From: Sasha Levin Date: Fri, 5 Sep 2025 12:21:18 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v5.4.299~60 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b9815c885e2f714060204abd1592c3faae47266c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-5.10/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..8594547af7 --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From f7cefabec0e95766f8af987b4ce4497068e6ed8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 015e004bf275c..3dd00ce201f54 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -972,6 +972,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 30b188c124..3457b2512c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,3 @@ drm-amd-display-don-t-warn-when-missing-dce-encoder-.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch diff --git a/queue-5.10/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-5.10/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..690cc5f1b8 --- /dev/null +++ b/queue-5.10/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From 483122b7c96e7d372972b8f61c659561a62919dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 6fb4400333fb4..6d2db6cc247b3 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -438,9 +438,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-5.15/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-5.15/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..1b99ca2665 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From 965c18054f92faa97e47e7370d277c9a847d8b87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 60a909a100eeb..ab2e2ee4ce6fe 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -978,6 +978,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-5.15/series b/queue-5.15/series index d80d428879..f79a3d5e9e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -4,3 +4,5 @@ bpf-move-bpf-map-owner-out-of-common-struct.patch bpf-fix-oob-access-in-cgroup-local-storage.patch drm-amd-display-don-t-warn-when-missing-dce-encoder-.patch fs-writeback-fix-use-after-free-in-__mark_inode_dirt.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch diff --git a/queue-5.15/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-5.15/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..799d955228 --- /dev/null +++ b/queue-5.15/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From 64831adc2041df558a37f7b24f6187894142878c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 6fb4400333fb4..6d2db6cc247b3 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -438,9 +438,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-6.1/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch b/queue-6.1/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch new file mode 100644 index 0000000000..2539cbd931 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch @@ -0,0 +1,39 @@ +From 1e3b218a8e5df5f23a4c4f9ea0add0583015f854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:03:07 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics + i.MX8M Plus DHCOM + +From: Marek Vasut + +[ Upstream commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +index 0f13ee3627715..2fd50b5890afa 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +@@ -508,6 +508,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.1/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-6.1/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..2366276c8e --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From 5970419eb271cf891dda1338367845611ab394a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 3d7b82e921f6e..fa3e1aaae9742 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -977,6 +977,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-6.1/series b/queue-6.1/series index 656019e83a..64457ee685 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -9,3 +9,7 @@ cdc_ncm-flag-intel-oem-version-of-fibocom-l850-gl-as.patch drm-amd-display-don-t-warn-when-missing-dce-encoder-.patch bluetooth-hci_sync-avoid-adding-default-advertising-.patch fs-writeback-fix-use-after-free-in-__mark_inode_dirt.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch +tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch diff --git a/queue-6.1/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-6.1/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..51a85c61b7 --- /dev/null +++ b/queue-6.1/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From 04dfadb64944564509d9019ab1f76744152200d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 27295bda3e0bd..15299334cf574 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -506,9 +506,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-6.1/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch b/queue-6.1/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch new file mode 100644 index 0000000000..53a5029af0 --- /dev/null +++ b/queue-6.1/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch @@ -0,0 +1,46 @@ +From b6ae5bd54d9394c9be535143c9cb9540f6b0e4b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:47:35 +0000 +Subject: tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" + +From: Sungbae Yoo + +[ Upstream commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 ] + +Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() +because compatbile is a typo of compatible. + +Fixes: 4615e5a34b95 ("optee: add FF-A support") +Signed-off-by: Sungbae Yoo +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index b8ba360e863ed..927c3d7947f9c 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -653,7 +653,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, + * with a matching configuration. + */ + +-static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, ++static bool optee_ffa_api_is_compatible(struct ffa_device *ffa_dev, + const struct ffa_ops *ops) + { + const struct ffa_msg_ops *msg_ops = ops->msg_ops; +@@ -804,7 +804,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) + + ffa_ops = ffa_dev->ops; + +- if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops)) ++ if (!optee_ffa_api_is_compatible(ffa_dev, ffa_ops)) + return -EINVAL; + + if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps, +-- +2.50.1 + diff --git a/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch b/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch new file mode 100644 index 0000000000..7b05f2282c --- /dev/null +++ b/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch @@ -0,0 +1,39 @@ +From 84b4d23e801b2bc866dab8c0bfd2f41ffd3e80cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:03:07 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics + i.MX8M Plus DHCOM + +From: Marek Vasut + +[ Upstream commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +index a90e28c07e3f1..6835f28c1e3c5 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +@@ -609,6 +609,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-30785 b/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-30785 new file mode 100644 index 0000000000..43dca72119 --- /dev/null +++ b/queue-6.12/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-30785 @@ -0,0 +1,39 @@ +From 1a1c2ef4e6e158c83682b91191e3edd6f07da4b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:04:32 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul + i.MX8M Plus eDM SBC + +From: Marek Vasut + +[ Upstream commit 80733306290f6d2e05f0632e5d3e98cd16105c3c ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +index d0fc5977258fb..16078ff60ef08 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +@@ -555,6 +555,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.12/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch b/queue-6.12/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch new file mode 100644 index 0000000000..53c338ae75 --- /dev/null +++ b/queue-6.12/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch @@ -0,0 +1,173 @@ +From f7d7765e80edfa80b534362afd5ab65317369992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 11:16:52 +0200 +Subject: arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off + +From: Markus Niebel + +[ Upstream commit 5245dc5ff9b1f6c02ef948f623432805ea148fca ] + +Fix SD card removal caused by automatic LDO5 power off after boot: + +LDO5: disabling +mmc1: card 59b4 removed +EXT4-fs (mmcblk1p2): shut down requested (2) +Aborting journal on device mmcblk1p2-8. +JBD2: I/O error when updating journal superblock for mmcblk1p2-8. + +To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled +regulator that is supplied by LDO5. Since this is implemented on SoM but +used on baseboards with SD-card interface, implement the functionality +on SoM part and optionally enable it on baseboards if needed. + +Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") +Signed-off-by: Markus Niebel +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../imx8mp-tqma8mpql-mba8mp-ras314.dts | 13 ++++++----- + .../freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 13 ++++++----- + .