From: Sasha Levin Date: Mon, 8 Dec 2025 03:07:02 +0000 (-0500) Subject: Fixes for all trees X-Git-Tag: v6.12.62~11^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d542631d7af00a5bfdcd2abcf1d2acb652bbffb8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-5.10/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..ec91231824 --- /dev/null +++ b/queue-5.10/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From 706110675a940badf7ca2f4226845874522eb2fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index fd691e4815c56..fa4e002925852 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-5.10/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-5.10/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..f340d7ac7a --- /dev/null +++ b/queue-5.10/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From 2e9e270d7119dc7c72b1230875ea2e52ef67ad17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index fb48f8ba5dcc8..c4fda94321bb4 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -73,7 +73,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + #ifdef CONFIG_DMA_API_DEBUG + void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr); +-- +2.51.0 + diff --git a/queue-5.10/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-5.10/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..d39b1d76bd --- /dev/null +++ b/queue-5.10/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From d6279aca63f8bbfc2585f5869d0127e63df6a8f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 049a34f0e13f7..f72a1598de28a 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-5.10/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-5.10/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..e05fe81c97 --- /dev/null +++ b/queue-5.10/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From db6d70b7516aab8e8e8b2daae0e314db5d2e63d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index ebec49957ed09..b35a0539a99c6 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -81,6 +81,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + }; + +@@ -1890,6 +1891,9 @@ static void acer_wmi_notify(u32 value, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-5.10/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-5.10/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..d8c8d5eafa --- /dev/null +++ b/queue-5.10/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From b50f7d14c9368c262382f22b0a3a5754e3a00409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index 23ebd0c046e16..da9f80bde794f 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-5.10/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-5.10/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..8fa987bed3 --- /dev/null +++ b/queue-5.10/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From 104a36d1875b944b1687c0c1ec460062f26cb41b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 7c20dd9fee..7c18189d14 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -2,3 +2,11 @@ xfrm-delete-x-tunnel-as-we-delete-x.patch revert-xfrm-destroy-xfrm_state-synchronously-on-net-.patch xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch xfrm-flush-all-states-in-xfrm_state_fini.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +samples-work-around-glibc-redefining-some-of-our-def.patch diff --git a/queue-5.10/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-5.10/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..413f797732 --- /dev/null +++ b/queue-5.10/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From 1d27c929e65547ec8d67d1c2cf76e95370204005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index f1a0073a8700f..a4e35c2f7d6ed 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -493,9 +493,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_disable_dma(struct spi_imx_data *spi_imx) +@@ -650,7 +656,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(spi_imx->wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1424,6 +1429,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(master->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-5.10/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-5.10/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..fc7e30da6e --- /dev/null +++ b/queue-5.10/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From cbbed0785d9f3515994d89bcf54c49bd1a347acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index 523edfdf5dcd1..d497fc4bc19eb 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 + diff --git a/queue-5.15/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-5.15/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..c6951187e0 --- /dev/null +++ b/queue-5.15/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From d42f9206c4c06f8b85707f62b056ceeff30156be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index fd691e4815c56..fa4e002925852 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-5.15/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-5.15/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..276b21de57 --- /dev/null +++ b/queue-5.15/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From b61323372b217568965e6652aadc996b7e5830eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index d7b91f82b0dce..e034355c35dd5 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -73,7 +73,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + #ifdef CONFIG_DMA_API_DEBUG + void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr); +-- +2.51.0 + diff --git a/queue-5.15/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch b/queue-5.15/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch new file mode 100644 index 0000000000..3abc2fbf8d --- /dev/null +++ b/queue-5.15/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch @@ -0,0 +1,80 @@ +From aa0c3f824952fc9cb199045434e8271c29a5b7fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 21:16:45 +0900 +Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F) + +From: Naoki Ueki + +[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ] + +The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which +shares the same report descriptor as the existing device (0x00FB). However, +the driver does not currently recognize this new ID, resulting in only five +buttons being functional. + +This patch adds the new device ID so that all six buttons work properly. + +Signed-off-by: Naoki Ueki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 6 ++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 4fa45ee77503b..f76fec79e8903 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8); + break; +- case USB_DEVICE_ID_ELECOM_M_XT3URBK: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F: + case USB_DEVICE_ID_ELECOM_M_XT3DRBK: + case USB_DEVICE_ID_ELECOM_M_XT4DRBK: + /* +@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index d897d48404d21..b68293a505518 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -415,7 +415,8 @@ + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 + #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 +-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f + #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc + #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index c07c7dc06d914..4b645db5cd4bc 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -382,7 +382,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +-- +2.51.0 + diff --git a/queue-5.15/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-5.15/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..a34b85d5d4 --- /dev/null +++ b/queue-5.15/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From ba0cf0311492f386ecaef74d725b4088c0d88a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 676b16397b07c..1bb7be9ed92f2 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-5.15/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-5.15/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..b4478cf8c7 --- /dev/null +++ b/queue-5.15/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From 3f676a16f68159f9551a2728dee95e092049db85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 7ef80f517e76e..ea5dbe8081570 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, + WMID_AC_EVENT = 0x8, +@@ -2060,6 +2061,9 @@ static void acer_wmi_notify(u32 value, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-5.15/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-5.15/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..4c70eecfbe --- /dev/null +++ b/queue-5.15/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From 5a1499d86eff5947b43c3a7985449eb6dfe5ca83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index 23ebd0c046e16..da9f80bde794f 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-5.15/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-5.15/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..5a2e512a63 --- /dev/null +++ b/queue-5.15/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From 293129f5d9b154599d0e7d9fddc78747eb994243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index dfa26f015c..7d291e936a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -6,3 +6,12 @@ dpaa2-mac-bail-if-the-dpmacs-fwnode-is-not-found.patch drm-i915-selftests-fix-inconsistent-is_err-and-ptr_e.patch leds-replace-all-non-returning-strlcpy-with-strscpy.patch leds-spi-byte-use-devm_led_classdev_register_ext.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch +samples-work-around-glibc-redefining-some-of-our-def.patch diff --git a/queue-5.15/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-5.15/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..dddb8843ed --- /dev/null +++ b/queue-5.15/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From d46799868513643b80db746e022e79ba8823e929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index f22b867b8c8a9..bcc31951a9925 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -498,9 +498,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_disable_dma(struct spi_imx_data *spi_imx) +@@ -665,7 +671,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(tx_wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1422,6 +1427,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(master->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-5.15/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-5.15/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..f160c6b676 --- /dev/null +++ b/queue-5.15/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From 5d18bd08274f48b3fb06c86c987ddd7abd53b53e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index 523edfdf5dcd1..d497fc4bc19eb 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch b/queue-6.1/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch new file mode 100644 index 0000000000..468f02eba2 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch @@ -0,0 +1,65 @@ +From 26beaa92d2b071182c8bd5a1d2974bf94c574952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 13:20:53 +0800 +Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series + +From: Lushih Hsieh + +[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ] + +The PureAudio APA DAC and Lotus DAC5 series are USB Audio +2.0 Class devices that support native Direct Stream Digital (DSD) +playback via specific vendor protocols. + +Without these quirks, the devices may only function in standard +PCM mode, or fail to correctly report their DSD format capabilities +to the ALSA framework, preventing native DSD playback under Linux. + +This commit adds new quirk entries for the mentioned DAC models +based on their respective Vendor/Product IDs (VID:PID), for example: +0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. + +The quirk ensures correct DSD format handling by setting the required +SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific +Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA +DSD API to correctly address the device for high-bitrate DSD streams, +bypassing the need for DoP (DSD over PCM). + +Test on APA DAC and Lotus DAC5 SE under Arch Linux. + +Tested-by: Lushih Hsieh +Signed-off-by: Lushih Hsieh +Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index aa5623e104c71..286ec4580718c 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1920,6 +1920,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ + case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */ ++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ + case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ +@@ -2187,6 +2189,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ + QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */ + QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ +-- +2.51.0 + diff --git a/queue-6.1/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-6.1/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..aac4f3fa47 --- /dev/null +++ b/queue-6.1/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From 0dca311a31722ed0e5e9404627d923bcc5bbc56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index 1926bec2c8500..07f7929d07fd8 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-6.1/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-6.1/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..e59b5f1ccf --- /dev/null +++ b/queue-6.1/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From cdd6f27e6aba505ab8a797168701d7471022b67e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index af3f39ecc1b87..ab400d957754c 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -74,7 +74,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + #ifdef CONFIG_DMA_API_DEBUG + void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr); +-- +2.51.0 + diff --git a/queue-6.1/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch b/queue-6.1/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch new file mode 100644 index 0000000000..8e705cb613 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch @@ -0,0 +1,82 @@ +From 498bcf5e281e379d53851228f6e763536bafe584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:36:40 -0500 +Subject: drm/vmwgfx: Use kref in vmw_bo_dirty + +From: Ian Forbes + +[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ] + +Rather than using an ad hoc reference count use kref which is atomic +and has underflow warnings. + +Signed-off-by: Ian Forbes +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +index 7bc99b1279f7d..09e938498442c 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +@@ -50,22 +50,22 @@ enum vmw_bo_dirty_method { + + /** + * struct vmw_bo_dirty - Dirty information for buffer objects ++ * @ref_count: Reference count for this structure. Must be first member! + * @start: First currently dirty bit + * @end: Last currently dirty bit + 1 + * @method: The currently used dirty method + * @change_count: Number of consecutive method change triggers +- * @ref_count: Reference count for this structure + * @bitmap_size: The size of the bitmap in bits. Typically equal to the + * nuber of pages in the bo. + * @bitmap: A bitmap where each bit represents a page. A set bit means a + * dirty page. + */ + struct vmw_bo_dirty { ++ struct kref ref_count; + unsigned long start; + unsigned long end; + enum vmw_bo_dirty_method method; + unsigned int change_count; +- unsigned int ref_count; + unsigned long bitmap_size; + unsigned long bitmap[]; + }; +@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo) + int ret; + + if (dirty) { +- dirty->ref_count++; ++ kref_get(&dirty->ref_count); + return 0; + } + +@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo) + dirty->bitmap_size = num_pages; + dirty->start = dirty->bitmap_size; + dirty->end = 0; +- dirty->ref_count = 1; ++ kref_init(&dirty->ref_count); + if (num_pages < PAGE_SIZE / sizeof(pte_t)) { + dirty->method = VMW_BO_DIRTY_PAGETABLE; + } else { +@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_buffer_object *vbo) + { + struct vmw_bo_dirty *dirty = vbo->dirty; + +- if (dirty && --dirty->ref_count == 0) { +- kvfree(dirty); ++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree)) + vbo->dirty = NULL; +- } + } + + /** +-- +2.51.0 + diff --git a/queue-6.1/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch b/queue-6.1/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch new file mode 100644 index 0000000000..de700b38ae --- /dev/null +++ b/queue-6.1/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch @@ -0,0 +1,156 @@ +From 12e2eed91b776bc434a393cecaf2e9126a420a19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:50:22 -0700 +Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() + +From: Song Liu + +[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ] + +ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on +the same kernel function. When needed, ftrace_hash_ipmodify_enable() +calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to +share the same function as the IPMODIFY ftrace (livepatch). + +ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, +but not called in modify_ftrace_direct() path. As a result, the following +operations will break livepatch: + +1. Load livepatch to a kernel function; +2. Attach fentry program to the kernel function; +3. Attach fexit program to the kernel function. + +After 3, the kernel function being used will not be the livepatched +version, but the original version. + +Fix this by adding __ftrace_hash_update_ipmodify() to +__modify_ftrace_direct() and adjust some logic around the call. + +Signed-off-by: Song Liu +Reviewed-by: Jiri Olsa +Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org +Signed-off-by: Alexei Starovoitov +Acked-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index a46e2f32ee5fc..e24906e7fcc5d 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1895,7 +1895,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops, + */ + static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + struct ftrace_hash *old_hash, +- struct ftrace_hash *new_hash) ++ struct ftrace_hash *new_hash, ++ bool update_target) + { + struct ftrace_page *pg; + struct dyn_ftrace *rec, *end = NULL; +@@ -1930,10 +1931,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (rec->flags & FTRACE_FL_DISABLED) + continue; + +- /* We need to update only differences of filter_hash */ ++ /* ++ * Unless we are updating the target of a direct function, ++ * we only need to update differences of filter_hash ++ */ + in_old = !!ftrace_lookup_ip(old_hash, rec->ip); + in_new = !!ftrace_lookup_ip(new_hash, rec->ip); +- if (in_old == in_new) ++ if (!update_target && (in_old == in_new)) + continue; + + if (in_new) { +@@ -1944,7 +1948,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (is_ipmodify) + goto rollback; + +- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT); ++ /* ++ * If this is called by __modify_ftrace_direct() ++ * then it is only changing where the direct ++ * pointer is jumping to, and the record already ++ * points to a direct trampoline. If it isn't, ++ * then it is a bug to update ipmodify on a direct ++ * caller. ++ */ ++ FTRACE_WARN_ON(!update_target && ++ (rec->flags & FTRACE_FL_DIRECT)); + + /* + * Another ops with IPMODIFY is already +@@ -2001,7 +2014,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash); ++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false); + } + + /* Disabling always succeeds */ +@@ -2012,7 +2025,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH); ++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false); + } + + static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, +@@ -2026,7 +2039,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, + if (ftrace_hash_empty(new_hash)) + new_hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash); ++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false); + } + + static void print_ip_ins(const char *fmt, const unsigned char *p) +@@ -5736,7 +5749,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct_multi); + static int + __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr) + { +- struct ftrace_hash *hash; ++ struct ftrace_hash *hash = ops->func_hash->filter_hash; + struct ftrace_func_entry *entry, *iter; + static struct ftrace_ops tmp_ops = { + .func = ftrace_stub, +@@ -5755,13 +5768,21 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr) + if (err) + return err; + ++ /* ++ * Call __ftrace_hash_update_ipmodify() here, so that we can call ++ * ops->ops_func for the ops. This is needed because the above ++ * register_ftrace_function_nolock() worked on tmp_ops. ++ */ ++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true); ++ if (err) ++ goto out; ++ + /* + * Now the ftrace_ops_list_func() is called to do the direct callers. + * We can safely change the direct functions attached to each entry. + */ + mutex_lock(&ftrace_lock); + +- hash = ops->func_hash->filter_hash; + size = 1 << hash->size_bits; + for (i = 0; i < size; i++) { + hlist_for_each_entry(iter, &hash->buckets[i], hlist) { +@@ -5774,6 +5795,7 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr) + + mutex_unlock(&ftrace_lock); + ++out: + /* Removing the tmp_ops will add