64 arrays; + u32 btf_id; +- int fd; ++ int fd, err = 0; + + fd = bpf_prog_get_fd_by_id(id); + if (fd < 0) +- return; ++ return -EINVAL; + + arrays = 1UL << PERF_BPIL_JITED_KSYMS; + arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS; +@@ -471,6 +477,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_linear = get_bpf_prog_info_linear(fd, arrays); + if (IS_ERR_OR_NULL(info_linear)) { + pr_debug("%s: failed to get BPF program info. aborting\n", __func__); ++ err = PTR_ERR(info_linear); + goto out; + } + +@@ -480,38 +487,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + if (info_node) { + info_node->info_linear = info_linear; + if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ pr_debug("%s: duplicate add bpf info request for id %u\n", ++ __func__, btf_id); + free(info_linear); + free(info_node); ++ goto out; + } +- } else ++ } else { + free(info_linear); ++ err = -ENOMEM; ++ goto out; ++ } + + if (btf_id == 0) + goto out; + + btf = btf__load_from_kernel_by_id(btf_id); +- if (libbpf_get_error(btf)) { +- pr_debug("%s: failed to get BTF of id %u, aborting\n", +- __func__, btf_id); +- goto out; ++ if (!btf) { ++ err = -errno; ++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err); ++ } else { ++ perf_env__fetch_btf(env, btf_id, btf); + } +- perf_env__fetch_btf(env, btf_id, btf); + + out: + btf__free(btf); + close(fd); ++ return err; + } + + static int bpf_event__sb_cb(union perf_event *event, void *data) + { + struct perf_env *env = data; ++ int ret = 0; + + if (event->header.type != PERF_RECORD_BPF_EVENT) + return -1; + + switch (event->bpf.type) { + case PERF_BPF_EVENT_PROG_LOAD: +- perf_env__add_bpf_info(env, event->bpf.id); ++ ret = perf_env__add_bpf_info(env, event->bpf.id); + + case PERF_BPF_EVENT_PROG_UNLOAD: + /* +@@ -525,7 +540,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data) + break; + } + +- return 0; ++ return ret; + } + + int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env) +-- +2.51.0 + diff --git a/queue-6.6/perf-bpf-utils-constify-bpil_array_desc.patch b/queue-6.6/perf-bpf-utils-constify-bpil_array_desc.patch new file mode 100644 index 0000000000..d94e0e98ba --- /dev/null +++ b/queue-6.6/perf-bpf-utils-constify-bpil_array_desc.patch @@ -0,0 +1,112 @@ +From de76efe03d963e6bf4dca34c0eefc6e1d8e82e94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:12 -0700 +Subject: perf bpf-utils: Constify bpil_array_desc + +From: Ian Rogers + +[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ] + +The array's contents is a compile time constant. Constify to make the +code more intention revealing and avoid unintended errors. + +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com +Signed-off-by: Namhyung Kim +Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear") +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 80b1d2b3729ba..64a5583446964 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -20,7 +20,7 @@ struct bpil_array_desc { + */ + }; + +-static struct bpil_array_desc bpil_array_desc[] = { ++static const struct bpil_array_desc bpil_array_desc[] = { + [PERF_BPIL_JITED_INSNS] = { + offsetof(struct bpf_prog_info, jited_prog_insns), + offsetof(struct bpf_prog_info, jited_prog_len), +@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + bool include_array = (arrays & (1UL << i)) > 0; +- struct bpil_array_desc *desc; + __u32 count, size; + +- desc = bpil_array_desc + i; +- + /* kernel is too old to support this field */ + if (info_len < desc->array_offset + sizeof(__u32) || + info_len < desc->count_offset + sizeof(__u32) || +@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + ptr = info_linear->data; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 count, size; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + count = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + size = bpf_prog_info_read_offset_u32(&info, desc->size_offset); + bpf_prog_info_set_offset_u32(&info_linear->info, +@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + + /* step 6: verify the data */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u32 v1, v2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); + v2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + addr = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + offs = addr - ptr_to_u64(info_linear->data); +@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear) + int i; + + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +- struct bpil_array_desc *desc; ++ const struct bpil_array_desc *desc = &bpil_array_desc[i]; + __u64 addr, offs; + + if ((info_linear->arrays & (1UL << i)) == 0) + continue; + +- desc = bpil_array_desc + i; + offs = bpf_prog_info_read_offset_u64(&info_linear->info, + desc->array_offset); + addr = offs + ptr_to_u64(info_linear->data); +-- +2.51.0 + diff --git a/queue-6.6/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch b/queue-6.6/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch new file mode 100644 index 0000000000..e0ada652ad --- /dev/null +++ b/queue-6.6/perf-bpf-utils-harden-get_bpf_prog_info_linear.patch @@ -0,0 +1,120 @@ +From a2b018b9d5ca7983542823bdfac4585899bfb8d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 11:17:13 -0700 +Subject: perf bpf-utils: Harden get_bpf_prog_info_linear + +From: Ian Rogers + +[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ] + +In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are +made, the first to compute memory requirements for a struct perf_bpil +and the second to fill it in. Previously the code would warn when the +second call didn't match the first. Such races can be common place in +things like perf test, whose perf trace tests will frequently load BPF +programs. Rather than a debug message, return actual errors for this +case. Out of paranoia also validate the read bpf_prog_info array +value. Change the type of ptr to avoid mismatched pointer type +compiler warnings. Add some additional debug print outs and sanity +asserts. + +Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ +Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") +Reviewed-by: Namhyung Kim +Signed-off-by: Ian Rogers +Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c +index 64a5583446964..5a66dc8594aa8 100644 +--- a/tools/perf/util/bpf-utils.c ++++ b/tools/perf/util/bpf-utils.c +@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + __u32 info_len = sizeof(info); + __u32 data_len = 0; + int i, err; +- void *ptr; ++ __u8 *ptr; + + if (arrays >> PERF_BPIL_LAST_ARRAY) + return ERR_PTR(-EINVAL); +@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + pr_debug("can't get prog info: %s", strerror(errno)); + return ERR_PTR(-EFAULT); + } ++ if (info.type >= __MAX_BPF_PROG_TYPE) ++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type); + + /* step 2: calculate total size of all arrays */ + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { +@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + desc->count_offset, count); + bpf_prog_info_set_offset_u32(&info_linear->info, + desc->size_offset, size); ++ assert(ptr >= info_linear->data); ++ assert(ptr < &info_linear->data[data_len]); + bpf_prog_info_set_offset_u64(&info_linear->info, + desc->array_offset, + ptr_to_u64(ptr)); +@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays) + free(info_linear); + return ERR_PTR(-EFAULT); + } ++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) { ++ pr_debug("%s:%d: unexpected program type %u\n", ++ __func__, __LINE__, info_linear->info.type); ++ } + + /* step 6: verify the data */ ++ ptr = info_linear->data; + for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) { + const struct bpil_array_desc *desc = &bpil_array_desc[i]; +- __u32 v1, v2; ++ __u32 count1, count2, size1, size2; ++ __u64 ptr2; + + if ((arrays & (1UL << i)) == 0) + continue; + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset); ++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->count_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in element count\n", __func__); ++ if (count1 != count2) { ++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } + +- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); +- v2 = bpf_prog_info_read_offset_u32(&info_linear->info, ++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset); ++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info, + desc->size_offset); +- if (v1 != v2) +- pr_warning("%s: mismatch in rec size\n", __func__); ++ if (size1 != size2) { ++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset); ++ if (ptr_to_u64(ptr) != ptr2) { ++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2); ++ free(info_linear); ++ return ERR_PTR(-ERANGE); ++ } ++ ptr += roundup(count1 * size1, sizeof(__u64)); + } + + /* step 7: update info_len and data_len */ +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 264b5afab1..fe5253b545 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -96,3 +96,18 @@ drm-mediatek-fix-device-node-reference-count-leaks-in-mtk_drm_get_all_drm_priv.p alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch revert-drm-amdgpu-avoid-extra-evict-restore-process.patch +pcmcia-omap-add-missing-check-for-platform_get_resou.patch +pcmcia-add-error-handling-for-add_interval-in-do_val.patch +hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch +spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch +spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch +spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch +drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch +perf-bpf-event-fix-use-after-free-in-synthesis.patch +perf-bpf-utils-constify-bpil_array_desc.patch +perf-bpf-utils-harden-get_bpf_prog_info_linear.patch +drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch +drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch +tools-gpio-rm-.