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 22 +++++++++++++++++++ + 3 files changed, 36 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +index d7fd9d36f8240..f7346b3d35fe5 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +@@ -467,6 +467,10 @@ &pwm4 { + status = "okay"; + }; + ++®_usdhc2_vqmmc { ++ status = "okay"; ++}; ++ + &sai5 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai5>; +@@ -876,8 +880,7 @@ pinctrl_usdhc2: usdhc2grp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { +@@ -886,8 +889,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { +@@ -896,8 +898,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_gpio: usdhc2-gpiogrp { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts +index ae64731266f35..e7c16a7ee6c26 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts +@@ -603,6 +603,10 @@ &pwm3 { + status = "okay"; + }; + ++®_usdhc2_vqmmc { ++ status = "okay"; ++}; ++ + &sai3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai3>; +@@ -982,8 +986,7 @@ pinctrl_usdhc2: usdhc2grp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { +@@ -992,8 +995,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { +@@ -1002,8 +1004,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_gpio: usdhc2-gpiogrp { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +index 3ddc5aaa7c5f0..9eac178ab2c20 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +@@ -24,6 +24,20 @@ reg_vcc3v3: regulator-vcc3v3 { + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; ++ ++ reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { ++ compatible = "regulator-gpio"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_reg_usdhc2_vqmmc>; ++ regulator-name = "V_SD2"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; ++ gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; ++ states = <1800000 0x1>, ++ <3300000 0x0>; ++ vin-supply = <&ldo5_reg>; ++ status = "disabled"; ++ }; + }; + + &A53_0 { +@@ -179,6 +193,10 @@ m24c64: eeprom@57 { + }; + }; + ++&usdhc2 { ++ vqmmc-supply = <®_usdhc2_vqmmc>; ++}; ++ + &usdhc3 { + pinctrl-names = "default", "state_100mhz", "state_200mhz"; + pinctrl-0 = <&pinctrl_usdhc3>; +@@ -228,6 +246,10 @@ pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp { + fsl,pins = ; + }; + ++ pinctrl_reg_usdhc2_vqmmc: regusdhc2vqmmcgrp { ++ fsl,pins = ; ++ }; ++ + pinctrl_usdhc3: usdhc3grp { + fsl,pins = , + , +-- +2.50.1 + diff --git a/queue-6.12/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-6.12/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..beb61ba0fc --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From febc2247dcf1b3d443ff722b770339a22689cfe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index a5a7e374bc594..a7afc83d2f266 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -966,6 +966,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-6.12/hid-core-harden-s32ton-against-conversion-to-0-bits.patch b/queue-6.12/hid-core-harden-s32ton-against-conversion-to-0-bits.patch new file mode 100644 index 0000000000..a24c181d7b --- /dev/null +++ b/queue-6.12/hid-core-harden-s32ton-against-conversion-to-0-bits.patch @@ -0,0 +1,54 @@ +From 06179e0f196947b92a0a59e2b845a51b84c8ba2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:37:04 -0400 +Subject: HID: core: Harden s32ton() against conversion to 0 bits + +From: Alan Stern + +[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ] + +Testing by the syzbot fuzzer showed that the HID core gets a +shift-out-of-bounds exception when it tries to convert a 32-bit +quantity to a 0-bit quantity. Ideally this should never occur, but +there are buggy devices and some might have a report field with size +set to zero; we shouldn't reject the report or the device just because +of that. + +Instead, harden the s32ton() routine so that it returns a reasonable +result instead of crashing when it is called with the number of bits +set to 0 -- the same as what snto32() does. + +Signed-off-by: Alan Stern +Reported-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.com/ +Tested-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com +Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harvard.edu +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 5169d8d56c889..9910c6d3fef30 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -66,8 +66,12 @@ static s32 snto32(__u32 value, unsigned int n) + + static u32 s32ton(__s32 value, unsigned int n) + { +- s32 a = value >> (n - 1); ++ s32 a; + ++ if (!value || !n) ++ return 0; ++ ++ a = value >> (n - 1); + if (a && a != -1) + return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; + return value & ((1 << n) - 1); +-- +2.50.1 + diff --git a/queue-6.12/hid-simplify-snto32.patch b/queue-6.12/hid-simplify-snto32.patch new file mode 100644 index 0000000000..e32ba8b482 --- /dev/null +++ b/queue-6.12/hid-simplify-snto32.patch @@ -0,0 +1,54 @@ +From 06ec05b24fbae77490fbebf4d2e041b2c26ba0b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 07:46:50 -0700 +Subject: HID: simplify snto32() + +From: Dmitry Torokhov + +[ Upstream commit ae9b956cb26c0fd5a365629f2d723ab2fb14df79 ] + +snto32() does exactly what sign_extend32() does, but handles +potentially malformed data coming from the device. Keep the checks, +but then call sign_extend32() to perform the actual conversion. + +Signed-off-by: Dmitry Torokhov +Link: https://patch.msgid.link/20241003144656.3786064-1-dmitry.torokhov@gmail.com +Signed-off-by: Benjamin Tissoires +Stable-dep-of: a6b87bfc2ab5 ("HID: core: Harden s32ton() against conversion to 0 bits") +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index c2783d04c6e05..1a8e88624acfb 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1318,9 +1318,7 @@ int hid_open_report(struct hid_device *device) + EXPORT_SYMBOL_GPL(hid_open_report); + + /* +- * Convert a signed n-bit integer to signed 32-bit integer. Common +- * cases are done through the compiler, the screwed things has to be +- * done by hand. ++ * Convert a signed n-bit integer to signed 32-bit integer. + */ + + static s32 snto32(__u32 value, unsigned n) +@@ -1331,12 +1329,7 @@ static s32 snto32(__u32 value, unsigned n) + if (n > 32) + n = 32; + +- switch (n) { +- case 8: return ((__s8)value); +- case 16: return ((__s16)value); +- case 32: return ((__s32)value); +- } +- return value & (1 << (n - 1)) ? value | (~0U << n) : value; ++ return sign_extend32(value, n - 1); + } + + s32 hid_snto32(__u32 value, unsigned n) +-- +2.50.1 + diff --git a/queue-6.12/hid-stop-exporting-hid_snto32.patch b/queue-6.12/hid-stop-exporting-hid_snto32.patch new file mode 100644 index 0000000000..28457f6179 --- /dev/null +++ b/queue-6.12/hid-stop-exporting-hid_snto32.patch @@ -0,0 +1,152 @@ +From 1c76d84c6f033a71deaa44d8e45cd7a7f7e23233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 07:46:51 -0700 +Subject: HID: stop exporting hid_snto32() + +From: Dmitry Torokhov + +[ Upstream commit c653ffc283404a6c1c0e65143a833180c7ff799b ] + +The only user of hid_snto32() is Logitech HID++ driver, which always +calls hid_snto32() with valid size (constant, either 12 or 8) and +therefore can simply use sign_extend32(). + +Make the switch and remove hid_snto32(). Move snto32() and