the updated direct callers to the functions */ + unregister_ftrace_function(&tmp_ops); + +-- +2.51.0 + diff --git a/queue-6.1/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch b/queue-6.1/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch new file mode 100644 index 0000000000..56d79e4e5e --- /dev/null +++ b/queue-6.1/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch @@ -0,0 +1,35 @@ +From 135bf778cbfe1828c04b8917c5cf0a1b8803f0ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:37:26 +0800 +Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list + +From: April Grimoire + +[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ] + +SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, +rendering function keys not treated properly. Despite being a +SONiX USB DEVICE, it uses a different name, so adding it to the list. + +Signed-off-by: April Grimoire +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 76b76b67fa860..2de1a97eafc14 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -320,6 +320,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { + { "SONiX USB DEVICE" }, ++ { "SONiX AK870 PRO" }, + { "Keychron" }, + { "AONE" }, + { "GANSS" } +-- +2.51.0 + diff --git a/queue-6.1/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch b/queue-6.1/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch new file mode 100644 index 0000000000..1f329c1d16 --- /dev/null +++ b/queue-6.1/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch @@ -0,0 +1,80 @@ +From 8d33d3129bd65a48cdd8a5ba68275d74fda28710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 21:16:45 +0900 +Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F) + +From: Naoki Ueki + +[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ] + +The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which +shares the same report descriptor as the existing device (0x00FB). However, +the driver does not currently recognize this new ID, resulting in only five +buttons being functional. + +This patch adds the new device ID so that all six buttons work properly. + +Signed-off-by: Naoki Ueki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 6 ++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 4fa45ee77503b..f76fec79e8903 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8); + break; +- case USB_DEVICE_ID_ELECOM_M_XT3URBK: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F: + case USB_DEVICE_ID_ELECOM_M_XT3DRBK: + case USB_DEVICE_ID_ELECOM_M_XT4DRBK: + /* +@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index a91208c83e46b..524edddd84895 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -439,7 +439,8 @@ + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 + #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 +-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f + #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc + #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 960392125ceac..249e626d1c6a3 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +-- +2.51.0 + diff --git a/queue-6.1/loongarch-mask-all-interrupts-during-kexec-kdump.patch b/queue-6.1/loongarch-mask-all-interrupts-during-kexec-kdump.patch new file mode 100644 index 0000000000..54c1fa9d03 --- /dev/null +++ b/queue-6.1/loongarch-mask-all-interrupts-during-kexec-kdump.patch @@ -0,0 +1,48 @@ +From 63d01d0e33dc462642db841383ac6f225f58ed27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 14:42:05 +0800 +Subject: LoongArch: Mask all interrupts during kexec/kdump + +From: Huacai Chen + +[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ] + +If the default state of the interrupt controllers in the first kernel +don't mask any interrupts, it may cause the second kernel to potentially +receive interrupts (which were previously allocated by the first kernel) +immediately after a CPU becomes online during its boot process. These +interrupts cannot be properly routed, leading to bad IRQ issues. + +This patch calls machine_kexec_mask_interrupts() to mask all interrupts +during the kexec/kdump process. + +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/machine_kexec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c +index 30aa420610a06..e50c9a81ff1aa 100644 +--- a/arch/loongarch/kernel/machine_kexec.c ++++ b/arch/loongarch/kernel/machine_kexec.c +@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs) + #ifdef CONFIG_SMP + crash_smp_send_stop(); + #endif ++ machine_kexec_mask_interrupts(); + cpumask_set_cpu(crashing_cpu, &cpus_in_crash); + + pr_info("Starting crashdump kernel...\n"); +@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image) + + /* We do not want to be bothered. */ + local_irq_disable(); ++ machine_kexec_mask_interrupts(); + + pr_notice("EFI boot flag 0x%lx\n", efi_boot); + pr_notice("Command line at 0x%lx\n", cmdline_ptr); +-- +2.51.0 + diff --git a/queue-6.1/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-6.1/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..2d69bc52c3 --- /dev/null +++ b/queue-6.1/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From 0f50a16d1fed08e0bb7bd02f87fdc146de681040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 34fc47c5c65aa..4f92078dc689d 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-6.1/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-6.1/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..46551feb40 --- /dev/null +++ b/queue-6.1/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From c70f3c17dd5ecd4c73fdd4eabf17f71b2ffb05e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index da765a7dedbc4..46311befc81ae 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, + WMID_AC_EVENT = 0x8, +@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-6.1/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-6.1/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..464e3f7df7 --- /dev/null +++ b/queue-6.1/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From a87827a3960e8d906066d629d7ddd7415843f77c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index ae5daecff1771..201e1f2e2c2f0 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-6.1/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-6.1/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..5dfe48de04 --- /dev/null +++ b/queue-6.1/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From a93238837093ee768de9616e4ff14ddf6eb89908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index b3a31a1752..99a9d018a6 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -4,3 +4,18 @@ xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch xfrm-flush-all-states-in-xfrm_state_fini.patch leds-replace-all-non-returning-strlcpy-with-strscpy.patch leds-spi-byte-use-devm_led_classdev_register_ext.patch +ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch +smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch +alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch +loongarch-mask-all-interrupts-during-kexec-kdump.patch +samples-work-around-glibc-redefining-some-of-our-def.patch diff --git a/queue-6.1/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch b/queue-6.1/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch new file mode 100644 index 0000000000..bcea2c18d0 --- /dev/null +++ b/queue-6.1/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch @@ -0,0 +1,38 @@ +From b09a7694af1b8cccb21427df34e2d6fe08326487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 15:05:39 +0800 +Subject: smb: fix invalid username check in smb3_fs_context_parse_param() + +From: Yiqi Sun + +[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ] + +Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) +is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() +is always FALSE and invalid. + +Fix the comparison in if statement. + +Signed-off-by: Yiqi Sun +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index e6d2e4162b081..9000299e98cb4 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -1183,7 +1183,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + break; + } + +- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) > ++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) == + CIFS_MAX_USERNAME_LEN) { + pr_warn("username too long\n"); + goto cifs_parse_mount_err; +-- +2.51.0 + diff --git a/queue-6.1/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-6.1/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..9615aa4632 --- /dev/null +++ b/queue-6.1/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From 3b44054ac061bd9f2504e32443e05fe48bc36755 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 13a6ebef01894..e929a5af38eea 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_disable_dma(struct spi_imx_data *spi_imx) +@@ -689,7 +695,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(tx_wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1449,6 +1454,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(controller->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-6.1/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-6.1/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..9625257d84 --- /dev/null +++ b/queue-6.1/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From f8a9f82cdff71b324c5b85889d7ee24a1da2f2b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index 7377d3b813022..8e2ed8a068ca2 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch b/queue-6.12/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch new file mode 100644 index 0000000000..3decdd57dd --- /dev/null +++ b/queue-6.12/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch @@ -0,0 +1,65 @@ +From 4bb06f09739d439dab9a887ccdfca8d4d245dcad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 13:20:53 +0800 +Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series + +From: Lushih Hsieh + +[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ] + +The PureAudio APA DAC and Lotus DAC5 series are USB Audio +2.0 Class devices that support native Direct Stream Digital (DSD) +playback via specific vendor protocols. + +Without these quirks, the devices may only function in standard +PCM mode, or fail to correctly report their DSD format capabilities +to the ALSA framework, preventing native DSD playback under Linux. + +This commit adds new quirk entries for the mentioned DAC models +based on their respective Vendor/Product IDs (VID:PID), for example: +0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. + +The quirk ensures correct DSD format handling by setting the required +SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific +Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA +DSD API to correctly address the device for high-bitrate DSD streams, +bypassing the need for DoP (DSD over PCM). + +Test on APA DAC and Lotus DAC5 SE under Arch Linux. + +Tested-by: Lushih Hsieh +Signed-off-by: Lushih Hsieh +Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 5ebd4670b4a06..a74bb3a2f9e03 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2022,6 +2022,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ + case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */ ++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ + case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ +@@ -2289,6 +2291,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ + QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */ + QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ +-- +2.51.0 + diff --git a/queue-6.12/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-6.12/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..34d610ee0d --- /dev/null +++ b/queue-6.12/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From a822ed737fe9906dbcd5861d3c55414bf2df9fad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index db81570c96375..ecf7f74779c6a 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-6.12/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch b/queue-6.12/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch new file mode 100644 index 0000000000..e932a929cd --- /dev/null +++ b/queue-6.12/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch @@ -0,0 +1,117 @@ +From 47cf1b579261c19c923d2a503f26c9fd17be030d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Nov 2025 20:02:04 +0800 +Subject: Bluetooth: btrtl: Avoid loading the config file on security chips + +From: Max Chou + +[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ] + +For chips with security enabled, it's only possible to load firmware +with a valid signature pattern. +If key_id is not zero, it indicates a security chip, and the driver will +not load the config file. + +- Example log for a security chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 1 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +- Example log for a normal chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 0 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin +Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +Tested-by: Hilda Wu +Signed-off-by: Nial Ni +Signed-off-by: Max Chou +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btrtl.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index c4431c5976b40..5e332b30696f6 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -50,7 +50,7 @@ + + #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}}) + #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) +-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) ++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}}) + + #define RTL_PATCH_SNIPPETS 0x01 + #define RTL_PATCH_DUMMY_HEADER 0x02 +@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + { + struct rtl_epatch_header_v2 *hdr; + int rc; +- u8 reg_val[2]; + u8 key_id; + u32 num_sections; + struct rtl_section *section; +@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + .len = btrtl_dev->fw_len - 7, /* Cut the tail */ + }; + +- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); +- if (rc < 0) +- return -EIO; +- key_id = reg_val[0]; +- +- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id); +- +- btrtl_dev->key_id = key_id; ++ key_id = btrtl_dev->key_id; + + hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); + if (!hdr) +@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + u16 hci_rev, lmp_subver; + u8 hci_ver, lmp_ver, chip_type = 0; + int ret; ++ int rc; ++ u8 key_id; + u8 reg_val[2]; + + btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL); +@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + ++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); ++ if (rc < 0) ++ goto err_free; ++ ++ key_id = reg_val[0]; ++ btrtl_dev->key_id = key_id; ++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id); ++ + btrtl_dev->fw_len = -EIO; + if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) { + snprintf(fw_name, sizeof(fw_name), "%s_v2.bin", +@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + +- if (btrtl_dev->ic_info->cfg_name) { ++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) { + if (postfix) { + snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin", + btrtl_dev->ic_info->cfg_name, postfix); +-- +2.51.0 + diff --git a/queue-6.12/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-6.12/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..39055051f4 --- /dev/null +++ b/queue-6.12/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From 9aeb742f7c35afc0e97bc1ede3ce1523f745ff99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 22b9099927fad..803f64e169c59 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -74,7 +74,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + #ifdef CONFIG_DMA_API_DEBUG + void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr); +-- +2.51.0 + diff --git a/queue-6.12/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch b/queue-6.12/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch new file mode 100644 index 0000000000..f7132c45fe --- /dev/null +++ b/queue-6.12/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch @@ -0,0 +1,56 @@ +From a0afd9f96da8ce0e4f632e090e4fe54f178b4f05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 14:37:07 -0400 +Subject: drm/amdkfd: Fix GPU mappings for APU after prefetch + +From: Harish Kasiviswanathan + +[ Upstream commit eac32ff42393efa6657efc821231b8d802c1d485 ] + +Fix the following corner case:- + Consider a 2M huge page SVM allocation, followed by prefetch call for +the first 4K page. The whole range is initially mapped with single PTE. +After the prefetch, this range gets split to first page + rest of the +pages. Currently, the first page mapping is not updated on MI300A (APU) +since page hasn't migrated. However, after range split PTE mapping it not +valid. + +Fix this by forcing page table update for the whole range when prefetch +is called. Calling prefetch on APU doesn't improve performance. If all +it deteriotes. However, functionality has to be supported. + +v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout +VRAM + +v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU + +v4: Remove v2 and v3 changes. Force update_mapping when range is split +at a size that is not aligned to prange granularity + +Suggested-by: Philip Yang +Signed-off-by: Harish Kasiviswanathan +Reviewed-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 0d950a20741d8..99ce4fe5eb170 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3675,6 +3675,8 @@ svm_range_set_attr(struct kfd_process *p, struct mm_struct *mm, + svm_range_apply_attrs(p, prange, nattr, attrs, &update_mapping); + /* TODO: unmap ranges from GPU that lost access */ + } ++ update_mapping |= !p->xnack_enabled && !list_empty(&remap_list); ++ + list_for_each_entry_safe(prange, next, &remove_list, update_list) { + pr_debug("unlink old 0x%p prange 0x%p [0x%lx 0x%lx]\n", + prange->svms, prange, prange->start, +-- +2.51.0 + diff --git a/queue-6.12/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch b/queue-6.12/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch new file mode 100644 index 0000000000..7f2b726d69 --- /dev/null +++ b/queue-6.12/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch @@ -0,0 +1,82 @@ +From 0efa6b657cc441f76fdf6d4faa9631659541977d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:36:40 -0500 +Subject: drm/vmwgfx: Use kref in vmw_bo_dirty + +From: Ian Forbes + +[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ] + +Rather than using an ad hoc reference count use kref which is atomic +and has underflow warnings. + +Signed-off-by: Ian Forbes +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +index 74ff2812d66a1..de2498749e276 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +@@ -51,22 +51,22 @@ enum vmw_bo_dirty_method { + + /** + * struct vmw_bo_dirty - Dirty information for buffer objects ++ * @ref_count: Reference count for this structure. Must be first member! + * @start: First currently dirty bit + * @end: Last currently dirty bit + 1 + * @method: The currently used dirty method + * @change_count: Number of consecutive method change triggers +- * @ref_count: Reference count for this structure + * @bitmap_size: The size of the bitmap in bits. Typically equal to the + * nuber of pages in the bo. + * @bitmap: A bitmap where each bit represents a page. A set bit means a + * dirty page. + */ + struct vmw_bo_dirty { ++ struct kref ref_count; + unsigned long start; + unsigned long end; + enum vmw_bo_dirty_method method; + unsigned int change_count; +- unsigned int ref_count; + unsigned long bitmap_size; + unsigned long bitmap[]; + }; +@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + int ret; + + if (dirty) { +- dirty->ref_count++; ++ kref_get(&dirty->ref_count); + return 0; + } + +@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + dirty->bitmap_size = num_pages; + dirty->start = dirty->bitmap_size; + dirty->end = 0; +- dirty->ref_count = 1; ++ kref_init(&dirty->ref_count); + if (num_pages < PAGE_SIZE / sizeof(pte_t)) { + dirty->method = VMW_BO_DIRTY_PAGETABLE; + } else { +@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo) + { + struct vmw_bo_dirty *dirty = vbo->dirty; + +- if (dirty && --dirty->ref_count == 0) { +- kvfree(dirty); ++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree)) + vbo->dirty = NULL; +- } + } + + /** +-- +2.51.0 + diff --git a/queue-6.12/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch b/queue-6.12/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch new file mode 100644 index 0000000000..d62cb306b4 --- /dev/null +++ b/queue-6.12/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch @@ -0,0 +1,156 @@ +From 828cc6365285ec3517b4642357aaaa0db78267ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:50:22 -0700 +Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() + +From: Song Liu + +[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ] + +ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on +the same kernel function. When needed, ftrace_hash_ipmodify_enable() +calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to +share the same function as the IPMODIFY ftrace (livepatch). + +ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, +but not called in modify_ftrace_direct() path. As a result, the following +operations will break livepatch: + +1. Load livepatch to a kernel function; +2. Attach fentry program to the kernel function; +3. Attach fexit program to the kernel function. + +After 3, the kernel function being used will not be the livepatched +version, but the original version. + +Fix this by adding __ftrace_hash_update_ipmodify() to +__modify_ftrace_direct() and adjust some logic around the call. + +Signed-off-by: Song Liu +Reviewed-by: Jiri Olsa +Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org +Signed-off-by: Alexei Starovoitov +Acked-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 1f61b36bc4803..b2442aabccfd0 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1969,7 +1969,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops) + */ + static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + struct ftrace_hash *old_hash, +- struct ftrace_hash *new_hash) ++ struct ftrace_hash *new_hash, ++ bool update_target) + { + struct ftrace_page *pg; + struct dyn_ftrace *rec, *end = NULL; +@@ -2004,10 +2005,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (rec->flags & FTRACE_FL_DISABLED) + continue; + +- /* We need to update only differences of filter_hash */ ++ /* ++ * Unless we are updating the target of a direct function, ++ * we only need to update differences of filter_hash ++ */ + in_old = !!ftrace_lookup_ip(old_hash, rec->ip); + in_new = !!ftrace_lookup_ip(new_hash, rec->ip); +- if (in_old == in_new) ++ if (!update_target && (in_old == in_new)) + continue; + + if (in_new) { +@@ -2018,7 +2022,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (is_ipmodify) + goto rollback; + +- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT); ++ /* ++ * If this is called by __modify_ftrace_direct() ++ * then it is only changing where the direct ++ * pointer is jumping to, and the record already ++ * points to a direct trampoline. If it isn't, ++ * then it is a bug to update ipmodify on a direct ++ * caller. ++ */ ++ FTRACE_WARN_ON(!update_target && ++ (rec->flags & FTRACE_FL_DIRECT)); + + /* + * Another ops with IPMODIFY is already +@@ -2075,7 +2088,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash); ++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false); + } + + /* Disabling always succeeds */ +@@ -2086,7 +2099,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH); ++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false); + } + + static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, +@@ -2100,7 +2113,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, + if (ftrace_hash_empty(new_hash)) + new_hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash); ++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false); + } + + static void print_ip_ins(const char *fmt, const unsigned char *p) +@@ -6055,7 +6068,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct); + static int + __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + { +- struct ftrace_hash *hash; ++ struct ftrace_hash *hash = ops->func_hash->filter_hash; + struct ftrace_func_entry *entry, *iter; + static struct ftrace_ops tmp_ops = { + .func = ftrace_stub, +@@ -6075,13 +6088,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + if (err) + return err; + ++ /* ++ * Call __ftrace_hash_update_ipmodify() here, so that we can call ++ * ops->ops_func for the ops. This is needed because the above ++ * register_ftrace_function_nolock() worked on tmp_ops. ++ */ ++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true); ++ if (err) ++ goto out; ++ + /* + * Now the ftrace_ops_list_func() is called to do the direct callers. + * We can safely change the direct functions attached to each entry. + */ + mutex_lock(&ftrace_lock); + +- hash = ops->func_hash->filter_hash; + size = 1 << hash->size_bits; + for (i = 0; i < size; i++) { + hlist_for_each_entry(iter, &hash->buckets[i], hlist) { +@@ -6096,6 +6117,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + + mutex_unlock(&ftrace_lock); + ++out: + /* Removing the tmp_ops will add the updated direct callers to the functions */ + unregister_ftrace_function(&tmp_ops); + +-- +2.51.0 + diff --git a/queue-6.12/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch b/queue-6.12/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch new file mode 100644 index 0000000000..ab078a7e75 --- /dev/null +++ b/queue-6.12/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch @@ -0,0 +1,35 @@ +From d31719a0f80bcbd27d92062721afb7367d1a8b92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:37:26 +0800 +Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list + +From: April Grimoire + +[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ] + +SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, +rendering function keys not treated properly. Despite being a +SONiX USB DEVICE, it uses a different name, so adding it to the list. + +Signed-off-by: April Grimoire +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 25d1edb6a2107..a0f79803df3bd 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { + { "SONiX USB DEVICE" }, ++ { "SONiX AK870 PRO" }, + { "Keychron" }, + { "AONE" }, + { "GANSS" }, +-- +2.51.0 + diff --git a/queue-6.12/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch b/queue-6.12/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch new file mode 100644 index 0000000000..26783ddfba --- /dev/null +++ b/queue-6.12/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch @@ -0,0 +1,80 @@ +From 872be643da534aa340486b83ac2a77d508c6b155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 21:16:45 +0900 +Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F) + +From: Naoki Ueki + +[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ] + +The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which +shares the same report descriptor as the existing device (0x00FB). However, +the driver does not currently recognize this new ID, resulting in only five +buttons being functional. + +This patch adds the new device ID so that all six buttons work properly. + +Signed-off-by: Naoki Ueki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 6 ++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index defcf91fdd14b..b57b6deb36f42 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -75,7 +75,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8); + break; +- case USB_DEVICE_ID_ELECOM_M_XT3URBK: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F: + case USB_DEVICE_ID_ELECOM_M_XT3DRBK: + case USB_DEVICE_ID_ELECOM_M_XT4DRBK: + /* +@@ -117,7 +118,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index a85027fbf726a..e0ac6dc07da09 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -445,7 +445,8 @@ + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 + #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 +-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f + #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc + #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index fa946666969b8..2da21415e676c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -405,7 +405,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +-- +2.51.0 + diff --git a/queue-6.12/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch b/queue-6.12/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch new file mode 100644 index 0000000000..92eef42e59 --- /dev/null +++ b/queue-6.12/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch @@ -0,0 +1,46 @@ +From a6ddd804052d45d779e24c77d3eb4a8326e569b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:06:25 -0500 +Subject: HID: hid-input: Extend Elan ignore battery quirk to USB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello (AMD) + +[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ] + +USB Elan devices have the same problem as the I2C ones with a fake +battery device showing up. + +Reviewed-by: Hans de Goede +Reported-by: André Barata +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722 +Signed-off-by: Mario Limonciello (AMD) +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f073d5621050a..fa3efe9701c96 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), + HID_BATTERY_QUIRK_AVOID_QUERY }, + /* +- * Elan I2C-HID touchscreens seem to all report a non present battery, +- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices. ++ * Elan HID touchscreens seem to all report a non present battery, ++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices. + */ + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.12/loongarch-mask-all-interrupts-during-kexec-kdump.patch b/queue-6.12/loongarch-mask-all-interrupts-during-kexec-kdump.patch new file mode 100644 index 0000000000..b328bfd7dd --- /dev/null +++ b/queue-6.12/loongarch-mask-all-interrupts-during-kexec-kdump.patch @@ -0,0 +1,48 @@ +From 1740bb43c3ad0f50e670951d1535047cf6613189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 14:42:05 +0800 +Subject: LoongArch: Mask all interrupts during kexec/kdump + +From: Huacai Chen + +[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ] + +If the default state of the interrupt controllers in the first kernel +don't mask any interrupts, it may cause the second kernel to potentially +receive interrupts (which were previously allocated by the first kernel) +immediately after a CPU becomes online during its boot process. These +interrupts cannot be properly routed, leading to bad IRQ issues. + +This patch calls machine_kexec_mask_interrupts() to mask all interrupts +during the kexec/kdump process. + +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/machine_kexec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c +index f9381800e291c..8ef4e4595d61a 100644 +--- a/arch/loongarch/kernel/machine_kexec.c ++++ b/arch/loongarch/kernel/machine_kexec.c +@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs) + #ifdef CONFIG_SMP + crash_smp_send_stop(); + #endif ++ machine_kexec_mask_interrupts(); + cpumask_set_cpu(crashing_cpu, &cpus_in_crash); + + pr_info("Starting crashdump kernel...\n"); +@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image) + + /* We do not want to be bothered. */ + local_irq_disable(); ++ machine_kexec_mask_interrupts(); + + pr_notice("EFI boot flag 0x%lx\n", efi_boot); + pr_notice("Command line at 0x%lx\n", cmdline_ptr); +-- +2.51.0 + diff --git a/queue-6.12/nvme-fix-admin-request_queue-lifetime.patch b/queue-6.12/nvme-fix-admin-request_queue-lifetime.patch new file mode 100644 index 0000000000..18229594c4 --- /dev/null +++ b/queue-6.12/nvme-fix-admin-request_queue-lifetime.patch @@ -0,0 +1,98 @@ +From fda0b29e2d3681b92570788f00ae323058a3948f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:48:30 -0800 +Subject: nvme: fix admin request_queue lifetime + +From: Keith Busch + +[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ] + +The namespaces can access the controller's admin request_queue, and +stale references on the namespaces may exist after tearing down the +controller. Ensure the admin request_queue is active by moving the +controller's 'put' to after all controller references have been released +to ensure no one is can access the request_queue. This fixes a reported +use-after-free bug: + + BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 + Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 + CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 + Tainted: [E]=UNSIGNED_MODULE + Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 + Call Trace: + + dump_stack_lvl+0x4f/0x60 + print_report+0xc4/0x620 + ? _raw_spin_lock_irqsave+0x70/0xb0 + ? _raw_read_unlock_irqrestore+0x30/0x30 + ? blk_queue_enter+0x41c/0x4a0 + kasan_report+0xab/0xe0 + ? blk_queue_enter+0x41c/0x4a0 + blk_queue_enter+0x41c/0x4a0 + ? __irq_work_queue_local+0x75/0x1d0 + ? blk_queue_start_drain+0x70/0x70 + ? irq_work_queue+0x18/0x20 + ? vprintk_emit.part.0+0x1cc/0x350 + ? wake_up_klogd_work_func+0x60/0x60 + blk_mq_alloc_request+0x2b7/0x6b0 + ? __blk_mq_alloc_requests+0x1060/0x1060 + ? __switch_to+0x5b7/0x1060 + nvme_submit_user_cmd+0xa9/0x330 + nvme_user_cmd.isra.0+0x240/0x3f0 + ? force_sigsegv+0xe0/0xe0 + ? nvme_user_cmd64+0x400/0x400 + ? vfs_fileattr_set+0x9b0/0x9b0 + ? cgroup_update_frozen_flag+0x24/0x1c0 + ? cgroup_leave_frozen+0x204/0x330 + ? nvme_ioctl+0x7c/0x2c0 + blkdev_ioctl+0x1a8/0x4d0 + ? blkdev_common_ioctl+0x1930/0x1930 + ? fdget+0x54/0x380 + __x64_sys_ioctl+0x129/0x190 + do_syscall_64+0x5b/0x160 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + RIP: 0033:0x7f765f703b0b + Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b + RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 + R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 + R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 + + +Reported-by: Casey Chen +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Reviewed-by: Ming Lei +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index a3b9f8ea235f7..a766290b1ee89 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4645,7 +4645,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl) + */ + nvme_stop_keep_alive(ctrl); + blk_mq_destroy_queue(ctrl->admin_q); +- blk_put_queue(ctrl->admin_q); + if (ctrl->ops->flags & NVME_F_FABRICS) { + blk_mq_destroy_queue(ctrl->fabrics_q); + blk_put_queue(ctrl->fabrics_q); +@@ -4790,6 +4789,8 @@ static void nvme_free_ctrl(struct device *dev) + container_of(dev, struct nvme_ctrl, ctrl_device); + struct nvme_subsystem *subsys = ctrl->subsys; + ++ if (ctrl->admin_q) ++ blk_put_queue(ctrl->admin_q); + if (!subsys || ctrl->instance != subsys->instance) + ida_free(&nvme_instance_ida, ctrl->instance); + nvme_free_cels(ctrl); +-- +2.51.0 + diff --git a/queue-6.12/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-6.12/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..4beb9f4c75 --- /dev/null +++ b/queue-6.12/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From 0de476e77afafb9fde5f69a9b12790477fe81051 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 5532328097894..27eb585bf42df 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-6.12/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..204b88890d --- /dev/null +++ b/queue-6.12/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From 542672df9e481b149aaf6f09d04c71e8db7ce337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index c5679e4a58a76..d7602962b3cad 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -93,6 +93,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, + WMID_AC_EVENT = 0x8, +@@ -2317,6 +2318,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch b/queue-6.12/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch new file mode 100644 index 0000000000..22882cdb48 --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch @@ -0,0 +1,60 @@ +From aea9ea381b33a1f5375f61a86c0e33c7bdc8d16d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:50:57 +0200 +Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ] + +The Lenovo Legion Go 2 takes a long time to resume from suspend. +This is due to it having an nvme resume handler that interferes +with IOMMU mappings. It is a common issue with older Lenovo +laptops. Adding it to that quirk list fixes this issue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618 +Suggested-by: Mario Limonciello +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 9fd2829ee2ab4..271cbeaa59af3 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -198,6 +198,23 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), + } + }, ++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */ ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"), ++ } ++ }, ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"), ++ } ++ }, + /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ + { + .ident = "HP Laptop 15s-eq2xxx", +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch b/queue-6.12/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch new file mode 100644 index 0000000000..67886073c2 --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch @@ -0,0 +1,54 @@ +From d422f0123d721984b705d4a418d6dab3feb7a86e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 17:21:51 +0200 +Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ] + +The Xbox Ally features a Van Gogh SoC that has spurious interrupts +during resume. We get the following logs: + +atkbd_receive_byte: 20 callbacks suppressed +atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly. + +So, add the spurious_8042 quirk for it. It does not have a keyboard, so +this does not result in any functional loss. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 271cbeaa59af3..a5031339dac8c 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -116,6 +116,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), + } + }, ++ { ++ .ident = "ROG Xbox Ally RC73YA", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */ + { + .ident = "V14 G4 AMN", +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-6.12/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..c5b74a75f6 --- /dev/null +++ b/queue-6.12/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From d451b35997f798f22b76b5bca158dde4af899cf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index d81fd5df4a000..d7a6111b2fe13 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-6.12/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-6.12/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..fdcf2f3de4 --- /dev/null +++ b/queue-6.12/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From c7345be42d8e36e791fc53708a4f5c6fd9e79d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 7c20dd9fee..cc7af1a775 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -2,3 +2,24 @@ xfrm-delete-x-tunnel-as-we-delete-x.patch revert-xfrm-destroy-xfrm_state-synchronously-on-net-.patch xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch xfrm-flush-all-states-in-xfrm_state_fini.patch +ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch +bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch +smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch +drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch +alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch +nvme-fix-admin-request_queue-lifetime.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch +platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch +hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch +loongarch-mask-all-interrupts-during-kexec-kdump.patch +samples-work-around-glibc-redefining-some-of-our-def.patch diff --git a/queue-6.12/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch b/queue-6.12/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch new file mode 100644 index 0000000000..3af4a0e962 --- /dev/null +++ b/queue-6.12/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch @@ -0,0 +1,38 @@ +From 7619d8e6319b6c81d81476b2302a4fce96115ad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 15:05:39 +0800 +Subject: smb: fix invalid username check in smb3_fs_context_parse_param() + +From: Yiqi Sun + +[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ] + +Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) +is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() +is always FALSE and invalid. + +Fix the comparison in if statement. + +Signed-off-by: Yiqi Sun +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index 9a4492106c25f..17133adfe798b 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -1415,7 +1415,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + break; + } + +- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) > ++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) == + CIFS_MAX_USERNAME_LEN) { + pr_warn("username too long\n"); + goto cifs_parse_mount_err; +-- +2.51.0 + diff --git a/queue-6.12/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-6.12/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..4dc08b4526 --- /dev/null +++ b/queue-6.12/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From 22896868c6f1397f45d1f162b6efdf08e1823e58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 810541eed213e..94d0f7695d07a 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_ecspi_disable(struct spi_imx_data *spi_imx) +@@ -699,7 +705,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(tx_wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1458,6 +1463,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(controller->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-6.12/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-6.12/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..f1dec33d4b --- /dev/null +++ b/queue-6.12/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From 639e37c79757d72462a7de03fd6cde312f790f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index 7795328427a68..f5e41813b9582 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -299,7 +299,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 + diff --git a/queue-6.17/acpi-mrrm-fix-memory-leaks-and-improve-error-handlin.patch b/queue-6.17/acpi-mrrm-fix-memory-leaks-and-improve-error-handlin.patch new file mode 100644 index 0000000000..53cd10f599 --- /dev/null +++ b/queue-6.17/acpi-mrrm-fix-memory-leaks-and-improve-error-handlin.patch @@ -0,0 +1,94 @@ +From 1495e12945b59eb6b58e28f902ca945278511b86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 08:02:28 +0530 +Subject: ACPI: MRRM: Fix memory leaks and improve error handling + +From: Kaushlendra Kumar + +[ Upstream commit 4b93d211bbffd3dce76664d95f2306d23e7215ce ] + +Add proper error handling and resource cleanup to prevent memory leaks +in add_boot_memory_ranges(). The function now checks for NULL return +from kobject_create_and_add(), uses local buffer for range names to +avoid dynamic allocation, and implements a cleanup path that removes +previously created sysfs groups and kobjects on failure. + +This prevents resource leaks when kobject creation or sysfs group +creation fails during boot memory range initialization. + +Signed-off-by: Kaushlendra Kumar +Reviewed-by: Tony Luck +Link: https://patch.msgid.link/20251030023228.3956296-1-kaushlendra.kumar@intel.