-.cmd-on-make-clean.patch +tools-gpio-remove-the-include-directory-on-make-clea.patch diff --git a/queue-6.6/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch b/queue-6.6/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch new file mode 100644 index 0000000000..08d809e979 --- /dev/null +++ b/queue-6.6/spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch @@ -0,0 +1,65 @@ +From a818f1abe80666aeb2ca6a66272c4354299be95f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:43 +0100 +Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module + +From: Larisa Grigore + +[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ] + +Clear the error flags after disabling the module to avoid the case when +a flag is set again between flag clear and module disable. And use +SR_CLEAR_MASK to replace hardcoded value for improved readability. + +Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa +("spi: lpspi: Fix CLK pin becomes low before one transfer"), the +original driver only reset SR in the interrupt handler, making it +vulnerable to the same issue. Therefore the fixes commit is set at the +introduction of the driver. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: Ciprian Marian Costea +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index d437ed1349edb..8ef82a11ebb0f 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -83,6 +83,8 @@ + #define TCR_RXMSK BIT(19) + #define TCR_TXMSK BIT(18) + ++#define SR_CLEAR_MASK GENMASK(13, 8) ++ + struct fsl_lpspi_devtype_data { + u8 prescale_max; + }; +@@ -532,14 +534,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi) + fsl_lpspi_intctrl(fsl_lpspi, 0); + } + +- /* W1C for all flags in SR */ +- temp = 0x3F << 8; +- writel(temp, fsl_lpspi->base + IMX7ULP_SR); +- + /* Clear FIFO and disable module */ + temp = CR_RRF | CR_RTF; + writel(temp, fsl_lpspi->base + IMX7ULP_CR); + ++ /* W1C for all flags in SR */ ++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch b/queue-6.6/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch new file mode 100644 index 0000000000..300d5587d0 --- /dev/null +++ b/queue-6.6/spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch @@ -0,0 +1,53 @@ +From 17c038db0641e1c5754531ad3c4b19371386fd6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:40 +0100 +Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT + +From: Larisa Grigore + +[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ] + +Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use +CONT") breaks transmissions when CONT is used. The TDIE interrupt should +not be disabled in all cases. If CONT is used and the TX transfer is not +yet completed yet, but the interrupt handler is called because there are +characters to be received, TDIE is replaced with FCIE. When the transfer +is finally completed, SR_TDF is set but the interrupt handler isn't +called again. + +Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index fa899ab2014c6..06c4fccf2f16d 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -3,7 +3,7 @@ + // Freescale i.MX7ULP LPSPI driver + // + // Copyright 2016 Freescale Semiconductor, Inc. +-// Copyright 2018 NXP Semiconductors ++// Copyright 2018, 2023, 2025 NXP + + #include + #include +@@ -780,7 +780,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id) + if (temp_SR & SR_MBF || + readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) { + writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR); +- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE); ++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE)); + return IRQ_HANDLED; + } + +-- +2.51.0 + diff --git a/queue-6.6/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch b/queue-6.6/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch new file mode 100644 index 0000000000..4d7db5d93e --- /dev/null +++ b/queue-6.6/spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch @@ -0,0 +1,47 @@ +From 85d8d1ecb4e1da5d74bede9fffc085432b6f0b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:42 +0100 +Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort + +From: Larisa Grigore + +[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ] + +In DMA mode fsl_lpspi_reset() is always called at the end, even when the +transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO +filled and the module enabled. + +Fix it by always calling