s32ton() to +avoid introducing forward declaration. + +Signed-off-by: Dmitry Torokhov +Link: https://patch.msgid.link/20241003144656.3786064-2-dmitry.torokhov@gmail.com +[bentiss: fix checkpatch warning] +Signed-off-by: Benjamin Tissoires +Stable-dep-of: a6b87bfc2ab5 ("HID: core: Harden s32ton() against conversion to 0 bits") +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 63 +++++++++++++++----------------- + drivers/hid/hid-logitech-hidpp.c | 6 +-- + include/linux/hid.h | 1 - + 3 files changed, 32 insertions(+), 38 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 1a8e88624acfb..5169d8d56c889 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -45,6 +45,34 @@ static int hid_ignore_special_drivers = 0; + module_param_named(ignore_special_drivers, hid_ignore_special_drivers, int, 0600); + MODULE_PARM_DESC(ignore_special_drivers, "Ignore any special drivers and handle all devices by generic driver"); + ++/* ++ * Convert a signed n-bit integer to signed 32-bit integer. ++ */ ++ ++static s32 snto32(__u32 value, unsigned int n) ++{ ++ if (!value || !n) ++ return 0; ++ ++ if (n > 32) ++ n = 32; ++ ++ return sign_extend32(value, n - 1); ++} ++ ++/* ++ * Convert a signed 32-bit integer to a signed n-bit integer. ++ */ ++ ++static u32 s32ton(__s32 value, unsigned int n) ++{ ++ s32 a = value >> (n - 1); ++ ++ if (a && a != -1) ++ return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; ++ return value & ((1 << n) - 1); ++} ++ + /* + * Register a new report for a device. + */ +@@ -425,7 +453,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item) + * both this and the standard encoding. */ + raw_value = item_sdata(item); + if (!(raw_value & 0xfffffff0)) +- parser->global.unit_exponent = hid_snto32(raw_value, 4); ++ parser->global.unit_exponent = snto32(raw_value, 4); + else + parser->global.unit_exponent = raw_value; + return 0; +@@ -1317,39 +1345,6 @@ int hid_open_report(struct hid_device *device) + } + EXPORT_SYMBOL_GPL(hid_open_report); + +-/* +- * Convert a signed n-bit integer to signed 32-bit integer. +- */ +- +-static s32 snto32(__u32 value, unsigned n) +-{ +- if (!value || !n) +- return 0; +- +- if (n > 32) +- n = 32; +- +- return sign_extend32(value, n - 1); +-} +- +-s32 hid_snto32(__u32 value, unsigned n) +-{ +- return snto32(value, n); +-} +-EXPORT_SYMBOL_GPL(hid_snto32); +- +-/* +- * Convert a signed 32-bit integer to a signed n-bit integer. +- */ +- +-static u32 s32ton(__s32 value, unsigned n) +-{ +- s32 a = value >> (n - 1); +- if (a && a != -1) +- return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; +- return value & ((1 << n) - 1); +-} +- + /* + * Extract/implement a data field from/to a little endian report (bit array). + * +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 234ddd4422d90..59f630962338d 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3296,13 +3296,13 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size) + 120); + } + +- v = hid_snto32(hid_field_extract(hdev, data+3, 0, 12), 12); ++ v = sign_extend32(hid_field_extract(hdev, data + 3, 0, 12), 11); + input_report_rel(hidpp->input, REL_X, v); + +- v = hid_snto32(hid_field_extract(hdev, data+3, 12, 12), 12); ++ v = sign_extend32(hid_field_extract(hdev, data + 3, 12, 12), 11); + input_report_rel(hidpp->input, REL_Y, v); + +- v = hid_snto32(data[6], 8); ++ v = sign_extend32(data[6], 7); + if (v != 0) + hidpp_scroll_counter_handle_scroll(hidpp->input, + &hidpp->vertical_wheel_counter, v); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 017d31f1d27b8..7d8d09318fa91 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -978,7 +978,6 @@ const struct hid_device_id *hid_match_device(struct hid_device *hdev, + struct hid_driver *hdrv); + bool hid_compare_device_paths(struct hid_device *hdev_a, + struct hid_device *hdev_b, char separator); +-s32 hid_snto32(__u32 value, unsigned n); + __u32 hid_field_extract(const struct hid_device *hid, __u8 *report, + unsigned offset, unsigned n); + +-- +2.50.1 + diff --git a/queue-6.12/loongarch-vdso-remove-hash-style-sysv.patch b/queue-6.12/loongarch-vdso-remove-hash-style-sysv.patch new file mode 100644 index 0000000000..2c7b76a2cb --- /dev/null +++ b/queue-6.12/loongarch-vdso-remove-hash-style-sysv.patch @@ -0,0 +1,52 @@ +From 5e4f17ed594210818dd9f8da357366ff12eef5d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Mar 2025 16:31:09 +0800 +Subject: LoongArch: vDSO: Remove --hash-style=sysv + +From: Xi Ruoyao + +[ Upstream commit c271c86a4c72c771b313fd9c3b06db61ab8ab8bf ] + +Glibc added support for .gnu.hash in 2006 and .hash has been obsoleted +far before the first LoongArch CPU was taped. Using --hash-style=sysv +might imply unaddressed issues and confuse readers. + +Some architectures use an explicit --hash-style=both for vDSO here, but +DT_GNU_HASH has already been supported by Glibc and Musl and become the +de-facto standard of the distros when the first LoongArch CPU was taped. +So DT_HASH seems just wasting storage space for LoongArch. + +Just drop the option and rely on the linker default, which is likely +"gnu" (Arch, Debian, Gentoo, LFS) on all LoongArch distros (confirmed on +Arch, Debian, Gentoo, and LFS; AOSC now defaults to "both" but it seems +just an oversight). + +Following the logic of commit 48f6430505c0b049 ("arm64/vdso: Remove +--hash-style=sysv"). + +Link: https://github.com/AOSC-Dev/aosc-os-abbs/pull/9796 +Signed-off-by: Xi Ruoyao +Signed-off-by: Huacai Chen +Stable-dep-of: d35ec48fa6c8 ("LoongArch: vDSO: Remove -nostdlib complier flag") +Signed-off-by: Sasha Levin +--- + arch/loongarch/vdso/Makefile | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/loongarch/vdso/Makefile b/arch/loongarch/vdso/Makefile +index fdde1bcd4e266..cf6c41054396a 100644 +--- a/arch/loongarch/vdso/Makefile ++++ b/arch/loongarch/vdso/Makefile +@@ -36,8 +36,7 @@ endif + + # VDSO linker flags. + ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ +- $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared \ +- --hash-style=sysv --build-id -T ++ $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared --build-id -T + + # + # Shared build commands. +-- +2.50.1 + diff --git a/queue-6.12/loongarch-vdso-remove-nostdlib-complier-flag.patch b/queue-6.12/loongarch-vdso-remove-nostdlib-complier-flag.patch new file mode 100644 index 0000000000..91b1f866f0 --- /dev/null +++ b/queue-6.12/loongarch-vdso-remove-nostdlib-complier-flag.patch @@ -0,0 +1,46 @@ +From 7e8760f9b9d7adefdcadecd62b40b81e6b8f8f7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 19:00:22 +0800 +Subject: LoongArch: vDSO: Remove -nostdlib complier flag + +From: Wentao Guan + +[ Upstream commit d35ec48fa6c8fe0cfa4a03155109fec7677911d4 ] + +Since $(LD) is directly used, hence -nostdlib is unneeded, MIPS has +removed this, we should remove it too. + +bdbf2038fbf4 ("MIPS: VDSO: remove -nostdlib compiler flag"). + +In fact, other architectures also use $(LD) now. + +fe00e50b2db8 ("ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO") +691efbedc60d ("arm64: vdso: use $(LD) instead of $(CC) to link VDSO") +2ff906994b6c ("MIPS: VDSO: Use $(LD) instead of $(CC) to link VDSO") +2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") + +Cc: stable@vger.kernel.org +Reviewed-by: Yanteng Si +Signed-off-by: Wentao Guan +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/vdso/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/vdso/Makefile b/arch/loongarch/vdso/Makefile +index cf6c41054396a..49af37f781bbe 100644 +--- a/arch/loongarch/vdso/Makefile ++++ b/arch/loongarch/vdso/Makefile +@@ -36,7 +36,7 @@ endif + + # VDSO linker flags. + ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ +- $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared --build-id -T ++ $(filter -E%,$(KBUILD_CFLAGS)) -shared --build-id -T + + # + # Shared build commands. +-- +2.50.1 + diff --git a/queue-6.12/mmc-sdhci-of-arasan-ensure-cd-logic-stabilization-be.patch b/queue-6.12/mmc-sdhci-of-arasan-ensure-cd-logic-stabilization-be.patch new file mode 100644 index 0000000000..9204f00aaf --- /dev/null +++ b/queue-6.12/mmc-sdhci-of-arasan-ensure-cd-logic-stabilization-be.patch @@ -0,0 +1,138 @@ +From 67b9f2196bd342fb92c0f70e5361357ca2a26444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:35:43 +0530 +Subject: mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up + +From: Sai Krishna Potthuri + +[ Upstream commit e251709aaddb3ee1e8ac1ed5e361a608a1cc92de ] + +During SD suspend/resume without a full card rescan (when using +non-removable SD cards for rootfs), the SD card initialization may fail +after resume. This occurs because, after a host controller reset, the +card detect logic may take time to stabilize due to debounce logic. +Without waiting for stabilization, the host may attempt powering up the +card prematurely, leading to command timeouts during resume flow. +Add sdhci_arasan_set_power_and_bus_voltage() to wait for the card detect +stable bit before power up the card. Since the stabilization time +is not fixed, a maximum timeout of one second is used to ensure +sufficient wait time for the card detect signal to stabilize. + +Signed-off-by: Sai Krishna Potthuri +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250730060543.1735971-1-sai.krishna.potthuri@amd.