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_mrrm.c | 43 ++++++++++++++++++++++++++++++---------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/drivers/acpi/acpi_mrrm.c b/drivers/acpi/acpi_mrrm.c +index a6dbf623e5571..6d69554c940ed 100644 +--- a/drivers/acpi/acpi_mrrm.c ++++ b/drivers/acpi/acpi_mrrm.c +@@ -152,26 +152,49 @@ ATTRIBUTE_GROUPS(memory_range); + + static __init int add_boot_memory_ranges(void) + { +- struct kobject *pkobj, *kobj; ++ struct kobject *pkobj, *kobj, **kobjs; + int ret = -EINVAL; +- char *name; ++ char name[16]; ++ int i; + + pkobj = kobject_create_and_add("memory_ranges", acpi_kobj); ++ if (!pkobj) ++ return -ENOMEM; + +- for (int i = 0; i < mrrm_mem_entry_num; i++) { +- name = kasprintf(GFP_KERNEL, "range%d", i); +- if (!name) { +- ret = -ENOMEM; +- break; +- } ++ kobjs = kcalloc(mrrm_mem_entry_num, sizeof(*kobjs), GFP_KERNEL); ++ if (!kobjs) { ++ kobject_put(pkobj); ++ return -ENOMEM; ++ } + ++ for (i = 0; i < mrrm_mem_entry_num; i++) { ++ scnprintf(name, sizeof(name), "range%d", i); + kobj = kobject_create_and_add(name, pkobj); ++ if (!kobj) { ++ ret = -ENOMEM; ++ goto cleanup; ++ } + + ret = sysfs_create_groups(kobj, memory_range_groups); +- if (ret) +- return ret; ++ if (ret) { ++ kobject_put(kobj); ++ goto cleanup; ++ } ++ kobjs[i] = kobj; + } + ++ kfree(kobjs); ++ return 0; ++ ++cleanup: ++ for (int j = 0; j < i; j++) { ++ if (kobjs[j]) { ++ sysfs_remove_groups(kobjs[j], memory_range_groups); ++ kobject_put(kobjs[j]); ++ } ++ } ++ kfree(kobjs); ++ kobject_put(pkobj); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.17/alsa-hda-tas2781-add-new-quirk-for-hp-new-projects.patch b/queue-6.17/alsa-hda-tas2781-add-new-quirk-for-hp-new-projects.patch new file mode 100644 index 0000000000..76a7cb1124 --- /dev/null +++ b/queue-6.17/alsa-hda-tas2781-add-new-quirk-for-hp-new-projects.patch @@ -0,0 +1,42 @@ +From 647b0a96c040bb8937b6b3cef163aa74495fc094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Nov 2025 22:23:25 +0800 +Subject: ALSA: hda/tas2781: Add new quirk for HP new projects + +From: Baojun Xu + +[ Upstream commit 7a39c723b7472b8aaa2e0a67d2b6c7cf1c45cafb ] + +Add new vendor_id and subsystem_id in quirk for HP new projects. + +Signed-off-by: Baojun Xu +Link: https://patch.msgid.link/20251108142325.2563-1-baojun.xu@ti.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 796f555dd381d..5e0c0f1e231b8 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -6685,6 +6685,15 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8e60, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8e61, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8e62, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x103c, 0x8ed5, "HP Merino13X", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8ed6, "HP Merino13", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8ed7, "HP Merino14", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8ed8, "HP Merino16", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8ed9, "HP Merino14W", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8eda, "HP Merino16W", ALC245_FIXUP_TAS2781_SPI_2), ++ SND_PCI_QUIRK(0x103c, 0x8f40, "HP Lampas14", ALC287_FIXUP_TAS2781_I2C), ++ SND_PCI_QUIRK(0x103c, 0x8f41, "HP Lampas16", ALC287_FIXUP_TAS2781_I2C), ++ SND_PCI_QUIRK(0x103c, 0x8f42, "HP LampasW14", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x1043, 0x1032, "ASUS VivoBook X513EA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1034, "ASUS GU605C", ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), +-- +2.51.0 + diff --git a/queue-6.17/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch b/queue-6.17/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch new file mode 100644 index 0000000000..2f739218dc --- /dev/null +++ b/queue-6.17/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch @@ -0,0 +1,65 @@ +From 2aa2722ad15c67efe96e2413fa8f829bf98f2cf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 13:20:53 +0800 +Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series + +From: Lushih Hsieh + +[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ] + +The PureAudio APA DAC and Lotus DAC5 series are USB Audio +2.0 Class devices that support native Direct Stream Digital (DSD) +playback via specific vendor protocols. + +Without these quirks, the devices may only function in standard +PCM mode, or fail to correctly report their DSD format capabilities +to the ALSA framework, preventing native DSD playback under Linux. + +This commit adds new quirk entries for the mentioned DAC models +based on their respective Vendor/Product IDs (VID:PID), for example: +0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. + +The quirk ensures correct DSD format handling by setting the required +SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific +Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA +DSD API to correctly address the device for high-bitrate DSD streams, +bypassing the need for DoP (DSD over PCM). + +Test on APA DAC and Lotus DAC5 SE under Arch Linux. + +Tested-by: Lushih Hsieh +Signed-off-by: Lushih Hsieh +Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index b04f52adb1f48..70f9e0cc28fac 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2022,6 +2022,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ + case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */ ++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ + case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ +@@ -2289,6 +2291,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ + QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */ + QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ +-- +2.51.0 + diff --git a/queue-6.17/arm64-reject-modules-with-internal-alternative-callb.patch b/queue-6.17/arm64-reject-modules-with-internal-alternative-callb.patch new file mode 100644 index 0000000000..4a8d34da56 --- /dev/null +++ b/queue-6.17/arm64-reject-modules-with-internal-alternative-callb.patch @@ -0,0 +1,132 @@ +From ec61551b9c19afcc1b086acf76b175c515a4b20b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Sep 2025 13:04:27 +0000 +Subject: arm64: Reject modules with internal alternative callbacks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Adrian Barnaś + +[ Upstream commit 8e8ae788964aa2573b4335026db4068540fa6a86 ] + +During module loading, check if a callback function used by the +alternatives specified in the '.altinstruction' ELF section (if present) +is located in core kernel .text. If not fail module loading before +callback is called. + +Reported-by: Fanqin Cui +Closes: https://lore.kernel.org/all/20250807072700.348514-1-fanqincui@163.com/ +Signed-off-by: Adrian Barnaś +Reviewed-by: Ard Biesheuvel +[will: Folded in 'noinstr' tweak from Mark] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/alternative.h | 7 +++++-- + arch/arm64/kernel/alternative.c | 19 ++++++++++++------- + arch/arm64/kernel/module.c | 9 +++++++-- + 3 files changed, 24 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h +index 00d97b8a757f4..51746005239bc 100644 +--- a/arch/arm64/include/asm/alternative.h ++++ b/arch/arm64/include/asm/alternative.h +@@ -26,9 +26,12 @@ void __init apply_alternatives_all(void); + bool alternative_is_applied(u16 cpucap); + + #ifdef CONFIG_MODULES +-void apply_alternatives_module(void *start, size_t length); ++int apply_alternatives_module(void *start, size_t length); + #else +-static inline void apply_alternatives_module(void *start, size_t length) { } ++static inline int apply_alternatives_module(void *start, size_t length) ++{ ++ return 0; ++} + #endif + + void alt_cb_patch_nops(struct alt_instr *alt, __le32 *origptr, +diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c +index 8ff6610af4966..f5ec7e7c1d3fd 100644 +--- a/arch/arm64/kernel/alternative.c ++++ b/arch/arm64/kernel/alternative.c +@@ -139,9 +139,9 @@ static noinstr void clean_dcache_range_nopatch(u64 start, u64 end) + } while (cur += d_size, cur < end); + } + +-static void __apply_alternatives(const struct alt_region *region, +- bool is_module, +- unsigned long *cpucap_mask) ++static int __apply_alternatives(const struct alt_region *region, ++ bool is_module, ++ unsigned long *cpucap_mask) + { + struct alt_instr *alt; + __le32 *origptr, *updptr; +@@ -166,10 +166,13 @@ static void __apply_alternatives(const struct alt_region *region, + updptr = is_module ? origptr : lm_alias(origptr); + nr_inst = alt->orig_len / AARCH64_INSN_SIZE; + +- if (ALT_HAS_CB(alt)) ++ if (ALT_HAS_CB(alt)) { + alt_cb = ALT_REPL_PTR(alt); +- else ++ if (is_module && !core_kernel_text((unsigned long)alt_cb)) ++ return -ENOEXEC; ++ } else { + alt_cb = patch_alternative; ++ } + + alt_cb(alt, origptr, updptr, nr_inst); + +@@ -193,6 +196,8 @@ static void __apply_alternatives(const struct alt_region *region, + bitmap_and(applied_alternatives, applied_alternatives, + system_cpucaps, ARM64_NCAPS); + } ++ ++ return 0; + } + + static void __init apply_alternatives_vdso(void) +@@ -277,7 +282,7 @@ void __init apply_boot_alternatives(void) + } + + #ifdef CONFIG_MODULES +-void apply_alternatives_module(void *start, size_t length) ++int apply_alternatives_module(void *start, size_t length) + { + struct alt_region region = { + .begin = start, +@@ -287,7 +292,7 @@ void apply_alternatives_module(void *start, size_t length) + + bitmap_fill(all_capabilities, ARM64_NCAPS); + +- __apply_alternatives(®ion, true, &all_capabilities[0]); ++ return __apply_alternatives(®ion, true, &all_capabilities[0]); + } + #endif + +diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c +index d6d443c4a01ac..0b15c57285add 100644 +--- a/arch/arm64/kernel/module.c ++++ b/arch/arm64/kernel/module.c +@@ -489,8 +489,13 @@ int module_finalize(const Elf_Ehdr *hdr, + int ret; + + s = find_section(hdr, sechdrs, ".altinstructions"); +- if (s) +- apply_alternatives_module((void *)s->sh_addr, s->sh_size); ++ if (s) { ++ ret = apply_alternatives_module((void *)s->sh_addr, s->sh_size); ++ if (ret < 0) { ++ pr_err("module %s: error occurred when applying alternatives\n", me->name); ++ return ret; ++ } ++ } + + if (scs_is_dynamic()) { + s = find_section(hdr, sechdrs, ".init.eh_frame"); +-- +2.51.0 + diff --git a/queue-6.17/asoc-sdca-bug-fix-while-parsing-mipi-sdca-control-cn.patch b/queue-6.17/asoc-sdca-bug-fix-while-parsing-mipi-sdca-control-cn.patch new file mode 100644 index 0000000000..60f8041bd3 --- /dev/null +++ b/queue-6.17/asoc-sdca-bug-fix-while-parsing-mipi-sdca-control-cn.patch @@ -0,0 +1,40 @@ +From e60845265cb8d991d04da73613ddfadd9f5d8c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 20:56:46 +0530 +Subject: ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list + +From: Niranjan H Y + +[ Upstream commit eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 ] + +"struct sdca_control" declares "values" field as integer array. +But the memory allocated to it is of char array. This causes +crash for sdca_parse_function API. This patch addresses the +issue by allocating correct data size. + +Signed-off-by: Niranjan H Y +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20251110152646.192-1-niranjan.hy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sdca/sdca_functions.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c +index 13f68f7b6dd6a..0ccb6775f4de3 100644 +--- a/sound/soc/sdca/sdca_functions.c ++++ b/sound/soc/sdca/sdca_functions.c +@@ -894,7 +894,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti + return ret; + } + +- control->values = devm_kzalloc(dev, hweight64(control->cn_list), GFP_KERNEL); ++ control->values = devm_kcalloc(dev, hweight64(control->cn_list), ++ sizeof(int), GFP_KERNEL); + if (!control->values) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.17/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-6.17/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..0cf9167122 --- /dev/null +++ b/queue-6.17/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From 804085541932045c013892daddcaa12d10624d7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index 1d41ce477df58..984b365df0460 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -61,7 +61,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -71,6 +83,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-6.17/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch b/queue-6.17/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch new file mode 100644 index 0000000000..212e2b21de --- /dev/null +++ b/queue-6.17/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch @@ -0,0 +1,117 @@ +From 1d239a2dade4e6dc98453f59245afb84ce5f0a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Nov 2025 20:02:04 +0800 +Subject: Bluetooth: btrtl: Avoid loading the config file on security chips + +From: Max Chou + +[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ] + +For chips with security enabled, it's only possible to load firmware +with a valid signature pattern. +If key_id is not zero, it indicates a security chip, and the driver will +not load the config file. + +- Example log for a security chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 1 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +- Example log for a normal chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 0 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin +Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +Tested-by: Hilda Wu +Signed-off-by: Nial Ni +Signed-off-by: Max Chou +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btrtl.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index 1d4a7887abccf..52794db2739bf 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -50,7 +50,7 @@ + + #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}}) + #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) +-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) ++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}}) + + #define RTL_PATCH_SNIPPETS 0x01 + #define RTL_PATCH_DUMMY_HEADER 0x02 +@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + { + struct rtl_epatch_header_v2 *hdr; + int rc; +- u8 reg_val[2]; + u8 key_id; + u32 num_sections; + struct rtl_section *section; +@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + .len = btrtl_dev->fw_len - 7, /* Cut the tail */ + }; + +- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); +- if (rc < 0) +- return -EIO; +- key_id = reg_val[0]; +- +- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id); +- +- btrtl_dev->key_id = key_id; ++ key_id = btrtl_dev->key_id; + + hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); + if (!hdr) +@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + u16 hci_rev, lmp_subver; + u8 hci_ver, lmp_ver, chip_type = 0; + int ret; ++ int rc; ++ u8 key_id; + u8 reg_val[2]; + + btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL); +@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + ++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); ++ if (rc < 0) ++ goto err_free; ++ ++ key_id = reg_val[0]; ++ btrtl_dev->key_id = key_id; ++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id); ++ + btrtl_dev->fw_len = -EIO; + if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) { + snprintf(fw_name, sizeof(fw_name), "%s_v2.bin", +@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + +- if (btrtl_dev->ic_info->cfg_name) { ++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) { + if (postfix) { + snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin", + btrtl_dev->ic_info->cfg_name, postfix); +-- +2.51.0 + diff --git a/queue-6.17/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-6.17/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..83b048ba50 --- /dev/null +++ b/queue-6.17/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From 51a1912d46ceb70602de50c167e440966b9836f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 55c03e5fe8cb3..277daf71ec8c7 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -70,7 +70,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + struct dma_iova_state { + dma_addr_t addr; +-- +2.51.0 + diff --git a/queue-6.17/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch b/queue-6.17/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch new file mode 100644 index 0000000000..90da24225d --- /dev/null +++ b/queue-6.17/drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch @@ -0,0 +1,56 @@ +From aceb137aa316b4a112199df47c78c40633197032 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 14:37:07 -0400 +Subject: drm/amdkfd: Fix GPU mappings for APU after prefetch + +From: Harish Kasiviswanathan + +[ Upstream commit eac32ff42393efa6657efc821231b8d802c1d485 ] + +Fix the following corner case:- + Consider a 2M huge page SVM allocation, followed by prefetch call for +the first 4K page. The whole range is initially mapped with single PTE. +After the prefetch, this range gets split to first page + rest of the +pages. Currently, the first page mapping is not updated on MI300A (APU) +since page hasn't migrated. However, after range split PTE mapping it not +valid. + +Fix this by forcing page table update for the whole range when prefetch +is called. Calling prefetch on APU doesn't improve performance. If all +it deteriotes. However, functionality has to be supported. + +v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout +VRAM + +v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU + +v4: Remove v2 and v3 changes. Force update_mapping when range is split +at a size that is not aligned to prange granularity + +Suggested-by: Philip Yang +Signed-off-by: Harish Kasiviswanathan +Reviewed-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 827507cfed7aa..fab6e7721c803 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -3688,6 +3688,8 @@ svm_range_set_attr(struct kfd_process *p, struct mm_struct *mm, + svm_range_apply_attrs(p, prange, nattr, attrs, &update_mapping); + /* TODO: unmap ranges from GPU that lost access */ + } ++ update_mapping |= !p->xnack_enabled && !list_empty(&remap_list); ++ + list_for_each_entry_safe(prange, next, &remove_list, update_list) { + pr_debug("unlink old 0x%p prange 0x%p [0x%lx 0x%lx]\n", + prange->svms, prange, prange->start, +-- +2.51.0 + diff --git a/queue-6.17/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch b/queue-6.17/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch new file mode 100644 index 0000000000..ac0befd912 --- /dev/null +++ b/queue-6.17/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch @@ -0,0 +1,82 @@ +From 728acaa791d20fd52cc11825b97f427af6e0cd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:36:40 -0500 +Subject: drm/vmwgfx: Use kref in vmw_bo_dirty + +From: Ian Forbes + +[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ] + +Rather than using an ad hoc reference count use kref which is atomic +and has underflow warnings. + +Signed-off-by: Ian Forbes +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +index 7de20e56082c8..fd4e76486f2d1 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +@@ -32,22 +32,22 @@ enum vmw_bo_dirty_method { + + /** + * struct vmw_bo_dirty - Dirty information for buffer objects ++ * @ref_count: Reference count for this structure. Must be first member! + * @start: First currently dirty bit + * @end: Last currently dirty bit + 1 + * @method: The currently used dirty method + * @change_count: Number of consecutive method change triggers +- * @ref_count: Reference count for this structure + * @bitmap_size: The size of the bitmap in bits. Typically equal to the + * nuber of pages in the bo. + * @bitmap: A bitmap where each bit represents a page. A set bit means a + * dirty page. + */ + struct vmw_bo_dirty { ++ struct kref ref_count; + unsigned long start; + unsigned long end; + enum vmw_bo_dirty_method method; + unsigned int change_count; +- unsigned int ref_count; + unsigned long bitmap_size; + unsigned long bitmap[]; + }; +@@ -221,7 +221,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + int ret; + + if (dirty) { +- dirty->ref_count++; ++ kref_get(&dirty->ref_count); + return 0; + } + +@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + dirty->bitmap_size = num_pages; + dirty->start = dirty->bitmap_size; + dirty->end = 0; +- dirty->ref_count = 1; ++ kref_init(&dirty->ref_count); + if (num_pages < PAGE_SIZE / sizeof(pte_t)) { + dirty->method = VMW_BO_DIRTY_PAGETABLE; + } else { +@@ -274,10 +274,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo) + { + struct vmw_bo_dirty *dirty = vbo->dirty; + +- if (dirty && --dirty->ref_count == 0) { +- kvfree(dirty); ++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree)) + vbo->dirty = NULL; +- } + } + + /** +-- +2.51.0 + diff --git a/queue-6.17/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch b/queue-6.17/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch new file mode 100644 index 0000000000..c7d51c1213 --- /dev/null +++ b/queue-6.17/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch @@ -0,0 +1,156 @@ +From faa0a326d2bf62cb7b313399a7f34ebcea28a2a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:50:22 -0700 +Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() + +From: Song Liu + +[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ] + +ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on +the same kernel function. When needed, ftrace_hash_ipmodify_enable() +calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to +share the same function as the IPMODIFY ftrace (livepatch). + +ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, +but not called in modify_ftrace_direct() path. As a result, the following +operations will break livepatch: + +1. Load livepatch to a kernel function; +2. Attach fentry program to the kernel function; +3. Attach fexit program to the kernel function. + +After 3, the kernel function being used will not be the livepatched +version, but the original version. + +Fix this by adding __ftrace_hash_update_ipmodify() to +__modify_ftrace_direct() and adjust some logic around the call. + +Signed-off-by: Song Liu +Reviewed-by: Jiri Olsa +Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org +Signed-off-by: Alexei Starovoitov +Acked-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index cbeb7e8331310..59cfacb8a5bbd 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1971,7 +1971,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops) + */ + static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + struct ftrace_hash *old_hash, +- struct ftrace_hash *new_hash) ++ struct ftrace_hash *new_hash, ++ bool update_target) + { + struct ftrace_page *pg; + struct dyn_ftrace *rec, *end = NULL; +@@ -2006,10 +2007,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (rec->flags & FTRACE_FL_DISABLED) + continue; + +- /* We need to update only differences of filter_hash */ ++ /* ++ * Unless we are updating the target of a direct function, ++ * we only need to update differences of filter_hash ++ */ + in_old = !!ftrace_lookup_ip(old_hash, rec->ip); + in_new = !!ftrace_lookup_ip(new_hash, rec->ip); +- if (in_old == in_new) ++ if (!update_target && (in_old == in_new)) + continue; + + if (in_new) { +@@ -2020,7 +2024,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (is_ipmodify) + goto rollback; + +- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT); ++ /* ++ * If this is called by __modify_ftrace_direct() ++ * then it is only changing where the direct ++ * pointer is jumping to, and the record already ++ * points to a direct trampoline. If it isn't, ++ * then it is a bug to update ipmodify on a direct ++ * caller. ++ */ ++ FTRACE_WARN_ON(!update_target && ++ (rec->flags & FTRACE_FL_DIRECT)); + + /* + * Another ops with IPMODIFY is already +@@ -2076,7 +2089,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash); ++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false); + } + + /* Disabling always succeeds */ +@@ -2087,7 +2100,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH); ++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false); + } + + static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, +@@ -2101,7 +2114,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, + if (ftrace_hash_empty(new_hash)) + new_hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash); ++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false); + } + + static void print_ip_ins(const char *fmt, const unsigned char *p) +@@ -6114,7 +6127,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct); + static int + __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + { +- struct ftrace_hash *hash; ++ struct ftrace_hash *hash = ops->func_hash->filter_hash; + struct ftrace_func_entry *entry, *iter; + static struct ftrace_ops tmp_ops = { + .func = ftrace_stub, +@@ -6134,13 +6147,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + if (err) + return err; + ++ /* ++ * Call __ftrace_hash_update_ipmodify() here, so that we can call ++ * ops->ops_func for the ops. This is needed because the above ++ * register_ftrace_function_nolock() worked on tmp_ops. ++ */ ++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true); ++ if (err) ++ goto out; ++ + /* + * Now the ftrace_ops_list_func() is called to do the direct callers. + * We can safely change the direct functions attached to each entry. + */ + mutex_lock(&ftrace_lock); + +- hash = ops->func_hash->filter_hash; + size = 1 << hash->size_bits; + for (i = 0; i < size; i++) { + hlist_for_each_entry(iter, &hash->buckets[i], hlist) { +@@ -6155,6 +6176,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + + mutex_unlock(&ftrace_lock); + ++out: + /* Removing the tmp_ops will add the updated direct callers to the functions */ + unregister_ftrace_function(&tmp_ops); + +-- +2.51.0 + diff --git a/queue-6.17/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch b/queue-6.17/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch new file mode 100644 index 0000000000..dabd629181 --- /dev/null +++ b/queue-6.17/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch @@ -0,0 +1,35 @@ +From 70962d20768f3659eb60dd3ae1ee13569246fdb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:37:26 +0800 +Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list + +From: April Grimoire + +[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ] + +SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, +rendering function keys not treated properly. Despite being a +SONiX USB DEVICE, it uses a different name, so adding it to the list. + +Signed-off-by: April Grimoire +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 61404d7a43ee1..57da4f86a9fa7 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -355,6 +355,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { + { "SONiX USB DEVICE" }, ++ { "SONiX AK870 PRO" }, + { "Keychron" }, + { "AONE" }, + { "GANSS" }, +-- +2.51.0 + diff --git a/queue-6.17/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch b/queue-6.17/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch new file mode 100644 index 0000000000..9acd1b6c26 --- /dev/null +++ b/queue-6.17/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch @@ -0,0 +1,80 @@ +From fdcd06268abab1f62d1a1668ccf5553beff01f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 21:16:45 +0900 +Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F) + +From: Naoki Ueki + +[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ] + +The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which +shares the same report descriptor as the existing device (0x00FB). However, +the driver does not currently recognize this new ID, resulting in only five +buttons being functional. + +This patch adds the new device ID so that all six buttons work properly. + +Signed-off-by: Naoki Ueki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 6 ++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 69771fd350060..981d1b6e96589 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -75,7 +75,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8); + break; +- case USB_DEVICE_ID_ELECOM_M_XT3URBK: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F: + case USB_DEVICE_ID_ELECOM_M_XT3DRBK: + case USB_DEVICE_ID_ELECOM_M_XT4DRBK: + /* +@@ -119,7 +120,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 85db279baa72e..c4589075a5ed6 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -449,7 +449,8 @@ + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 + #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 +-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f + #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc + #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 22760ac50f2d9..c89a015686c07 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -410,7 +410,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +-- +2.51.0 + diff --git a/queue-6.17/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch b/queue-6.17/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch new file mode 100644 index 0000000000..151ae7c0c1 --- /dev/null +++ b/queue-6.17/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch @@ -0,0 +1,46 @@ +From 1d1e23e2dba577a92fc747d8ac72c718c71bfc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:06:25 -0500 +Subject: HID: hid-input: Extend Elan ignore battery quirk to USB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello (AMD) + +[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ] + +USB Elan devices have the same problem as the I2C ones with a fake +battery device showing up. + +Reviewed-by: Hans de Goede +Reported-by: André Barata +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722 +Signed-off-by: Mario Limonciello (AMD) +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 2c743e35c1d33..bc7de9ef45ecd 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), + HID_BATTERY_QUIRK_AVOID_QUERY }, + /* +- * Elan I2C-HID touchscreens seem to all report a non present battery, +- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices. ++ * Elan HID touchscreens seem to all report a non present battery, ++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices. + */ + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.17/hid-lenovo-fixup-lenovo-yoga-slim-7x-keyboard-rdesc.patch b/queue-6.17/hid-lenovo-fixup-lenovo-yoga-slim-7x-keyboard-rdesc.patch new file mode 100644 index 0000000000..24914d4930 --- /dev/null +++ b/queue-6.17/hid-lenovo-fixup-lenovo-yoga-slim-7x-keyboard-rdesc.patch @@ -0,0 +1,92 @@ +From c3a5b8bd69f6d9c956bb022373a4778d2df31a37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Oct 2025 15:35:15 +0900 +Subject: HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc + +From: Lauri Tirkkonen + +[ Upstream commit a45f15808fb753a14c6041fd1e5bef5d552bd2e3 ] + +The keyboard of this device has the following in its report description +for Usage (Keyboard) in Collection (Application): + + # 0x15, 0x00, // Logical Minimum (0) 52 + # 0x25, 0x65, // Logical Maximum (101) 54 + # 0x05, 0x07, // Usage Page (Keyboard) 56 + # 0x19, 0x00, // Usage Minimum (0) 58 + # 0x29, 0xdd, // Usage Maximum (221) 60 + # 0x81, 0x00, // Input (Data,Arr,Abs) 62 + +Since the Usage Min/Max range exceeds the Logical Min/Max range, +keypresses outside the Logical range are not recognized. This includes, +for example, the Japanese language keyboard variant's keys for |, _ and +\. + +Fixup the report description to make the Logical range match the Usage +range, fixing the interpretation of keypresses above 101 on this device. + +Signed-off-by: Lauri Tirkkonen +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-lenovo.c | 17 +++++++++++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 52ae7c29f9e08..85db279baa72e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -718,6 +718,7 @@ + #define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350 + #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a + #define USB_DEVICE_ID_ITE_LENOVO_YOGA900 0x8396 ++#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD 0x8987 + #define USB_DEVICE_ID_ITE8595 0x8595 + #define USB_DEVICE_ID_ITE_MEDION_E1239T 0xce50 + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index 654879814f97a..9cc3e029e9f61 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -148,6 +148,14 @@ static const __u8 lenovo_tpIIbtkbd_need_fixup_collection[] = { + 0x81, 0x01, /* Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */ + }; + ++static const __u8 lenovo_yoga7x_kbd_need_fixup_collection[] = { ++ 0x15, 0x00, // Logical Minimum (0) ++ 0x25, 0x65, // Logical Maximum (101) ++ 0x05, 0x07, // Usage Page (Keyboard) ++ 0x19, 0x00, // Usage Minimum (0) ++ 0x29, 0xDD, // Usage Maximum (221) ++}; ++ + static const __u8 *lenovo_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +@@ -177,6 +185,13 @@ static const __u8 *lenovo_report_fixup(struct hid_device *hdev, __u8 *rdesc, + rdesc[260] = 0x01; /* report count (2) = 0x01 */ + } + break; ++ case I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD: ++ if (*rsize == 176 && ++ memcmp(&rdesc[52], lenovo_yoga7x_kbd_need_fixup_collection, ++ sizeof(lenovo_yoga7x_kbd_need_fixup_collection)) == 0) { ++ rdesc[55] = rdesc[61]; // logical maximum = usage maximum ++ } ++ break; + } + return rdesc; + } +@@ -1538,6 +1553,8 @@ static const struct hid_device_id lenovo_devices[] = { + USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB2) }, ++ { HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD) }, + { } + }; + +-- +2.51.0 + diff --git a/queue-6.17/loongarch-mask-all-interrupts-during-kexec-kdump.patch b/queue-6.17/loongarch-mask-all-interrupts-during-kexec-kdump.patch new file mode 100644 index 0000000000..6eca32bf98 --- /dev/null +++ b/queue-6.17/loongarch-mask-all-interrupts-during-kexec-kdump.patch @@ -0,0 +1,48 @@ +From 7dfce754d9ddbf924757751845058bf95d678641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 14:42:05 +0800 +Subject: LoongArch: Mask all interrupts during kexec/kdump + +From: Huacai Chen + +[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ] + +If the default state of the interrupt controllers in the first kernel +don't mask any interrupts, it may cause the second kernel to potentially +receive interrupts (which were previously allocated by the first kernel) +immediately after a CPU becomes online during its boot process. These +interrupts cannot be properly routed, leading to bad IRQ issues. + +This patch calls machine_kexec_mask_interrupts() to mask all interrupts +during the kexec/kdump process. + +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/machine_kexec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c +index f9381800e291c..8ef4e4595d61a 100644 +--- a/arch/loongarch/kernel/machine_kexec.c ++++ b/arch/loongarch/kernel/machine_kexec.c +@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs) + #ifdef CONFIG_SMP + crash_smp_send_stop(); + #endif ++ machine_kexec_mask_interrupts(); + cpumask_set_cpu(crashing_cpu, &cpus_in_crash); + + pr_info("Starting crashdump kernel...\n"); +@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image) + + /* We do not want to be bothered. */ + local_irq_disable(); ++ machine_kexec_mask_interrupts(); + + pr_notice("EFI boot flag 0x%lx\n", efi_boot); + pr_notice("Command line at 0x%lx\n", cmdline_ptr); +-- +2.51.0 + diff --git a/queue-6.17/nvme-fix-admin-request_queue-lifetime.patch b/queue-6.17/nvme-fix-admin-request_queue-lifetime.patch new file mode 100644 index 0000000000..3ccb77769b --- /dev/null +++ b/queue-6.17/nvme-fix-admin-request_queue-lifetime.patch @@ -0,0 +1,98 @@ +From de17352d58c606b9320371856926c7140d1ddd1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:48:30 -0800 +Subject: nvme: fix admin request_queue lifetime + +From: Keith Busch + +[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ] + +The namespaces can access the controller's admin request_queue, and +stale references on the namespaces may exist after tearing down the +controller. Ensure the admin request_queue is active by moving the +controller's 'put' to after all controller references have been released +to ensure no one is can access the request_queue. This fixes a reported +use-after-free bug: + + BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 + Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 + CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 + Tainted: [E]=UNSIGNED_MODULE + Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 + Call Trace: + + dump_stack_lvl+0x4f/0x60 + print_report+0xc4/0x620 + ? _raw_spin_lock_irqsave+0x70/0xb0 + ? _raw_read_unlock_irqrestore+0x30/0x30 + ? blk_queue_enter+0x41c/0x4a0 + kasan_report+0xab/0xe0 + ? blk_queue_enter+0x41c/0x4a0 + blk_queue_enter+0x41c/0x4a0 + ? __irq_work_queue_local+0x75/0x1d0 + ? blk_queue_start_drain+0x70/0x70 + ? irq_work_queue+0x18/0x20 + ? vprintk_emit.part.0+0x1cc/0x350 + ? wake_up_klogd_work_func+0x60/0x60 + blk_mq_alloc_request+0x2b7/0x6b0 + ? __blk_mq_alloc_requests+0x1060/0x1060 + ? __switch_to+0x5b7/0x1060 + nvme_submit_user_cmd+0xa9/0x330 + nvme_user_cmd.isra.0+0x240/0x3f0 + ? force_sigsegv+0xe0/0xe0 + ? nvme_user_cmd64+0x400/0x400 + ? vfs_fileattr_set+0x9b0/0x9b0 + ? cgroup_update_frozen_flag+0x24/0x1c0 + ? cgroup_leave_frozen+0x204/0x330 + ? nvme_ioctl+0x7c/0x2c0 + blkdev_ioctl+0x1a8/0x4d0 + ? blkdev_common_ioctl+0x1930/0x1930 + ? fdget+0x54/0x380 + __x64_sys_ioctl+0x129/0x190 + do_syscall_64+0x5b/0x160 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + RIP: 0033:0x7f765f703b0b + Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b + RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 + R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 + R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 + + +Reported-by: Casey Chen +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Reviewed-by: Ming Lei +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 5714d49932822..28c598008124c 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4896,7 +4896,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl) + */ + nvme_stop_keep_alive(ctrl); + blk_mq_destroy_queue(ctrl->admin_q); +- blk_put_queue(ctrl->admin_q); + if (ctrl->ops->flags & NVME_F_FABRICS) { + blk_mq_destroy_queue(ctrl->fabrics_q); + blk_put_queue(ctrl->fabrics_q); +@@ -5040,6 +5039,8 @@ static void nvme_free_ctrl(struct device *dev) + container_of(dev, struct nvme_ctrl, ctrl_device); + struct nvme_subsystem *subsys = ctrl->subsys; + ++ if (ctrl->admin_q) ++ blk_put_queue(ctrl->admin_q); + if (!subsys || ctrl->instance != subsys->instance) + ida_free(&nvme_instance_ida, ctrl->instance); + nvme_free_cels(ctrl); +-- +2.51.0 + diff --git a/queue-6.17/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-6.17/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..9d29b9fddb --- /dev/null +++ b/queue-6.17/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From 5604855f17d51414f147886b598db4a4169a0eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 83eb075b6bfa1..3d6601dc6fcc5 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -215,7 +215,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-6.17/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..5c6636bcdd --- /dev/null +++ b/queue-6.17/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From af37fa6437c878210f989384b1856c4527f9e759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 13eb22b35aa8f..d848afc91f87d 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -102,6 +102,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, + WMID_AC_EVENT = 0x8, +@@ -2369,6 +2370,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch b/queue-6.17/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch new file mode 100644 index 0000000000..95cb259bc2 --- /dev/null +++ b/queue-6.17/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch @@ -0,0 +1,60 @@ +From c035e88ad8846e7568f7f78fae115427644448d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:50:57 +0200 +Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ] + +The Lenovo Legion Go 2 takes a long time to resume from suspend. +This is due to it having an nvme resume handler that interferes +with IOMMU mappings. It is a common issue with older Lenovo +laptops. Adding it to that quirk list fixes this issue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618 +Suggested-by: Mario Limonciello +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index d63aaad7ef599..0fadcf5f288ac 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -204,6 +204,23 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), + } + }, ++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */ ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"), ++ } ++ }, ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"), ++ } ++ }, + /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ + { + .ident = "HP Laptop 15s-eq2xxx", +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch b/queue-6.17/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch new file mode 100644 index 0000000000..40c3115b3d --- /dev/null +++ b/queue-6.17/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch @@ -0,0 +1,54 @@ +From b2d409fdf2953b7c32e755b51a418dc94598f809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 17:21:51 +0200 +Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ] + +The Xbox Ally features a Van Gogh SoC that has spurious interrupts +during resume. We get the following logs: + +atkbd_receive_byte: 20 callbacks suppressed +atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly. + +So, add the spurious_8042 quirk for it. It does not have a keyboard, so +this does not result in any functional loss. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 0fadcf5f288ac..404e62ad293a9 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -122,6 +122,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), + } + }, ++ { ++ .ident = "ROG Xbox Ally RC73YA", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */ + { + .ident = "V14 G4 AMN", +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-amd-pmc-add-support-for-van-gogh-soc.patch b/queue-6.17/platform-x86-amd-pmc-add-support-for-van-gogh-soc.patch new file mode 100644 index 0000000000..6f2a3f0d83 --- /dev/null +++ b/queue-6.17/platform-x86-amd-pmc-add-support-for-van-gogh-soc.patch @@ -0,0 +1,76 @@ +From f1d03893b76db2e2913f8e44c808a162fe3798b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 17:21:50 +0200 +Subject: platform/x86/amd/pmc: Add support for Van Gogh SoC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb ] + +The ROG Xbox Ally (non-X) SoC features a similar architecture to the +Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), +this support was dropped by the Xbox Ally which only S0ix suspend. + +Since the handler is missing here, this causes the device to not suspend +and the AMD GPU driver to crash while trying to resume afterwards due to +a power hang. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Acked-by: Shyam Sundar S K +Link: https://patch.msgid.link/20251024152152.3981721-2-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc.c | 3 +++ + drivers/platform/x86/amd/pmc/pmc.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index bd318fd02ccf4..cae3fcafd4d7b 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -106,6 +106,7 @@ static void amd_pmc_get_ip_info(struct amd_pmc_dev *dev) + switch (dev->cpu_id) { + case AMD_CPU_ID_PCO: + case AMD_CPU_ID_RN: ++ case AMD_CPU_ID_VG: + case AMD_CPU_ID_YC: + case AMD_CPU_ID_CB: + dev->num_ips = 12; +@@ -517,6 +518,7 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev) + case AMD_CPU_ID_PCO: + return MSG_OS_HINT_PCO; + case AMD_CPU_ID_RN: ++ case AMD_CPU_ID_VG: + case AMD_CPU_ID_YC: + case AMD_CPU_ID_CB: + case AMD_CPU_ID_PS: +@@ -717,6 +719,7 @@ static const struct pci_device_id pmc_pci_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_RV) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SP) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SHP) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_VG) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) }, + { } +diff --git a/drivers/platform/x86/amd/pmc/pmc.h b/drivers/platform/x86/amd/pmc/pmc.h +index 62f3e51020fdf..fe3f53eb59558 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.h ++++ b/drivers/platform/x86/amd/pmc/pmc.h +@@ -156,6 +156,7 @@ void amd_mp2_stb_deinit(struct amd_pmc_dev *dev); + #define AMD_CPU_ID_RN 0x1630 + #define AMD_CPU_ID_PCO AMD_CPU_ID_RV + #define AMD_CPU_ID_CZN AMD_CPU_ID_RN ++#define AMD_CPU_ID_VG 0x1645 + #define AMD_CPU_ID_YC 0x14B5 + #define AMD_CPU_ID_CB 0x14D8 + #define AMD_CPU_ID_PS 0x14E8 +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-hp-wmi-add-omen-16-wf1xxx-fan-support.patch b/queue-6.17/platform-x86-hp-wmi-add-omen-16-wf1xxx-fan-support.patch new file mode 100644 index 0000000000..2a8cedf473 --- /dev/null +++ b/queue-6.17/platform-x86-hp-wmi-add-omen-16-wf1xxx-fan-support.patch @@ -0,0 +1,50 @@ +From e9e9d3059ba59d836282e2604b83ffce65c06e4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Oct 2025 16:40:01 +0530 +Subject: platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krishna Chomal + +[ Upstream commit fb146a38cb119c8d69633851c7a2ce2c8d34861a ] + +The newer HP Omen laptops, such as Omen 16-wf1xxx, use the same +WMI-based thermal profile interface as Victus 16-r1000 and 16-s1000 +models. + +Add the DMI board name "8C78" to the victus_s_thermal_profile_boards +list to enable proper fan and thermal mode control. + +Tested on: HP Omen 16-wf1xxx (board 8C78) +Result: +* Fan RPMs are readable +* echo 0 | sudo tee /sys/devices/platform/hp-wmi/hwmon/*/pwm1_enable + allows the fans to run on max RPM. + +Signed-off-by: Krishna Chomal +Link: https://patch.msgid.link/20251018111001.56625-1-krishna.chomal108@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp/hp-wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c +index 9a668e2587952..e10c75d91f248 100644 +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -95,7 +95,7 @@ static const char * const victus_thermal_profile_boards[] = { + /* DMI Board names of Victus 16-r and Victus 16-s laptops */ + static const char * const victus_s_thermal_profile_boards[] = { + "8BBE", "8BD4", "8BD5", +- "8C99", "8C9C" ++ "8C78", "8C99", "8C9C", + }; + + enum hp_wmi_radio { +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-hp-wmi-add-omen-max-16-ah0xx-fan-suppor.patch b/queue-6.17/platform-x86-hp-wmi-add-omen-max-16-ah0xx-fan-suppor.patch new file mode 100644 index 0000000000..d2e491187c --- /dev/null +++ b/queue-6.17/platform-x86-hp-wmi-add-omen-max-16-ah0xx-fan-suppor.patch @@ -0,0 +1,43 @@ +From 5791007ea564a1fd58c5c45a0eda4e812b0912b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Nov 2025 12:47:41 +0100 +Subject: platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal + profile +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marcos Vega + +[ Upstream commit fa0498f8047536b877819ce4ab154d332b243d43 ] + +New HP Omen laptops follow the same WMI thermal profile as Victus +16-r1000 and 16-s1000. + +Add DMI board 8D41 to victus_s_thermal_profile_boards. + +Signed-off-by: Marcos Vega +Link: https://patch.msgid.link/20251108114739.9255-3-marcosmola2@gmail.com +[ij: changelog taken partially from v1] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp/hp-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c +index e10c75d91f248..ad9d9f97960f2 100644 +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -96,6 +96,7 @@ static const char * const victus_thermal_profile_boards[] = { + static const char * const victus_s_thermal_profile_boards[] = { + "8BBE", "8BD4", "8BD5", + "8C78", "8C99", "8C9C", ++ "8D41", + }; + + enum hp_wmi_radio { +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-hp-wmi-mark-victus-16-r0-and-16-s0-for-.patch b/queue-6.17/platform-x86-hp-wmi-mark-victus-16-r0-and-16-s0-for-.patch new file mode 100644 index 0000000000..d17a59be8a --- /dev/null +++ b/queue-6.17/platform-x86-hp-wmi-mark-victus-16-r0-and-16-s0-for-.patch @@ -0,0 +1,43 @@ +From 90bd390c334dc75a19a380e3649cb5919afe8289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Oct 2025 21:10:44 +0300 +Subject: platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan + and thermal profile support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Edip Hazuri + +[ Upstream commit 54afb047cd7eb40149f3fc42d69fd4ddde2be9f0 ] + +This patch adds Victus 16-r0 (8bbe) and Victus 16-s0(8bd4, 8bd5) laptop +DMI board name into existing list + +Signed-off-by: Edip Hazuri +Link: https://patch.msgid.link/20251015181042.23961-3-edip@medip.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp/hp-wmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c +index 8b3533d6ba091..9a668e2587952 100644 +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -92,8 +92,9 @@ static const char * const victus_thermal_profile_boards[] = { + "8A25" + }; + +-/* DMI Board names of Victus 16-r1000 and Victus 16-s1000 laptops */ ++/* DMI Board names of Victus 16-r and Victus 16-s laptops */ + static const char * const victus_s_thermal_profile_boards[] = { ++ "8BBE", "8BD4", "8BD5", + "8C99", "8C9C" + }; + +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-6.17/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..384a7e197b --- /dev/null +++ b/queue-6.17/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From 5a1a79da6c2b3d8c4c9fc28b66b627bfc3e8578d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index c3772df34679f..8a4c54089ace3 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-intel-hid-add-nova-lake-support.patch b/queue-6.17/platform-x86-intel-hid-add-nova-lake-support.patch new file mode 100644 index 0000000000..8ce10e4473 --- /dev/null +++ b/queue-6.17/platform-x86-intel-hid-add-nova-lake-support.patch @@ -0,0 +1,38 @@ +From 1ec689d4c4d9b2bc700093f4d972a3a41e0d642f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:50:41 -0800 +Subject: platform/x86/intel/hid: Add Nova Lake support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivas Pandruvada + +[ Upstream commit ddf5ffff3a5fe95bed178f5554596b93c52afbc9 ] + +Add ACPI ID for Nova Lake. + +Signed-off-by: Srinivas Pandruvada +Link: https://patch.msgid.link/20251110235041.123685-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index f25a427cccdac..9c07a7faf18fe 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -55,6 +55,7 @@ static const struct acpi_device_id intel_hid_ids[] = { + { "INTC10CB" }, + { "INTC10CC" }, + { "INTC10F1" }, ++ { "INTC10F2" }, + { } + }; + MODULE_DEVICE_TABLE(acpi, intel_hid_ids); +-- +2.51.0 + diff --git a/queue-6.17/platform-x86-intel-uncore-freq-add-additional-client.patch b/queue-6.17/platform-x86-intel-uncore-freq-add-additional-client.patch new file mode 100644 index 0000000000..27a7639ffe --- /dev/null +++ b/queue-6.17/platform-x86-intel-uncore-freq-add-additional-client.patch @@ -0,0 +1,42 @@ +From 325fecc1bdf03b0c7bcc8539fc4b89e1a62526b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 14:17:33 -0700 +Subject: platform/x86: intel-uncore-freq: Add additional client processors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kuppuswamy Sathyanarayanan + +[ Upstream commit a229809c18926e79aeca232d5b502157beb0dec3 ] + +Add Intel uncore frequency driver support for Pantherlake, Wildcatlake +and Novalake processors. + +Signed-off-by: Kuppuswamy Sathyanarayanan +Link: https://patch.msgid.link/20251022211733.3565526-1-sathyanarayanan.kuppuswamy@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + .../platform/x86/intel/uncore-frequency/uncore-frequency.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c +index 2a6897035150c..0dfc552b28024 100644 +--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c ++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c +@@ -256,6 +256,10 @@ static const struct x86_cpu_id intel_uncore_cpu_ids[] = { + X86_MATCH_VFM(INTEL_ARROWLAKE, NULL), + X86_MATCH_VFM(INTEL_ARROWLAKE_H, NULL), + X86_MATCH_VFM(INTEL_LUNARLAKE_M, NULL), ++ X86_MATCH_VFM(INTEL_PANTHERLAKE_L, NULL), ++ X86_MATCH_VFM(INTEL_WILDCATLAKE_L, NULL), ++ X86_MATCH_VFM(INTEL_NOVALAKE, NULL), ++ X86_MATCH_VFM(INTEL_NOVALAKE_L, NULL), + {} + }; + MODULE_DEVICE_TABLE(x86cpu, intel_uncore_cpu_ids); +-- +2.51.0 + diff --git a/queue-6.17/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-6.17/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..2356e0d71d --- /dev/null +++ b/queue-6.17/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From 85cee045fcb78876badd950e6f49b168edf5bd86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.17/sched_ext-fix-possible-deadlock-in-the-deferred_irq_.patch b/queue-6.17/sched_ext-fix-possible-deadlock-in-the-deferred_irq_.patch new file mode 100644 index 0000000000..6546050b9b --- /dev/null +++ b/queue-6.17/sched_ext-fix-possible-deadlock-in-the-deferred_irq_.patch @@ -0,0 +1,45 @@ +From 1ecfe4db629fa982a9091770f821b38864036565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Nov 2025 19:43:55 +0800 +Subject: sched_ext: Fix possible deadlock in the deferred_irq_workfn() + +From: Zqiang + +[ Upstream commit a257e974210320ede524f340ffe16bf4bf0dda1e ] + +For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in +the per-cpu irq_work/* task context and not disable-irq, if the rq +returned by container_of() is current CPU's rq, the following scenarios +may occur: + +lock(&rq->__lock); + + lock(&rq->__lock); + +This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to +initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn() +is always invoked in hard-irq context. + +Signed-off-by: Zqiang +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/sched/ext.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c +index 1e4740de66c28..16a7ae9b29ae4 100644 +--- a/kernel/sched/ext.c ++++ b/kernel/sched/ext.c +@@ -5377,7 +5377,7 @@ void __init init_sched_ext_class(void) + BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_kick_if_idle, GFP_KERNEL, n)); + BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_preempt, GFP_KERNEL, n)); + BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_wait, GFP_KERNEL, n)); +- init_irq_work(&rq->scx.deferred_irq_work, deferred_irq_workfn); ++ rq->scx.deferred_irq_work = IRQ_WORK_INIT_HARD(deferred_irq_workfn); + init_irq_work(&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn); + + if (cpu_online(cpu)) +-- +2.51.0 + diff --git a/queue-6.17/sched_ext-use-irq_work_init_hard-to-initialize-rq-sc.patch b/queue-6.17/sched_ext-use-irq_work_init_hard-to-initialize-rq-sc.patch new file mode 100644 index 0000000000..80ca44b658 --- /dev/null +++ b/queue-6.17/sched_ext-use-irq_work_init_hard-to-initialize-rq-sc.patch @@ -0,0 +1,39 @@ +From ba53fd523e525c91bb46b9d94b553baf9bf40086 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 20:53:10 +0800 +Subject: sched_ext: Use IRQ_WORK_INIT_HARD() to initialize + rq->scx.kick_cpus_irq_work + +From: Zqiang + +[ Upstream commit 36c6f3c03d104faf1aa90922f2310549c175420f ] + +For PREEMPT_RT kernels, the kick_cpus_irq_workfn() be invoked in +the per-cpu irq_work/* task context and there is no rcu-read critical +section to protect. this commit therefore use IRQ_WORK_INIT_HARD() to +initialize the per-cpu rq->scx.kick_cpus_irq_work in the +init_sched_ext_class(). + +Signed-off-by: Zqiang +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/sched/ext.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c +index 16a7ae9b29ae4..9592579db949d 100644 +--- a/kernel/sched/ext.c ++++ b/kernel/sched/ext.c +@@ -5378,7 +5378,7 @@ void __init init_sched_ext_class(void) + BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_preempt, GFP_KERNEL, n)); + BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_wait, GFP_KERNEL, n)); + rq->scx.deferred_irq_work = IRQ_WORK_INIT_HARD(deferred_irq_workfn); +- init_irq_work(&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn); ++ rq->scx.kick_cpus_irq_work = IRQ_WORK_INIT_HARD(kick_cpus_irq_workfn); + + if (cpu_online(cpu)) + cpu_rq(cpu)->scx.flags |= SCX_RQ_ONLINE; +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series new file mode 100644 index 0000000000..91170060c3 --- /dev/null +++ b/queue-6.17/series @@ -0,0 +1,34 @@ +ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +acpi-mrrm-fix-memory-leaks-and-improve-error-handlin.patch +drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch +arm64-reject-modules-with-internal-alternative-callb.patch +alsa-hda-tas2781-add-new-quirk-for-hp-new-projects.patch +bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch +asoc-sdca-bug-fix-while-parsing-mipi-sdca-control-cn.patch +smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch +drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch +alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch +hid-lenovo-fixup-lenovo-yoga-slim-7x-keyboard-rdesc.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch +platform-x86-amd-pmc-add-support-for-van-gogh-soc.patch +platform-x86-hp-wmi-mark-victus-16-r0-and-16-s0-for-.patch +nvme-fix-admin-request_queue-lifetime.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +platform-x86-intel-uncore-freq-add-additional-client.patch +platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch +platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch +sched_ext-fix-possible-deadlock-in-the-deferred_irq_.patch +platform-x86-intel-hid-add-nova-lake-support.patch +hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch +sched_ext-use-irq_work_init_hard-to-initialize-rq-sc.patch +loongarch-mask-all-interrupts-during-kexec-kdump.patch +samples-work-around-glibc-redefining-some-of-our-def.patch +platform-x86-hp-wmi-add-omen-16-wf1xxx-fan-support.patch +platform-x86-hp-wmi-add-omen-max-16-ah0xx-fan-suppor.patch diff --git a/queue-6.17/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch b/queue-6.17/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch new file mode 100644 index 0000000000..a7805de279 --- /dev/null +++ b/queue-6.17/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch @@ -0,0 +1,38 @@ +From f703e47320a2a87a1dcdf86f1112cbf1a586dd04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 15:05:39 +0800 +Subject: smb: fix invalid username check in smb3_fs_context_parse_param() + +From: Yiqi Sun + +[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ] + +Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) +is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() +is always FALSE and invalid. + +Fix the comparison in if statement. + +Signed-off-by: Yiqi Sun +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index c9cd00b96cde1..44dc5e24482e8 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -1472,7 +1472,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + break; + } + +- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) > ++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) == + CIFS_MAX_USERNAME_LEN) { + pr_warn("username too long\n"); + goto cifs_parse_mount_err; +-- +2.51.0 + diff --git a/queue-6.17/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-6.17/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..cc97097a03 --- /dev/null +++ b/queue-6.17/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From 9b2ef82e3201748da289a6e65d1ddaa90d1bbbbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 155ddeb8fcd46..bbf1fd4fe1e92 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -519,9 +519,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_ecspi_disable(struct spi_imx_data *spi_imx) +@@ -759,7 +765,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(tx_wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1520,6 +1525,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(controller->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-6.17/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-6.17/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..5aa6412af8 --- /dev/null +++ b/queue-6.17/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From 00cb310f1e4acad8c51bc40bb76b36e4e70bf31c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index d59cc8a184846..c86dc56f38b45 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -300,7 +300,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch b/queue-6.6/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch new file mode 100644 index 0000000000..3c4719cd9f --- /dev/null +++ b/queue-6.6/alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch @@ -0,0 +1,65 @@ +From c06092e62c35c7e668e87c328c8d2aab8e77892d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 13:20:53 +0800 +Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series + +From: Lushih Hsieh + +[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ] + +The PureAudio APA DAC and Lotus DAC5 series are USB Audio +2.0 Class devices that support native Direct Stream Digital (DSD) +playback via specific vendor protocols. + +Without these quirks, the devices may only function in standard +PCM mode, or fail to correctly report their DSD format capabilities +to the ALSA framework, preventing native DSD playback under Linux. + +This commit adds new quirk entries for the mentioned DAC models +based on their respective Vendor/Product IDs (VID:PID), for example: +0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. + +The quirk ensures correct DSD format handling by setting the required +SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific +Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA +DSD API to correctly address the device for high-bitrate DSD streams, +bypassing the need for DoP (DSD over PCM). + +Test on APA DAC and Lotus DAC5 SE under Arch Linux. + +Tested-by: Lushih Hsieh +Signed-off-by: Lushih Hsieh +Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 68238e62020b0..44274f39d6937 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1922,6 +1922,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ + case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */ ++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ + case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ +@@ -2189,6 +2191,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ + QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */ + QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ +-- +2.51.0 + diff --git a/queue-6.6/bfs-reconstruct-file-type-when-loading-from-disk.patch b/queue-6.6/bfs-reconstruct-file-type-when-loading-from-disk.patch new file mode 100644 index 0000000000..79c6688459 --- /dev/null +++ b/queue-6.6/bfs-reconstruct-file-type-when-loading-from-disk.patch @@ -0,0 +1,73 @@ +From f77efdee134d92dca41ea3fb19302491fd5c9614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 22:25:49 +0900 +Subject: bfs: Reconstruct file type when loading from disk + +From: Tetsuo Handa + +[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ] + +syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when +the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted +or when the 32bits "attributes" field loaded from disk are corrupted. + +A documentation says that BFS uses only lower 9 bits of the "mode" field. +But I can't find an explicit explanation that the unused upper 23 bits +(especially, the S_IFMT bits) are initialized with 0. + +Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. +Also, verify that the value of the "attributes" field loaded from disk is +either BFS_VREG or BFS_VDIR (because BFS supports only regular files and +the root directory). + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d +Signed-off-by: Tetsuo Handa +Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp +Reviewed-by: Tigran Aivazian +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/bfs/inode.