fsl_lpspi_reset(). + +Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") +Signed-off-by: Larisa Grigore +Reviewed-by: Frank Li +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index b1ed34d237948..d437ed1349edb 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -730,12 +730,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller, + fsl_lpspi_write_tx_fifo(fsl_lpspi); + + ret = fsl_lpspi_wait_for_completion(controller); +- if (ret) +- return ret; + + fsl_lpspi_reset(fsl_lpspi); + +- return 0; ++ return ret; + } + + static int fsl_lpspi_transfer_one(struct spi_controller *controller, +-- +2.51.0 + diff --git a/queue-6.6/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch b/queue-6.6/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch new file mode 100644 index 0000000000..b2f12c934b --- /dev/null +++ b/queue-6.6/spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch @@ -0,0 +1,59 @@ +From eb93399bae1ec4baeb1d89ef648ec45b482d3284 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Aug 2025 11:14:41 +0100 +Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit + +From: Larisa Grigore + +[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ] + +The driver currently supports multiple chip-selects, but only sets the +polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for +the desired chip-select. + +Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 06c4fccf2f16d..b1ed34d237948 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -5,6 +5,7 @@ + // Copyright 2016 Freescale Semiconductor, Inc. + // Copyright 2018, 2023, 2025 NXP + ++#include + #include + #include + #include +@@ -70,7 +71,7 @@ + #define DER_TDDE BIT(0) + #define CFGR1_PCSCFG BIT(27) + #define CFGR1_PINCFG (BIT(24)|BIT(25)) +-#define CFGR1_PCSPOL BIT(8) ++#define CFGR1_PCSPOL_MASK GENMASK(11, 8) + #define CFGR1_NOSTALL BIT(3) + #define CFGR1_HOST BIT(0) + #define FSR_TXCOUNT (0xFF) +@@ -420,7 +421,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi) + else + temp = CFGR1_PINCFG; + if (fsl_lpspi->config.mode & SPI_CS_HIGH) +- temp |= CFGR1_PCSPOL; ++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK, ++ BIT(fsl_lpspi->config.chip_select)); ++ + writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1); + + temp = readl(fsl_lpspi->base + IMX7ULP_CR); +-- +2.51.0 + diff --git a/queue-6.6/tools-gpio-remove-the-include-directory-on-make-clea.patch b/queue-6.6/tools-gpio-remove-the-include-directory-on-make-clea.patch new file mode 100644 index 0000000000..11b71fcdc3 --- /dev/null +++ b/queue-6.6/tools-gpio-remove-the-include-directory-on-make-clea.patch @@ -0,0 +1,37 @@ +From d124889361340972c20753ef3351252088cbf77a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Sep 2025 14:36:20 +0800 +Subject: tools: gpio: remove the include directory on make clean + +From: zhang jiao + +[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ] + +Remove the generated include directory when running make clean. + +Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem") +Signed-off-by: Zhang Jiao +Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com +[Bartosz: add Fixes tag, improve the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index ed565eb52275f..342e056c8c665 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + + clean: + rm -f $(ALL_PROGRAMS) +- rm -f $(OUTPUT)include/linux/gpio.h ++ rm -rf $(OUTPUT)include + find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) +-- +2.51.0 + diff --git a/queue-6.6/tools-gpio-rm-.-.cmd-on-make-clean.patch b/queue-6.6/tools-gpio-rm-.-.cmd-on-make-clean.patch new file mode 100644 index 0000000000..3c44281309 --- /dev/null +++ b/queue-6.6/tools-gpio-rm-.-.cmd-on-make-clean.patch @@ -0,0 +1,36 @@ +From 3ed4eb85daa67c420c5f73a3cfa3f32b4854a0e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 14:29:42 +0800 +Subject: tools: gpio: rm .*.cmd on make clean + +From: zhangjiao + +[ Upstream commit 931a36c4138ac418d487bd4db0d03780b46a77ba ] + +rm .*.cmd when calling make clean + +Signed-off-by: zhangjiao +Link: https://lore.kernel.org/r/20240829062942.11487-1-zhangjiao2@cmss.chinamobile.com +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: ed42d80f3bae ("tools: gpio: remove the include directory on make clean") +Signed-off-by: Sasha Levin +--- + tools/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile +index d29c9c49e2512..ed565eb52275f 100644 +--- a/tools/gpio/Makefile ++++ b/tools/gpio/Makefile +@@ -78,7 +78,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN) + clean: + rm -f $(ALL_PROGRAMS) + rm -f $(OUTPUT)include/linux/gpio.h +- find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete ++ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete + + install: $(ALL_PROGRAMS) + install -d -m 755 $(DESTDIR)$(bindir); \ +-- +2.51.0 +