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-arasan.c | 33 ++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c +index 0cb05bdec34d5..30daa2db80b19 100644 +--- a/drivers/mmc/host/sdhci-of-arasan.c ++++ b/drivers/mmc/host/sdhci-of-arasan.c +@@ -99,6 +99,9 @@ + #define HIWORD_UPDATE(val, mask, shift) \ + ((val) << (shift) | (mask) << ((shift) + 16)) + ++#define CD_STABLE_TIMEOUT_US 1000000 ++#define CD_STABLE_MAX_SLEEP_US 10 ++ + /** + * struct sdhci_arasan_soc_ctl_field - Field used in sdhci_arasan_soc_ctl_map + * +@@ -206,12 +209,15 @@ struct sdhci_arasan_data { + * 19MHz instead + */ + #define SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN BIT(2) ++/* Enable CD stable check before power-up */ ++#define SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE BIT(3) + }; + + struct sdhci_arasan_of_data { + const struct sdhci_arasan_soc_ctl_map *soc_ctl_map; + const struct sdhci_pltfm_data *pdata; + const struct sdhci_arasan_clk_ops *clk_ops; ++ u32 quirks; + }; + + static const struct sdhci_arasan_soc_ctl_map rk3399_soc_ctl_map = { +@@ -514,6 +520,24 @@ static int sdhci_arasan_voltage_switch(struct mmc_host *mmc, + return -EINVAL; + } + ++static void sdhci_arasan_set_power_and_bus_voltage(struct sdhci_host *host, unsigned char mode, ++ unsigned short vdd) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_arasan_data *sdhci_arasan = sdhci_pltfm_priv(pltfm_host); ++ u32 reg; ++ ++ /* ++ * Ensure that the card detect logic has stabilized before powering up, this is ++ * necessary after a host controller reset. ++ */ ++ if (mode == MMC_POWER_UP && sdhci_arasan->quirks & SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE) ++ read_poll_timeout(sdhci_readl, reg, reg & SDHCI_CD_STABLE, CD_STABLE_MAX_SLEEP_US, ++ CD_STABLE_TIMEOUT_US, false, host, SDHCI_PRESENT_STATE); ++ ++ sdhci_set_power_and_bus_voltage(host, mode, vdd); ++} ++ + static const struct sdhci_ops sdhci_arasan_ops = { + .set_clock = sdhci_arasan_set_clock, + .get_max_clock = sdhci_pltfm_clk_get_max_clock, +@@ -521,7 +545,7 @@ static const struct sdhci_ops sdhci_arasan_ops = { + .set_bus_width = sdhci_set_bus_width, + .reset = sdhci_arasan_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, +- .set_power = sdhci_set_power_and_bus_voltage, ++ .set_power = sdhci_arasan_set_power_and_bus_voltage, + .hw_reset = sdhci_arasan_hw_reset, + }; + +@@ -570,7 +594,7 @@ static const struct sdhci_ops sdhci_arasan_cqe_ops = { + .set_bus_width = sdhci_set_bus_width, + .reset = sdhci_arasan_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, +- .set_power = sdhci_set_power_and_bus_voltage, ++ .set_power = sdhci_arasan_set_power_and_bus_voltage, + .irq = sdhci_arasan_cqhci_irq, + }; + +@@ -1447,6 +1471,7 @@ static const struct sdhci_arasan_clk_ops zynqmp_clk_ops = { + static struct sdhci_arasan_of_data sdhci_arasan_zynqmp_data = { + .pdata = &sdhci_arasan_zynqmp_pdata, + .clk_ops = &zynqmp_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static const struct sdhci_arasan_clk_ops versal_clk_ops = { +@@ -1457,6 +1482,7 @@ static const struct sdhci_arasan_clk_ops versal_clk_ops = { + static struct sdhci_arasan_of_data sdhci_arasan_versal_data = { + .pdata = &sdhci_arasan_zynqmp_pdata, + .clk_ops = &versal_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static const struct sdhci_arasan_clk_ops versal_net_clk_ops = { +@@ -1467,6 +1493,7 @@ static const struct sdhci_arasan_clk_ops versal_net_clk_ops = { + static struct sdhci_arasan_of_data sdhci_arasan_versal_net_data = { + .pdata = &sdhci_arasan_versal_net_pdata, + .clk_ops = &versal_net_clk_ops, ++ .quirks = SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE, + }; + + static struct sdhci_arasan_of_data intel_keembay_emmc_data = { +@@ -1945,6 +1972,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev) + if (of_device_is_compatible(np, "rockchip,rk3399-sdhci-5.1")) + sdhci_arasan_update_clockmultiplier(host, 0x0); + ++ sdhci_arasan->quirks |= data->quirks; ++ + if (of_device_is_compatible(np, "intel,keembay-sdhci-5.1-emmc") || + of_device_is_compatible(np, "intel,keembay-sdhci-5.1-sd") || + of_device_is_compatible(np, "intel,keembay-sdhci-5.1-sdio")) { +-- +2.50.1 + diff --git a/queue-6.12/mmc-sdhci-of-arasan-support-for-emmc-hardware-reset.patch b/queue-6.12/mmc-sdhci-of-arasan-support-for-emmc-hardware-reset.patch new file mode 100644 index 0000000000..1e9361c76c --- /dev/null +++ b/queue-6.12/mmc-sdhci-of-arasan-support-for-emmc-hardware-reset.patch @@ -0,0 +1,69 @@ +From 1d7f6bffaeaa1062240ba8da1e36c26bc81714ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 15:24:45 +0530 +Subject: mmc: sdhci-of-arasan: Support for emmc hardware reset + +From: Paul Alvin + +[ Upstream commit 11c7d665181c1879b0d5561102c3834ff14a5615 ] + +Add hw_reset callback to support emmc hardware reset, this callback get +called from the mmc core only when "cap-mmc-hw-reset" property is +defined in the DT. + +Signed-off-by: Paul Alvin +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20241007095445.19340-1-alvin.paulp@amd.com +Signed-off-by: Ulf Hansson +Stable-dep-of: e251709aaddb ("mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-arasan.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c +index 5edd024347bd5..0cb05bdec34d5 100644 +--- a/drivers/mmc/host/sdhci-of-arasan.c ++++ b/drivers/mmc/host/sdhci-of-arasan.c +@@ -76,6 +76,8 @@ + #define FREQSEL_225M_200M 0x7 + #define PHY_DLL_TIMEOUT_MS 100 + ++#define SDHCI_HW_RST_EN BIT(4) ++ + /* Default settings for ZynqMP Clock Phases */ + #define ZYNQMP_ICLK_PHASE {0, 63, 63, 0, 63, 0, 0, 183, 54, 0, 0} + #define ZYNQMP_OCLK_PHASE {0, 72, 60, 0, 60, 72, 135, 48, 72, 135, 0} +@@ -475,6 +477,21 @@ static void sdhci_arasan_reset(struct sdhci_host *host, u8 mask) + } + } + ++static void sdhci_arasan_hw_reset(struct sdhci_host *host) ++{ ++ u8 reg; ++ ++ reg = sdhci_readb(host, SDHCI_POWER_CONTROL); ++ reg |= SDHCI_HW_RST_EN; ++ sdhci_writeb(host, reg, SDHCI_POWER_CONTROL); ++ /* As per eMMC spec, minimum 1us is required but give it 2us for good measure */ ++ usleep_range(2, 5); ++ reg &= ~SDHCI_HW_RST_EN; ++ sdhci_writeb(host, reg, SDHCI_POWER_CONTROL); ++ /* As per eMMC spec, minimum 200us is required but give it 300us for good measure */ ++ usleep_range(300, 500); ++} ++ + static int sdhci_arasan_voltage_switch(struct mmc_host *mmc, + struct mmc_ios *ios) + { +@@ -505,6 +522,7 @@ static const struct sdhci_ops sdhci_arasan_ops = { + .reset = sdhci_arasan_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, + .set_power = sdhci_set_power_and_bus_voltage, ++ .hw_reset = sdhci_arasan_hw_reset, + }; + + static u32 sdhci_arasan_cqhci_irq(struct sdhci_host *host, u32 intmask) +-- +2.50.1 + diff --git a/queue-6.12/net-usb-qmi_wwan-add-telit-cinterion-fn990a-w-audio-.patch b/queue-6.12/net-usb-qmi_wwan-add-telit-cinterion-fn990a-w-audio-.patch new file mode 100644 index 0000000000..4582da8da8 --- /dev/null +++ b/queue-6.12/net-usb-qmi_wwan-add-telit-cinterion-fn990a-w-audio-.patch @@ -0,0 +1,79 @@ +From 7c127399244b5266af183b2dcd3389a9dac632c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Aug 2025 15:31:08 +0200 +Subject: net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fabio Porcedda + +[ Upstream commit 61aaca8b89fb98be58b8df19f01181bb983cccff ] + +Add the following Telit Cinterion FN990A w/audio composition: + +0x1077: tty (diag) + adb + rmnet + audio + tty (AT/NMEA) + tty (AT) + +tty (AT) + tty (AT) +T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1077 Rev=05.04 +S: Manufacturer=Telit Wireless Solutions +S: Product=FN990 +S: SerialNumber=67e04c35 +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio +I: If#= 4 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio +E: Ad=03(O) Atr=0d(Isoc) MxPS= 68 Ivl=1ms +I: If#= 5 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio +E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms +I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Acked-by: Bjørn Mork +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index efab1127e0187..f04da733240c0 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1364,6 +1364,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1077, 2)}, /* Telit FN990A w/audio */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990A */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ +-- +2.50.1 + diff --git a/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fe990a-name.patch b/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fe990a-name.patch new file mode 100644 index 0000000000..f00539d45b --- /dev/null +++ b/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fe990a-name.patch @@ -0,0 +1,37 @@ +From 8ac91b397b53f772991ba311b14bc8cc81f60c09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2025 12:24:40 +0100 +Subject: net: usb: qmi_wwan: fix Telit Cinterion FE990A name + +From: Fabio Porcedda + +[ Upstream commit 5728b289abbb4e1faf7b5eb264624f08442861f4 ] + +The correct name for FE990 is FE990A so use it in order to avoid +confusion with FE990B. + +Signed-off-by: Fabio Porcedda +Link: https://patch.msgid.link/20250227112441.3653819-3-fabio.porcedda@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 61aaca8b89fb ("net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 8278fd8823112..efab1127e0187 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1364,7 +1364,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ +- {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990A */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ +-- +2.50.1 + diff --git a/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fn990a-name.patch b/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fn990a-name.patch new file mode 100644 index 0000000000..7c644c84d3 --- /dev/null +++ b/queue-6.12/net-usb-qmi_wwan-fix-telit-cinterion-fn990a-name.patch @@ -0,0 +1,37 @@ +From 7463f06c1f8e949053691ad35e6c13a6a93c863a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 18:16:48 +0100 +Subject: net: usb: qmi_wwan: fix Telit Cinterion FN990A name + +From: Fabio Porcedda + +[ Upstream commit ad1664fb699006f552dceeba331ef1e8874309a8 ] + +The correct name for FN990 is FN990A so use it in order to avoid +confusion with FN990B. + +Signed-off-by: Fabio Porcedda +Link: https://patch.msgid.link/20250205171649.618162-5-fabio.porcedda@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 61aaca8b89fb ("net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 0a0f0e18762bb..8278fd8823112 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1363,7 +1363,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ +- {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ +-- +2.50.1 + diff --git a/queue-6.12/series b/queue-6.12/series index 928a7c7e30..763a1f9285 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -13,3 +13,20 @@ bluetooth-hci_sync-avoid-adding-default-advertising-.patch drm-rockchip-vop2-make-vp-registers-nonvolatile.patch btrfs-zoned-skip-zone-finish-of-conventional-zones.patch fs-writeback-fix-use-after-free-in-__mark_inode_dirt.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch +tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch +arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-30785 +hid-simplify-snto32.patch +hid-stop-exporting-hid_snto32.patch +hid-core-harden-s32ton-against-conversion-to-0-bits.patch +net-usb-qmi_wwan-fix-telit-cinterion-fn990a-name.patch +net-usb-qmi_wwan-fix-telit-cinterion-fe990a-name.patch +net-usb-qmi_wwan-add-telit-cinterion-fn990a-w-audio-.patch +loongarch-vdso-remove-hash-style-sysv.patch +loongarch-vdso-remove-nostdlib-complier-flag.patch +mmc-sdhci-of-arasan-support-for-emmc-hardware-reset.patch +mmc-sdhci-of-arasan-ensure-cd-logic-stabilization-be.patch diff --git a/queue-6.12/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch b/queue-6.12/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch new file mode 100644 index 0000000000..4cb1e901c2 --- /dev/null +++ b/queue-6.12/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch @@ -0,0 +1,53 @@ +From 5c38c31f6b014ebcd3ff1fbc6eee4e136d4bda4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 14:22:41 +0800 +Subject: tee: fix memory leak in tee_dyn_shm_alloc_helper + +From: Pei Xiao + +[ Upstream commit 50a74d0095cd23d2012133e208df45a298868870 ] + +When shm_register() fails in tee_dyn_shm_alloc_helper(), the pre-allocated +pages array is not freed, resulting in a memory leak. + +Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 915239b033f5f..2a7d253d9c554 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, + pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL); + if (!pages) { + rc = -ENOMEM; +- goto err; ++ goto err_pages; + } + + for (i = 0; i < nr_pages; i++) +@@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, + rc = shm_register(shm->ctx, shm, pages, nr_pages, + (unsigned long)shm->kaddr); + if (rc) +- goto err; ++ goto err_kfree; + } + + return 0; +-err: ++err_kfree: ++ kfree(pages); ++err_pages: + free_pages_exact(shm->kaddr, shm->size); + shm->kaddr = NULL; + return rc; +-- +2.50.1 + diff --git a/queue-6.12/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-6.12/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..c3578dc7d2 --- /dev/null +++ b/queue-6.12/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From 0fb65d49f686e89b1986f1a7f84dc53c2d998c5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index daf6e5cfd59ae..915239b033f5f 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -560,9 +560,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-6.12/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch b/queue-6.12/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch new file mode 100644 index 0000000000..935380518c --- /dev/null +++ b/queue-6.12/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch @@ -0,0 +1,46 @@ +From c4b12fd49c228323291042b4c51c6797c265704c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:47:35 +0000 +Subject: tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" + +From: Sungbae Yoo + +[ Upstream commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 ] + +Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() +because compatbile is a typo of compatible. + +Fixes: 4615e5a34b95 ("optee: add FF-A support") +Signed-off-by: Sungbae Yoo +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index f9ef7d94cebd7..a963eed70c1d4 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -657,7 +657,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, + * with a matching configuration. + */ + +-static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, ++static bool optee_ffa_api_is_compatible(struct ffa_device *ffa_dev, + const struct ffa_ops *ops) + { + const struct ffa_msg_ops *msg_ops = ops->msg_ops; +@@ -908,7 +908,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) + ffa_ops = ffa_dev->ops; + notif_ops = ffa_ops->notifier_ops; + +- if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops)) ++ if (!optee_ffa_api_is_compatible(ffa_dev, ffa_ops)) + return -EINVAL; + + if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps, +-- +2.50.1 + diff --git a/queue-6.16/arm-dts-microchip-sama7d65-force-sdmmc-legacy-mode.patch b/queue-6.16/arm-dts-microchip-sama7d65-force-sdmmc-legacy-mode.patch new file mode 100644 index 0000000000..8c7086b049 --- /dev/null +++ b/queue-6.16/arm-dts-microchip-sama7d65-force-sdmmc-legacy-mode.patch @@ -0,0 +1,39 @@ +From d5963a7cf7919d9ff752095782a009d9f9e20b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 10:05:24 -0700 +Subject: ARM: dts: microchip: sama7d65: Force SDMMC Legacy mode + +From: Ryan Wanner + +[ Upstream commit 217efb440933bf97a78ef328b211d8a39f4ff171 ] + +The SDMMC in this IP currently only supports legacy mode +due to a hardware quirk, setting the flags to reflect the limitation. + +Fixes: deaa14ab6b06 ("ARM: dts: microchip: add support for sama7d65_curiosity board") +Signed-off-by: Ryan Wanner +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20250819170528.126010-1-Ryan.Wanner@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/microchip/at91-sama7d65_curiosity.