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index e6a76ae9eb444..42805e3dbdaec 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; + di = (struct bfs_inode *)bh->b_data + off; + +- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); ++ /* ++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that ++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode ++ * value. This means that, although bfs_write_inode() saves whole ++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} ++ * bits), middle 7 bits of di->i_mode value can be garbage when these ++ * bits were not saved by bfs_write_inode(). ++ * Since we can't tell whether middle 7 bits are garbage, use only ++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being ++ * garbage) and reconstruct S_IFMT bits for Linux environment from ++ * di->i_vtype value. ++ */ ++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); + if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { + inode->i_mode |= S_IFDIR; + inode->i_op = &bfs_dir_inops; +@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &bfs_file_inops; + inode->i_fop = &bfs_file_operations; + inode->i_mapping->a_ops = &bfs_aops; ++ } else { ++ brelse(bh); ++ printf("Unknown vtype=%u %s:%08lx\n", ++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); ++ goto error; + } + + BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); +-- +2.51.0 + diff --git a/queue-6.6/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch b/queue-6.6/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch new file mode 100644 index 0000000000..7d5b9ada7a --- /dev/null +++ b/queue-6.6/bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch @@ -0,0 +1,117 @@ +From f88f7869bf2fa2384b36927e97ab38e92eace032 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Nov 2025 20:02:04 +0800 +Subject: Bluetooth: btrtl: Avoid loading the config file on security chips + +From: Max Chou + +[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ] + +For chips with security enabled, it's only possible to load firmware +with a valid signature pattern. +If key_id is not zero, it indicates a security chip, and the driver will +not load the config file. + +- Example log for a security chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 1 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +- Example log for a normal chip. + +Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a + lmp_ver=0c lmp_subver=8922 +Bluetooth: hci0: RTL: rom_version status=0 version=1 +Bluetooth: hci0: RTL: btrtl_initialize: key id 0 +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin +Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin +Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 +Bluetooth: hci0: RTL: fw version 0x41c0c905 + +Tested-by: Hilda Wu +Signed-off-by: Nial Ni +Signed-off-by: Max Chou +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btrtl.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index 24dae5440c036..3d995790a5071 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -49,7 +49,7 @@ + + #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}}) + #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) +-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) ++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}}) + + #define RTL_PATCH_SNIPPETS 0x01 + #define RTL_PATCH_DUMMY_HEADER 0x02 +@@ -513,7 +513,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + { + struct rtl_epatch_header_v2 *hdr; + int rc; +- u8 reg_val[2]; + u8 key_id; + u32 num_sections; + struct rtl_section *section; +@@ -528,14 +527,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, + .len = btrtl_dev->fw_len - 7, /* Cut the tail */ + }; + +- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); +- if (rc < 0) +- return -EIO; +- key_id = reg_val[0]; +- +- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id); +- +- btrtl_dev->key_id = key_id; ++ key_id = btrtl_dev->key_id; + + hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); + if (!hdr) +@@ -1049,6 +1041,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + u16 hci_rev, lmp_subver; + u8 hci_ver, lmp_ver, chip_type = 0; + int ret; ++ int rc; ++ u8 key_id; + u8 reg_val[2]; + + btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL); +@@ -1159,6 +1153,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + ++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); ++ if (rc < 0) ++ goto err_free; ++ ++ key_id = reg_val[0]; ++ btrtl_dev->key_id = key_id; ++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id); ++ + btrtl_dev->fw_len = -EIO; + if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) { + snprintf(fw_name, sizeof(fw_name), "%s_v2.bin", +@@ -1181,7 +1183,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, + goto err_free; + } + +- if (btrtl_dev->ic_info->cfg_name) { ++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) { + if (postfix) { + snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin", + btrtl_dev->ic_info->cfg_name, postfix); +-- +2.51.0 + diff --git a/queue-6.6/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch b/queue-6.6/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch new file mode 100644 index 0000000000..195076a03e --- /dev/null +++ b/queue-6.6/dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch @@ -0,0 +1,49 @@ +From a661ee914b7b7a135d43fa60f04b705eca07c4b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:05:27 +0000 +Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope + +From: James Clark + +[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ] + +Clang doesn't like that (1ULL<<(64)) overflows when initializing a +global scope variable, even if that part of the ternary isn't used when +n = 64. The same initialization can be done without warnings in function +scopes, and GCC doesn't mind either way. + +The build failure that highlighted this was already fixed in a different +way [1], which also has detailed links to the Clang issues. However it's +not going to be long before the same thing happens again, so it's better +to fix the root cause. + +Fix it by using GENMASK_ULL() which does exactly the same thing, is much +more readable anyway, and doesn't have a shift that overflows. + +[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ + +Signed-off-by: James Clark +Reviewed-by: Nathan Chancellor +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 608e8296ba206..48656f6344b65 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -74,7 +74,7 @@ + */ + #define DMA_MAPPING_ERROR (~(dma_addr_t)0) + +-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) ++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0) + + #ifdef CONFIG_DMA_API_DEBUG + void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr); +-- +2.51.0 + diff --git a/queue-6.6/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch b/queue-6.6/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch new file mode 100644 index 0000000000..1899fe8cf5 --- /dev/null +++ b/queue-6.6/drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch @@ -0,0 +1,82 @@ +From a5f3bfbcecec01728a015fb021edae3b44a1367e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 14:36:40 -0500 +Subject: drm/vmwgfx: Use kref in vmw_bo_dirty + +From: Ian Forbes + +[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ] + +Rather than using an ad hoc reference count use kref which is atomic +and has underflow warnings. + +Signed-off-by: Ian Forbes +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +index 74ff2812d66a1..de2498749e276 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +@@ -51,22 +51,22 @@ enum vmw_bo_dirty_method { + + /** + * struct vmw_bo_dirty - Dirty information for buffer objects ++ * @ref_count: Reference count for this structure. Must be first member! + * @start: First currently dirty bit + * @end: Last currently dirty bit + 1 + * @method: The currently used dirty method + * @change_count: Number of consecutive method change triggers +- * @ref_count: Reference count for this structure + * @bitmap_size: The size of the bitmap in bits. Typically equal to the + * nuber of pages in the bo. + * @bitmap: A bitmap where each bit represents a page. A set bit means a + * dirty page. + */ + struct vmw_bo_dirty { ++ struct kref ref_count; + unsigned long start; + unsigned long end; + enum vmw_bo_dirty_method method; + unsigned int change_count; +- unsigned int ref_count; + unsigned long bitmap_size; + unsigned long bitmap[]; + }; +@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + int ret; + + if (dirty) { +- dirty->ref_count++; ++ kref_get(&dirty->ref_count); + return 0; + } + +@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) + dirty->bitmap_size = num_pages; + dirty->start = dirty->bitmap_size; + dirty->end = 0; +- dirty->ref_count = 1; ++ kref_init(&dirty->ref_count); + if (num_pages < PAGE_SIZE / sizeof(pte_t)) { + dirty->method = VMW_BO_DIRTY_PAGETABLE; + } else { +@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo) + { + struct vmw_bo_dirty *dirty = vbo->dirty; + +- if (dirty && --dirty->ref_count == 0) { +- kvfree(dirty); ++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree)) + vbo->dirty = NULL; +- } + } + + /** +-- +2.51.0 + diff --git a/queue-6.6/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch b/queue-6.6/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch new file mode 100644 index 0000000000..70997a73f0 --- /dev/null +++ b/queue-6.6/ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch @@ -0,0 +1,156 @@ +From 3820ac32fb40eb5640fe959efa63cd756ad81ef6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 10:50:22 -0700 +Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() + +From: Song Liu + +[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ] + +ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on +the same kernel function. When needed, ftrace_hash_ipmodify_enable() +calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to +share the same function as the IPMODIFY ftrace (livepatch). + +ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, +but not called in modify_ftrace_direct() path. As a result, the following +operations will break livepatch: + +1. Load livepatch to a kernel function; +2. Attach fentry program to the kernel function; +3. Attach fexit program to the kernel function. + +After 3, the kernel function being used will not be the livepatched +version, but the original version. + +Fix this by adding __ftrace_hash_update_ipmodify() to +__modify_ftrace_direct() and adjust some logic around the call. + +Signed-off-by: Song Liu +Reviewed-by: Jiri Olsa +Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org +Signed-off-by: Alexei Starovoitov +Acked-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 44e31eebb7aaa..8f2d44e741510 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1937,7 +1937,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops, + */ + static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + struct ftrace_hash *old_hash, +- struct ftrace_hash *new_hash) ++ struct ftrace_hash *new_hash, ++ bool update_target) + { + struct ftrace_page *pg; + struct dyn_ftrace *rec, *end = NULL; +@@ -1972,10 +1973,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (rec->flags & FTRACE_FL_DISABLED) + continue; + +- /* We need to update only differences of filter_hash */ ++ /* ++ * Unless we are updating the target of a direct function, ++ * we only need to update differences of filter_hash ++ */ + in_old = !!ftrace_lookup_ip(old_hash, rec->ip); + in_new = !!ftrace_lookup_ip(new_hash, rec->ip); +- if (in_old == in_new) ++ if (!update_target && (in_old == in_new)) + continue; + + if (in_new) { +@@ -1986,7 +1990,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + if (is_ipmodify) + goto rollback; + +- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT); ++ /* ++ * If this is called by __modify_ftrace_direct() ++ * then it is only changing where the direct ++ * pointer is jumping to, and the record already ++ * points to a direct trampoline. If it isn't, ++ * then it is a bug to update ipmodify on a direct ++ * caller. ++ */ ++ FTRACE_WARN_ON(!update_target && ++ (rec->flags & FTRACE_FL_DIRECT)); + + /* + * Another ops with IPMODIFY is already +@@ -2043,7 +2056,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash); ++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false); + } + + /* Disabling always succeeds */ +@@ -2054,7 +2067,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops) + if (ftrace_hash_empty(hash)) + hash = NULL; + +- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH); ++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false); + } + + static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, +@@ -2068,7 +2081,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops, + if (ftrace_hash_empty(new_hash)) + new_hash = NULL; + +- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash); ++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false); + } + + static void print_ip_ins(const char *fmt, const unsigned char *p) +@@ -5531,7 +5544,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct); + static int + __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + { +- struct ftrace_hash *hash; ++ struct ftrace_hash *hash = ops->func_hash->filter_hash; + struct ftrace_func_entry *entry, *iter; + static struct ftrace_ops tmp_ops = { + .func = ftrace_stub, +@@ -5551,13 +5564,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + if (err) + return err; + ++ /* ++ * Call __ftrace_hash_update_ipmodify() here, so that we can call ++ * ops->ops_func for the ops. This is needed because the above ++ * register_ftrace_function_nolock() worked on tmp_ops. ++ */ ++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true); ++ if (err) ++ goto out; ++ + /* + * Now the ftrace_ops_list_func() is called to do the direct callers. + * We can safely change the direct functions attached to each entry. + */ + mutex_lock(&ftrace_lock); + +- hash = ops->func_hash->filter_hash; + size = 1 << hash->size_bits; + for (i = 0; i < size; i++) { + hlist_for_each_entry(iter, &hash->buckets[i], hlist) { +@@ -5572,6 +5593,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + + mutex_unlock(&ftrace_lock); + ++out: + /* Removing the tmp_ops will add the updated direct callers to the functions */ + unregister_ftrace_function(&tmp_ops); + +-- +2.51.0 + diff --git a/queue-6.6/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch b/queue-6.6/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch new file mode 100644 index 0000000000..005239be34 --- /dev/null +++ b/queue-6.6/hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch @@ -0,0 +1,35 @@ +From 661f43795194cacc8e284dfc9e99869941d84c0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:37:26 +0800 +Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list + +From: April Grimoire + +[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ] + +SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, +rendering function keys not treated properly. Despite being a +SONiX USB DEVICE, it uses a different name, so adding it to the list. + +Signed-off-by: April Grimoire +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 7cf17c671da48..2b8021628d3c6 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -341,6 +341,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = { + + static const struct apple_non_apple_keyboard non_apple_keyboards[] = { + { "SONiX USB DEVICE" }, ++ { "SONiX AK870 PRO" }, + { "Keychron" }, + { "AONE" }, + { "GANSS" }, +-- +2.51.0 + diff --git a/queue-6.6/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch b/queue-6.6/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch new file mode 100644 index 0000000000..f502106651 --- /dev/null +++ b/queue-6.6/hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch @@ -0,0 +1,80 @@ +From 4f21b1156f048493a837cc190bb8d18d428bb16b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 21:16:45 +0900 +Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F) + +From: Naoki Ueki + +[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ] + +The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which +shares the same report descriptor as the existing device (0x00FB). However, +the driver does not currently recognize this new ID, resulting in only five +buttons being functional. + +This patch adds the new device ID so that all six buttons work properly. + +Signed-off-by: Naoki Ueki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 6 ++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index 4fa45ee77503b..f76fec79e8903 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8); + break; +- case USB_DEVICE_ID_ELECOM_M_XT3URBK: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB: ++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F: + case USB_DEVICE_ID_ELECOM_M_XT3DRBK: + case USB_DEVICE_ID_ELECOM_M_XT4DRBK: + /* +@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static const struct hid_device_id elecom_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 6a538dca21a9a..ca9c70c8f3cf1 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -439,7 +439,8 @@ + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 + #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 +-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb ++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f + #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc + #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index fa946666969b8..2da21415e676c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -405,7 +405,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + #if IS_ENABLED(CONFIG_HID_ELECOM) + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, +-- +2.51.0 + diff --git a/queue-6.6/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch b/queue-6.6/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch new file mode 100644 index 0000000000..f1f6700325 --- /dev/null +++ b/queue-6.6/hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch @@ -0,0 +1,46 @@ +From d440f4a4b87ab8856103d9c74b17b753cd928bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:06:25 -0500 +Subject: HID: hid-input: Extend Elan ignore battery quirk to USB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello (AMD) + +[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ] + +USB Elan devices have the same problem as the I2C ones with a fake +battery device showing up. + +Reviewed-by: Hans de Goede +Reported-by: André Barata +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722 +Signed-off-by: Mario Limonciello (AMD) +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f073d5621050a..fa3efe9701c96 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), + HID_BATTERY_QUIRK_AVOID_QUERY }, + /* +- * Elan I2C-HID touchscreens seem to all report a non present battery, +- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices. ++ * Elan HID touchscreens seem to all report a non present battery, ++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices. + */ + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.6/loongarch-mask-all-interrupts-during-kexec-kdump.patch b/queue-6.6/loongarch-mask-all-interrupts-during-kexec-kdump.patch new file mode 100644 index 0000000000..e4f00a7a68 --- /dev/null +++ b/queue-6.6/loongarch-mask-all-interrupts-during-kexec-kdump.patch @@ -0,0 +1,48 @@ +From bf8926b3cf42d10572600389efa549a6187e4f64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 14:42:05 +0800 +Subject: LoongArch: Mask all interrupts during kexec/kdump + +From: Huacai Chen + +[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ] + +If the default state of the interrupt controllers in the first kernel +don't mask any interrupts, it may cause the second kernel to potentially +receive interrupts (which were previously allocated by the first kernel) +immediately after a CPU becomes online during its boot process. These +interrupts cannot be properly routed, leading to bad IRQ issues. + +This patch calls machine_kexec_mask_interrupts() to mask all interrupts +during the kexec/kdump process. + +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/machine_kexec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c +index 30aa420610a06..e50c9a81ff1aa 100644 +--- a/arch/loongarch/kernel/machine_kexec.c ++++ b/arch/loongarch/kernel/machine_kexec.c +@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs) + #ifdef CONFIG_SMP + crash_smp_send_stop(); + #endif ++ machine_kexec_mask_interrupts(); + cpumask_set_cpu(crashing_cpu, &cpus_in_crash); + + pr_info("Starting crashdump kernel...