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/microchip/at91-sama7d65_curiosity.dts b/arch/arm/boot/dts/microchip/at91-sama7d65_curiosity.dts +index 53a657cf4efba..dfe1f0616a810 100644 +--- a/arch/arm/boot/dts/microchip/at91-sama7d65_curiosity.dts ++++ b/arch/arm/boot/dts/microchip/at91-sama7d65_curiosity.dts +@@ -352,6 +352,8 @@ &rtt { + + &sdmmc1 { + bus-width = <4>; ++ no-1-8-v; ++ sdhci-caps-mask = <0x0 0x00200000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sdmmc1_default>; + status = "okay"; +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch b/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch new file mode 100644 index 0000000000..d19612f4c3 --- /dev/null +++ b/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch @@ -0,0 +1,39 @@ +From 64c1dd5d7ae3d318487aa3089671dc36adaf137b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:03:07 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics + i.MX8M Plus DHCOM + +From: Marek Vasut + +[ Upstream commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +index 7f754e0a5d693..68c2e0156a5c8 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +@@ -609,6 +609,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-482 b/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-482 new file mode 100644 index 0000000000..1b32e85a34 --- /dev/null +++ b/queue-6.16/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-482 @@ -0,0 +1,39 @@ +From 828342cbd3dc2489571fc002f4433fb1ec709e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:04:32 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul + i.MX8M Plus eDM SBC + +From: Marek Vasut + +[ Upstream commit 80733306290f6d2e05f0632e5d3e98cd16105c3c ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +index d0fc5977258fb..16078ff60ef08 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +@@ -555,6 +555,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch b/queue-6.16/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch new file mode 100644 index 0000000000..e0bae59093 --- /dev/null +++ b/queue-6.16/arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch @@ -0,0 +1,173 @@ +From 58b74a499ad3eaaf6f130b5e13bc350260424575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Jul 2025 11:16:52 +0200 +Subject: arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off + +From: Markus Niebel + +[ Upstream commit 5245dc5ff9b1f6c02ef948f623432805ea148fca ] + +Fix SD card removal caused by automatic LDO5 power off after boot: + +LDO5: disabling +mmc1: card 59b4 removed +EXT4-fs (mmcblk1p2): shut down requested (2) +Aborting journal on device mmcblk1p2-8. +JBD2: I/O error when updating journal superblock for mmcblk1p2-8. + +To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled +regulator that is supplied by LDO5. Since this is implemented on SoM but +used on baseboards with SD-card interface, implement the functionality +on SoM part and optionally enable it on baseboards if needed. + +Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") +Signed-off-by: Markus Niebel +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../imx8mp-tqma8mpql-mba8mp-ras314.dts | 13 ++++++----- + .../freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 13 ++++++----- + .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 22 +++++++++++++++++++ + 3 files changed, 36 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +index d7fd9d36f8240..f7346b3d35fe5 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +@@ -467,6 +467,10 @@ &pwm4 { + status = "okay"; + }; + ++®_usdhc2_vqmmc { ++ status = "okay"; ++}; ++ + &sai5 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai5>; +@@ -876,8 +880,7 @@ pinctrl_usdhc2: usdhc2grp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { +@@ -886,8 +889,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { +@@ -896,8 +898,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_gpio: usdhc2-gpiogrp { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts +index 23c612e80dd38..092b1b65a88c0 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts +@@ -603,6 +603,10 @@ &pwm3 { + status = "okay"; + }; + ++®_usdhc2_vqmmc { ++ status = "okay"; ++}; ++ + &sai3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai3>; +@@ -982,8 +986,7 @@ pinctrl_usdhc2: usdhc2grp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { +@@ -992,8 +995,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { +@@ -1002,8 +1004,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + , + , + , +- , +- ; ++ ; + }; + + pinctrl_usdhc2_gpio: usdhc2-gpiogrp { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +index 6067ca3be814e..0a592fa2d8bc7 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +@@ -24,6 +24,20 @@ reg_vcc3v3: regulator-vcc3v3 { + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; ++ ++ reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { ++ compatible = "regulator-gpio"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_reg_usdhc2_vqmmc>; ++ regulator-name = "V_SD2"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; ++ gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; ++ states = <1800000 0x1>, ++ <3300000 0x0>; ++ vin-supply = <&ldo5_reg>; ++ status = "disabled"; ++ }; + }; + + &A53_0 { +@@ -180,6 +194,10 @@ m24c64: eeprom@57 { + }; + }; + ++&usdhc2 { ++ vqmmc-supply = <®_usdhc2_vqmmc>; ++}; ++ + &usdhc3 { + pinctrl-names = "default", "state_100mhz", "state_200mhz"; + pinctrl-0 = <&pinctrl_usdhc3>; +@@ -229,6 +247,10 @@ pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp { + fsl,pins = ; + }; + ++ pinctrl_reg_usdhc2_vqmmc: regusdhc2vqmmcgrp { ++ fsl,pins = ; ++ }; ++ + pinctrl_usdhc3: usdhc3grp { + fsl,pins = , + , +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-rockchip-add-supplies-for-emmc-on-rk3588-o.patch b/queue-6.16/arm64-dts-rockchip-add-supplies-for-emmc-on-rk3588-o.patch new file mode 100644 index 0000000000..cceb6d724c --- /dev/null +++ b/queue-6.16/arm64-dts-rockchip-add-supplies-for-emmc-on-rk3588-o.patch @@ -0,0 +1,39 @@ +From 470d05e1b12fb69736553a871a562767c8fcf111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 13:29:39 +0800 +Subject: arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 + +From: Chen-Yu Tsai + +[ Upstream commit 2dea24df234940b27d378f786933dc10f33de6b8 ] + +The eMMC description is missing both vmmc and vqmmc supplies. + +Add them to complete the description. + +Fixes: 236d225e1ee7 ("arm64: dts: rockchip: Add board device tree for rk3588-orangepi-5-plus") +Fixes: ea63f4666e48 ("arm64: dts: rockchip: refactor common rk3588-orangepi-5.dtsi") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250821052939.1869171-1-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-orangepi-5.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5.dtsi +index 91d56c34a1e45..8a8f3b26754d7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5.dtsi +@@ -365,6 +365,8 @@ &sdhci { + max-frequency = <200000000>; + mmc-hs400-1_8v; + mmc-hs400-enhanced-strobe; ++ vmmc-supply = <&vcc_3v3_s3>; ++ vqmmc-supply = <&vcc_1v8_s3>; + status = "okay"; + }; + +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-6.16/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..65f3f1ffe5 --- /dev/null +++ b/queue-6.16/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From fce32cb837355d77cd285e18dbe9a7a7c35ad36a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 5473070823cb1..6cadde440fff4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -966,6 +966,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-rockchip-fix-the-headphone-detection-on-th.patch b/queue-6.16/arm64-dts-rockchip-fix-the-headphone-detection-on-th.patch new file mode 100644 index 0000000000..936d75fbe2 --- /dev/null +++ b/queue-6.16/arm64-dts-rockchip-fix-the-headphone-detection-on-th.patch @@ -0,0 +1,44 @@ +From 7a0888053d1cc5700b6a43f063fd04dd469e7ba3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Aug 2025 14:43:50 +0200 +Subject: arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 + plus +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maud Spierings + +[ Upstream commit 8976583832579fe7e450034d6143d74d9f8c8608 ] + +The logic of the headphone detect pin seems to be inverted, with this +change headphones actually output sound when plugged in. + +Verified by checking /sys/kernel/debug/gpio and by listening. + +Fixes: 236d225e1ee7 ("arm64: dts: rockchip: Add board device tree for rk3588-orangepi-5-plus") +Signed-off-by: Maud Spierings +Reviewed-by: Ondřej Jirman +Link: https://lore.kernel.org/r/20250823-orangepi5-v1-1-ae77dd0e06d7@hotmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +index 121e4d1c3fa5d..8222f1fae8fad 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-orangepi-5-plus.dts +@@ -77,7 +77,7 @@ &analog_sound { + pinctrl-names = "default"; + pinctrl-0 = <&hp_detect>; + simple-audio-card,aux-devs = <&speaker_amp>, <&headphone_amp>; +- simple-audio-card,hp-det-gpios = <&gpio1 RK_PD3 GPIO_ACTIVE_LOW>; ++ simple-audio-card,hp-det-gpios = <&gpio1 RK_PD3 GPIO_ACTIVE_HIGH>; + simple-audio-card,widgets = + "Microphone", "Onboard Microphone", + "Microphone", "Microphone Jack", +-- +2.50.1 + diff --git a/queue-6.16/arm64-dts-rockchip-mark-eeprom-as-read-only-for-radx.patch b/queue-6.16/arm64-dts-rockchip-mark-eeprom-as-read-only-for-radx.patch new file mode 100644 index 0000000000..73fd5eaa94 --- /dev/null +++ b/queue-6.16/arm64-dts-rockchip-mark-eeprom-as-read-only-for-radx.patch @@ -0,0 +1,36 @@ +From 06dfaf47aa5b03b0b4e5ce1e71e42edd746316cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:00:19 +0800 +Subject: arm64: dts: rockchip: mark eeprom as read-only for Radxa E52C + +From: Chukun Pan + +[ Upstream commit f18c9e79bbe65627805fff6aac3ea96b6b55b53d ] + +The eeprom on the Radxa E52C SBC contains manufacturer data +such as the mac address, so it should be marked as read-only. + +Fixes: 9be4171219b6 ("arm64: dts: rockchip: Add Radxa E52C") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20250810100020.445053-2-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3582-radxa-e52c.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3582-radxa-e52c.dts b/arch/arm64/boot/dts/rockchip/rk3582-radxa-e52c.dts +index e04f21d8c831e..431ff77d45180 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3582-radxa-e52c.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3582-radxa-e52c.dts +@@ -250,6 +250,7 @@ eeprom@50 { + compatible = "belling,bl24c16a", "atmel,24c16"; + reg = <0x50>; + pagesize = <16>; ++ read-only; + vcc-supply = <&vcc_3v3_pmu>; + }; + }; +-- +2.50.1 + diff --git a/queue-6.16/series b/queue-6.16/series index 507591a515..30022aa6d4 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -16,3 +16,14 @@ btrfs-clear-block-dirty-if-submit_one_sector-failed.patch btrfs-zoned-skip-zone-finish-of-conventional-zones.patch platform-x86-amd-pmc-drop-smu-f-w-match-for-cezanne.patch fs-writeback-fix-use-after-free-in-__mark_inode_dirt.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch +arm64-dts-rockchip-mark-eeprom-as-read-only-for-radx.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch +tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch +arm64-dts-imx8mp-tqma8mpql-fix-ldo5-power-off.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-482 +arm64-dts-rockchip-fix-the-headphone-detection-on-th.patch +arm64-dts-rockchip-add-supplies-for-emmc-on-rk3588-o.patch +arm-dts-microchip-sama7d65-force-sdmmc-legacy-mode.patch diff --git a/queue-6.16/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch b/queue-6.16/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch new file mode 100644 index 0000000000..0137c9a81a --- /dev/null +++ b/queue-6.16/tee-fix-memory-leak-in-tee_dyn_shm_alloc_helper.patch @@ -0,0 +1,53 @@ +From dcd50707973828a787fc1dd28608d47131c274a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 14:22:41 +0800 +Subject: tee: fix memory leak in tee_dyn_shm_alloc_helper + +From: Pei Xiao + +[ Upstream commit 50a74d0095cd23d2012133e208df45a298868870 ] + +When shm_register() fails in tee_dyn_shm_alloc_helper(), the pre-allocated +pages array is not freed, resulting in a memory leak. + +Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 915239b033f5f..2a7d253d9c554 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, + pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL); + if (!pages) { + rc = -ENOMEM; +- goto err; ++ goto err_pages; + } + + for (i = 0; i < nr_pages; i++) +@@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, + rc = shm_register(shm->ctx, shm, pages, nr_pages, + (unsigned long)shm->kaddr); + if (rc) +- goto err; ++ goto err_kfree; + } + + return 0; +-err: ++err_kfree: ++ kfree(pages); ++err_pages: + free_pages_exact(shm->kaddr, shm->size); + shm->kaddr = NULL; + return rc; +-- +2.50.1 + diff --git a/queue-6.16/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-6.16/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..4b9110685b --- /dev/null +++ b/queue-6.16/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From d3b47d9cd7e58bb366d1f6237f0d345a020a250e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index daf6e5cfd59ae..915239b033f5f 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -560,9 +560,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-6.16/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch b/queue-6.16/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch new file mode 100644 index 0000000000..3226eacf79 --- /dev/null +++ b/queue-6.16/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch @@ -0,0 +1,46 @@ +From fe01e4a68129863e97795e96f21ea528f08c4a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:47:35 +0000 +Subject: tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" + +From: Sungbae Yoo + +[ Upstream commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 ] + +Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() +because compatbile is a typo of compatible. + +Fixes: 4615e5a34b95 ("optee: add FF-A support") +Signed-off-by: Sungbae Yoo +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index f9ef7d94cebd7..a963eed70c1d4 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -657,7 +657,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, + * with a matching configuration. + */ + +-static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, ++static bool optee_ffa_api_is_compatible(struct ffa_device *ffa_dev, + const struct ffa_ops *ops) + { + const struct ffa_msg_ops *msg_ops = ops->msg_ops; +@@ -908,7 +908,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) + ffa_ops = ffa_dev->ops; + notif_ops = ffa_ops->notifier_ops; + +- if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops)) ++ if (!optee_ffa_api_is_compatible(ffa_dev, ffa_ops)) + return -EINVAL; + + if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps, +-- +2.50.1 + diff --git a/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch b/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch new file mode 100644 index 0000000000..ea77f693d1 --- /dev/null +++ b/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch @@ -0,0 +1,39 @@ +From 0892abb63f1c919094b3319a2498707becc5e842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:03:07 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics + i.MX8M Plus DHCOM + +From: Marek Vasut + +[ Upstream commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +index eae39c1cb9856..2e93d922c8611 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +@@ -571,6 +571,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-12817 b/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-12817 new file mode 100644 index 0000000000..703e099f60 --- /dev/null +++ b/queue-6.6/arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-12817 @@ -0,0 +1,39 @@ +From 96e304e73052d517e191ee3acaaa96ad0b68d5d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Aug 2025 18:04:32 +0200 +Subject: arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul + i.MX8M Plus eDM SBC + +From: Marek Vasut + +[ Upstream commit 80733306290f6d2e05f0632e5d3e98cd16105c3c ] + +Add missing microSD slot vqmmc-supply property, otherwise the kernel +might shut down LDO5 regulator and that would power off the microSD +card slot, possibly while it is in use. Add the property to make sure +the kernel is aware of the LDO5 regulator which supplies the microSD +slot and keeps the LDO5 enabled. + +Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +index cd44bf83745ca..678ecc9f81dbb 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +@@ -442,6 +442,7 @@ &usdhc2 { + pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; + cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; ++ vqmmc-supply = <&ldo5>; + bus-width = <4>; + status = "okay"; + }; +-- +2.50.1 + diff --git a/queue-6.6/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch b/queue-6.6/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch new file mode 100644 index 0000000000..4730cb7a3c --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch @@ -0,0 +1,42 @@ +From 60101c9c470031a2d6e48373a100bf1f464c5f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jul 2025 11:21:26 +0100 +Subject: arm64: dts: rockchip: Add vcc-supply to SPI flash on + rk3399-pinebook-pro + +From: Peter Robinson + +[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ] + +As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, +he SPI Flash's VCC connector is connected to VCC_3V0 power source. + +This fixes the following warning: + + spi-nor spi1.0: supply vcc not found, using dummy regulator + +Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Peter Robinson +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index f5e124b235c83..fb3012a6c9fc3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -967,6 +967,7 @@ spiflash: flash@0 { + reg = <0>; + m25p,fast-read; + spi-max-frequency = <10000000>; ++ vcc-supply = <&vcc_3v0>; + }; + }; + +-- +2.50.1 + diff --git a/queue-6.6/series b/queue-6.6/series index 2a5044d503..b9aa0d1073 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -11,3 +11,8 @@ drm-amd-display-don-t-warn-when-missing-dce-encoder-.patch cpupower-fix-a-bug-where-the-t-option-of-the-set-sub.patch bluetooth-hci_sync-avoid-adding-default-advertising-.patch fs-writeback-fix-use-after-free-in-__mark_inode_dirt.patch +tee-fix-null-pointer-dereference-in-tee_shm_put.patch +arm64-dts-rockchip-add-vcc-supply-to-spi-flash-on-rk.patch +tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch +arm64-dts-imx8mp-fix-missing-microsd-slot-vqmmc-on-d.patch-12817 diff --git a/queue-6.6/tee-fix-null-pointer-dereference-in-tee_shm_put.patch b/queue-6.6/tee-fix-null-pointer-dereference-in-tee_shm_put.patch new file mode 100644 index 0000000000..02026093d5 --- /dev/null +++ b/queue-6.6/tee-fix-null-pointer-dereference-in-tee_shm_put.patch @@ -0,0 +1,106 @@ +From 9aeef1b891f2c8a9d6bf4b13693d48cccffb57fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jul 2025 10:09:07 +0800 +Subject: tee: fix NULL pointer dereference in tee_shm_put + +From: Pei Xiao + +[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] + +tee_shm_put have NULL pointer dereference: + +__optee_disable_shm_cache --> + shm = reg_pair_to_ptr(...);//shm maybe return NULL + tee_shm_free(shm); --> + tee_shm_put(shm);//crash + +Add check in tee_shm_put to fix it. + +panic log: +Unable to handle kernel paging request at virtual address 0000000000100cca +Mem abort info: +ESR = 0x0000000096000004 +EC = 0x25: DABT (current EL), IL = 32 bits +SET = 0, FnV = 0 +EA = 0, S1PTW = 0 +FSC = 0x04: level 0 translation fault +Data abort info: +ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 +[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] SMP +CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- +6.6.0-39-generic #38 +Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 +Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 +10/26/2022 +pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tee_shm_put+0x24/0x188 +lr : tee_shm_free+0x14/0x28 +sp : ffff001f98f9faf0 +x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 +x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 +x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 +x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff +x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 +x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 +x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c +x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca +Call trace: +tee_shm_put+0x24/0x188 +tee_shm_free+0x14/0x28 +__optee_disable_shm_cache+0xa8/0x108 +optee_shutdown+0x28/0x38 +platform_shutdown+0x28/0x40 +device_shutdown+0x144/0x2b0 +kernel_power_off+0x3c/0x80 +hibernate+0x35c/0x388 +state_store+0x64/0x80 +kobj_attr_store+0x14/0x28 +sysfs_kf_write+0x48/0x60 +kernfs_fop_write_iter+0x128/0x1c0 +vfs_write+0x270/0x370 +ksys_write+0x6c/0x100 +__arm64_sys_write+0x20/0x30 +invoke_syscall+0x4c/0x120 +el0_svc_common.constprop.0+0x44/0xf0 +do_el0_svc+0x24/0x38 +el0_svc+0x24/0x88 +el0t_64_sync_handler+0x134/0x150 +el0t_64_sync+0x14c/0x15 + +Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") +Signed-off-by: Pei Xiao +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 673cf03594948..426b818f2dd79 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -489,9 +489,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- struct tee_device *teedev = shm->ctx->teedev; ++ struct tee_device *teedev; + bool do_release = false; + ++ if (!shm || !shm->ctx || !shm->ctx->teedev) ++ return; ++ ++ teedev = shm->ctx->teedev; + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* +-- +2.50.1 + diff --git a/queue-6.6/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch b/queue-6.6/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch new file mode 100644 index 0000000000..6368c356e9 --- /dev/null +++ b/queue-6.6/tee-optee-ffa-fix-a-typo-of-optee_ffa_api_is_compati.patch @@ -0,0 +1,46 @@ +From d1d5442d5efe17a41eded4ef2c9b3762b759a0b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Aug 2025 12:47:35 +0000 +Subject: tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" + +From: Sungbae Yoo + +[ Upstream commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 ] + +Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() +because compatbile is a typo of compatible. + +Fixes: 4615e5a34b95 ("optee: add FF-A support") +Signed-off-by: Sungbae Yoo +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index b8ba360e863ed..927c3d7947f9c 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -653,7 +653,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, + * with a matching configuration. + */ + +-static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, ++static bool optee_ffa_api_is_compatible(struct ffa_device *ffa_dev, + const struct ffa_ops *ops) + { + const struct ffa_msg_ops *msg_ops = ops->msg_ops; +@@ -804,7 +804,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) + + ffa_ops = ffa_dev->ops; + +- if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops)) ++ if (!optee_ffa_api_is_compatible(ffa_dev, ffa_ops)) + return -EINVAL; + + if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps, +-- +2.50.1 +