\n"); +@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image) + + /* We do not want to be bothered. */ + local_irq_disable(); ++ machine_kexec_mask_interrupts(); + + pr_notice("EFI boot flag 0x%lx\n", efi_boot); + pr_notice("Command line at 0x%lx\n", cmdline_ptr); +-- +2.51.0 + diff --git a/queue-6.6/nvme-fix-admin-request_queue-lifetime.patch b/queue-6.6/nvme-fix-admin-request_queue-lifetime.patch new file mode 100644 index 0000000000..b71ab9aa63 --- /dev/null +++ b/queue-6.6/nvme-fix-admin-request_queue-lifetime.patch @@ -0,0 +1,98 @@ +From db690b902086c7157f37445715338102be2a2eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Nov 2025 14:48:30 -0800 +Subject: nvme: fix admin request_queue lifetime + +From: Keith Busch + +[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ] + +The namespaces can access the controller's admin request_queue, and +stale references on the namespaces may exist after tearing down the +controller. Ensure the admin request_queue is active by moving the +controller's 'put' to after all controller references have been released +to ensure no one is can access the request_queue. This fixes a reported +use-after-free bug: + + BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 + Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 + CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 + Tainted: [E]=UNSIGNED_MODULE + Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 + Call Trace: + + dump_stack_lvl+0x4f/0x60 + print_report+0xc4/0x620 + ? _raw_spin_lock_irqsave+0x70/0xb0 + ? _raw_read_unlock_irqrestore+0x30/0x30 + ? blk_queue_enter+0x41c/0x4a0 + kasan_report+0xab/0xe0 + ? blk_queue_enter+0x41c/0x4a0 + blk_queue_enter+0x41c/0x4a0 + ? __irq_work_queue_local+0x75/0x1d0 + ? blk_queue_start_drain+0x70/0x70 + ? irq_work_queue+0x18/0x20 + ? vprintk_emit.part.0+0x1cc/0x350 + ? wake_up_klogd_work_func+0x60/0x60 + blk_mq_alloc_request+0x2b7/0x6b0 + ? __blk_mq_alloc_requests+0x1060/0x1060 + ? __switch_to+0x5b7/0x1060 + nvme_submit_user_cmd+0xa9/0x330 + nvme_user_cmd.isra.0+0x240/0x3f0 + ? force_sigsegv+0xe0/0xe0 + ? nvme_user_cmd64+0x400/0x400 + ? vfs_fileattr_set+0x9b0/0x9b0 + ? cgroup_update_frozen_flag+0x24/0x1c0 + ? cgroup_leave_frozen+0x204/0x330 + ? nvme_ioctl+0x7c/0x2c0 + blkdev_ioctl+0x1a8/0x4d0 + ? blkdev_common_ioctl+0x1930/0x1930 + ? fdget+0x54/0x380 + __x64_sys_ioctl+0x129/0x190 + do_syscall_64+0x5b/0x160 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + RIP: 0033:0x7f765f703b0b + Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b + RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 + R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 + R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 + + +Reported-by: Casey Chen +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Reviewed-by: Ming Lei +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 78d00e25a1790..f09ebcbe11798 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4318,7 +4318,6 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set); + void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl) + { + blk_mq_destroy_queue(ctrl->admin_q); +- blk_put_queue(ctrl->admin_q); + if (ctrl->ops->flags & NVME_F_FABRICS) { + blk_mq_destroy_queue(ctrl->fabrics_q); + blk_put_queue(ctrl->fabrics_q); +@@ -4463,6 +4462,8 @@ static void nvme_free_ctrl(struct device *dev) + container_of(dev, struct nvme_ctrl, ctrl_device); + struct nvme_subsystem *subsys = ctrl->subsys; + ++ if (ctrl->admin_q) ++ blk_put_queue(ctrl->admin_q); + if (!subsys || ctrl->instance != subsys->instance) + ida_free(&nvme_instance_ida, ctrl->instance); + +-- +2.51.0 + diff --git a/queue-6.6/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch b/queue-6.6/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch new file mode 100644 index 0000000000..3b653bb3ba --- /dev/null +++ b/queue-6.6/pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch @@ -0,0 +1,48 @@ +From ba8474ab92a3fbfa7848d6357e7723c0769a4719 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 15:40:41 +0530 +Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration + +From: Praveen Talari + +[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ] + +Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() +to prevent deadlock when wakeup IRQ is triggered on the same +GPIO being reconfigured. + +The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ +handler attempts to reconfigure the same GPIO's pinmux. In this scenario, +msm_pinmux_set_mux() calls disable_irq() which waits for the currently +running IRQ handler to complete, creating a circular dependency that +results in deadlock. + +Using disable_irq_nosync() avoids waiting for the IRQ handler to +complete, preventing the deadlock condition while still properly +disabling the interrupt during pinmux reconfiguration. + +Suggested-by: Prasad Sodagudi +Signed-off-by: Praveen Talari +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 13dc8bc1d0cff..688f3d01f4af8 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + */ + if (d && i != gpio_func && + !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux)) +- disable_irq(irq); ++ disable_irq_nosync(irq); + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-acer-wmi-ignore-backlight-event.patch b/queue-6.6/platform-x86-acer-wmi-ignore-backlight-event.patch new file mode 100644 index 0000000000..64b094e00d --- /dev/null +++ b/queue-6.6/platform-x86-acer-wmi-ignore-backlight-event.patch @@ -0,0 +1,54 @@ +From 9c85c9458eace3fff0e5392b5493d1124e218ba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 16:59:38 +0100 +Subject: platform/x86: acer-wmi: Ignore backlight event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ] + +On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI +firmware when the backlight up/down keys are pressed. Ignore this +event to avoid spamming the kernel log with error messages, as the +acpi-video driver already handles brightness up/down events. + +Reported-by: Bugaddr +Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues +Tested-by: Bugaddr +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 868faccfb8628..e7a43f824272f 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, ++ WMID_BACKLIGHT_EVENT = 0x4, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, + WMID_AC_EVENT = 0x8, +@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; ++ case WMID_BACKLIGHT_EVENT: ++ /* Already handled by acpi-video */ ++ break; + case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); + acer_kbd_dock_event(&return_value); +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch b/queue-6.6/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch new file mode 100644 index 0000000000..703a1f3fb9 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch @@ -0,0 +1,60 @@ +From 77c24369eb34bc3a173553db95c11e098fa57810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Oct 2025 15:50:57 +0200 +Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ] + +The Lenovo Legion Go 2 takes a long time to resume from suspend. +This is due to it having an nvme resume handler that interferes +with IOMMU mappings. It is a common issue with older Lenovo +laptops. Adding it to that quirk list fixes this issue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618 +Suggested-by: Mario Limonciello +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 9fd2829ee2ab4..271cbeaa59af3 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -198,6 +198,23 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), + } + }, ++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */ ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"), ++ } ++ }, ++ { ++ .ident = "Lenovo Legion Go 2", ++ .driver_data = &quirk_s2idle_bug, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"), ++ } ++ }, + /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ + { + .ident = "HP Laptop 15s-eq2xxx", +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch b/queue-6.6/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch new file mode 100644 index 0000000000..370ce25fc1 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch @@ -0,0 +1,54 @@ +From c0adab8801d3371352d3c591152670795d7ae44a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 17:21:51 +0200 +Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ] + +The Xbox Ally features a Van Gogh SoC that has spurious interrupts +during resume. We get the following logs: + +atkbd_receive_byte: 20 callbacks suppressed +atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly. + +So, add the spurious_8042 quirk for it. It does not have a keyboard, so +this does not result in any functional loss. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 271cbeaa59af3..a5031339dac8c 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -116,6 +116,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), + } + }, ++ { ++ .ident = "ROG Xbox Ally RC73YA", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */ + { + .ident = "V14 G4 AMN", +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-huawei-wmi-add-keys-for-honor-models.patch b/queue-6.6/platform-x86-huawei-wmi-add-keys-for-honor-models.patch new file mode 100644 index 0000000000..1eba8b7a8a --- /dev/null +++ b/queue-6.6/platform-x86-huawei-wmi-add-keys-for-honor-models.patch @@ -0,0 +1,47 @@ +From af281cd54bfe236ed7d0e22cba9337ddf172afe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Oct 2025 05:18:38 +0000 +Subject: platform/x86: huawei-wmi: add keys for HONOR models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jia Ston + +[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ] + +HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print +Screen and YOYO keys properly, with the system reporting them as +unknown key presses (codes: 0x028b and 0x028e). + +To resolve this, a key_entry is added for both the HONOR Print Screen +key and the HONOR YOYO key, ensuring they function correctly on these +models. + +Signed-off-by: Ston Jia +Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index 0ef1c46b617b6..29ef391d33052 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_KEY, 0x289, { KEY_WLAN } }, + // Huawei |M| key + { KE_KEY, 0x28a, { KEY_CONFIG } }, ++ // HONOR YOYO key ++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, ++ // HONOR print screen ++ { KE_KEY, 0x28e, { KEY_PRINT } }, + // Keyboard backlit + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, +-- +2.51.0 + diff --git a/queue-6.6/samples-work-around-glibc-redefining-some-of-our-def.patch b/queue-6.6/samples-work-around-glibc-redefining-some-of-our-def.patch new file mode 100644 index 0000000000..dafba99616 --- /dev/null +++ b/queue-6.6/samples-work-around-glibc-redefining-some-of-our-def.patch @@ -0,0 +1,94 @@ +From f853b8d5620f6eaf3f0151a21e506600fe1603df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 09:29:02 -0800 +Subject: samples: work around glibc redefining some of our defines wrong + +From: Linus Torvalds + +[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ] + +Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE +and some of the other flags for renameat2() and friends in . + +Which would all be fine, except for inexplicable reasons glibc decided +to define them _differently_ from the kernel definitions, which then +makes some of our sample code that includes both kernel headers and user +space headers unhappy, because the compiler will (correctly) complain +about redefining things. + +Now, mixing kernel headers and user space headers is always a somewhat +iffy proposition due to namespacing issues, but it's kind of inevitable +in our sample and selftest code. And this is just glibc being stupid. + +Those defines come from the kernel, glibc is exposing the kernel +interfaces, and glibc shouldn't make up some random new expressions for +these values. + +It's not like glibc headers changed the actual result values, but they +arbitrarily just decided to use a different expression to describe those +values. The kernel just does + + #define AT_RENAME_NOREPLACE 0x0001 + +while glibc does + + # define RENAME_NOREPLACE (1 << 0) + # define AT_RENAME_NOREPLACE RENAME_NOREPLACE + +instead. Same value in the end, but very different macro definition. + +For absolutely no reason. + +This has since been fixed in the glibc development tree, so eventually +we'll end up with the canonical expressions and no clashes. But in the +meantime the broken headers are in the glibc-2.42 release and have made +it out into distributions. + +Do a minimal work-around to make the samples build cleanly by just +undefining the affected macros in between the user space header include +and the kernel header includes. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/vfs/test-statx.c | 6 ++++++ + samples/watch_queue/watch_test.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c +index 49c7a46cee073..424a6fa15723c 100644 +--- a/samples/vfs/test-statx.c ++++ b/samples/vfs/test-statx.c +@@ -19,6 +19,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #define statx foo +diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c +index 8c6cb57d5cfc5..24cf7d7a19725 100644 +--- a/samples/watch_queue/watch_test.c ++++ b/samples/watch_queue/watch_test.c +@@ -16,6 +16,12 @@ + #include + #include + #include ++ ++// Work around glibc header silliness ++#undef AT_RENAME_NOREPLACE ++#undef AT_RENAME_EXCHANGE ++#undef AT_RENAME_WHITEOUT ++ + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 244f90a9d3..c4edd7cc45 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -3,3 +3,23 @@ revert-xfrm-destroy-xfrm_state-synchronously-on-net-.patch xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch xfrm-flush-all-states-in-xfrm_state_fini.patch leds-spi-byte-use-devm_led_classdev_register_ext.patch +ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch +spi-xilinx-increase-number-of-retries-before-declari.patch +spi-imx-keep-dma-request-disabled-before-dma-transfe.patch +dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch +drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch +bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch +smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch +alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch +bfs-reconstruct-file-type-when-loading-from-disk.patch +hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch +nvme-fix-admin-request_queue-lifetime.patch +pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch +platform-x86-acer-wmi-ignore-backlight-event.patch +hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch +platform-x86-huawei-wmi-add-keys-for-honor-models.patch +platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch +platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch +hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch +loongarch-mask-all-interrupts-during-kexec-kdump.patch +samples-work-around-glibc-redefining-some-of-our-def.patch diff --git a/queue-6.6/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch b/queue-6.6/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch new file mode 100644 index 0000000000..feb19bf3df --- /dev/null +++ b/queue-6.6/smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch @@ -0,0 +1,38 @@ +From 11bd38f0ee8b09c925e0b8618a445f82385ceb7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 15:05:39 +0800 +Subject: smb: fix invalid username check in smb3_fs_context_parse_param() + +From: Yiqi Sun + +[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ] + +Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) +is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() +is always FALSE and invalid. + +Fix the comparison in if statement. + +Signed-off-by: Yiqi Sun +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index a64c0b0dbec78..6358f2483c869 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -1386,7 +1386,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + break; + } + +- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) > ++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) == + CIFS_MAX_USERNAME_LEN) { + pr_warn("username too long\n"); + goto cifs_parse_mount_err; +-- +2.51.0 + diff --git a/queue-6.6/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch b/queue-6.6/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch new file mode 100644 index 0000000000..e0913f5b9c --- /dev/null +++ b/queue-6.6/spi-imx-keep-dma-request-disabled-before-dma-transfe.patch @@ -0,0 +1,69 @@ +From a5478ca7d8a4192ce0ac6e10b4389fd0d26394c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Oct 2025 13:53:20 +0800 +Subject: spi: imx: keep dma request disabled before dma transfer setup + +From: Robin Gong + +[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ] + +Since sdma hardware configure postpone to transfer phase, have to disable +dma request before dma transfer setup because there is a hardware +limitation on sdma event enable(ENBLn) as below: + +"It is thus essential for the Arm platform to program them before any DMA + request is triggered to the SDMA, otherwise an unpredictable combination + of channels may be started." + +Signed-off-by: Carlos Song +Signed-off-by: Robin Gong +Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index da4442954375b..76f8747c29432 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) + { + u32 reg; + +- reg = readl(spi_imx->base + MX51_ECSPI_CTRL); +- reg |= MX51_ECSPI_CTRL_XCH; +- writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ if (spi_imx->usedma) { ++ reg = readl(spi_imx->base + MX51_ECSPI_DMA); ++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN; ++ writel(reg, spi_imx->base + MX51_ECSPI_DMA); ++ } else { ++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL); ++ reg |= MX51_ECSPI_CTRL_XCH; ++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL); ++ } + } + + static void mx51_ecspi_disable(struct spi_imx_data *spi_imx) +@@ -699,7 +705,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx) + writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) | + MX51_ECSPI_DMA_TX_WML(tx_wml) | + MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) | +- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN | + MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA); + } + +@@ -1458,6 +1463,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx, + reinit_completion(&spi_imx->dma_tx_completion); + dma_async_issue_pending(controller->dma_tx); + ++ spi_imx->devtype_data->trigger(spi_imx); ++ + transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len); + + /* Wait SDMA to finish the data transfer.*/ +-- +2.51.0 + diff --git a/queue-6.6/spi-xilinx-increase-number-of-retries-before-declari.patch b/queue-6.6/spi-xilinx-increase-number-of-retries-before-declari.patch new file mode 100644 index 0000000000..df4a18959c --- /dev/null +++ b/queue-6.6/spi-xilinx-increase-number-of-retries-before-declari.patch @@ -0,0 +1,42 @@ +From 6b86a9a708166b61d8035692e251e8fef56309b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:45:35 +0100 +Subject: spi: xilinx: increase number of retries before declaring stall + +From: Alvaro Gamez Machado + +[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ] + +SPI devices using a (relative) slow frequency need a larger time. + +For instance, microblaze running at 83.25MHz and performing a +3 bytes transaction using a 10MHz/16 = 625kHz needed this stall +value increased to at least 20. The SPI device is quite slow, but +also is the microblaze, so set this value to 32 to give it even +more margin. + +Signed-off-by: Alvaro Gamez Machado +Reviewed-by: Ricardo Ribalda +Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c +index 8e6e3876aa9af..b5405d9974ba6 100644 +--- a/drivers/spi/spi-xilinx.c ++++ b/drivers/spi/spi-xilinx.c +@@ -299,7 +299,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) + + /* Read out all the data from the Rx FIFO */ + rx_words = n_words; +- stalled = 10; ++ stalled = 32; + while (rx_words) { + if (rx_words == n_words && !(stalled--) && + !(sr & XSPI_SR_TX_EMPTY_MASK) && +-- +2.51.0 +