From ab10ae6305b18435fa0802cf69f0838f441a12b2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 29 Sep 2025 13:48:24 +0200 Subject: [PATCH] 6.16-stable patches added patches: arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch tracing-fgraph-protect-return-handler-from-recursion-loop.patch tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch vhost-net-flush-batched-before-enabling-notifications.patch --- ...a-fix-mdio-bus-probe-and-phy-address.patch | 43 +++++++ ...earfog-disable-emmc-high-speed-modes.patch | 43 +++++++ ...g-fix-multi-lane-pci-x2-and-x4-ports.patch | 65 +++++++++++ ...n913x-solidrun-fix-sata-ports-status.patch | 103 ++++++++++++++++ ...correct-boolean-values-in-af_alg_ctx.patch | 43 +++++++ ...ht-after-amdgpu_dm_init-or-dm_resume.patch | 110 ++++++++++++++++++ ...leep-instead-of-mdelay-for-edid-read.patch | 40 +++++++ ...y-pinned-kernel-bos-twice-on-suspend.patch | 57 +++++++++ ...roha-fix-wrong-mdio-function-bitmaks.patch | 80 +++++++++++++ ...ng-phy-led-mux-value-for-led1-gpio46.patch | 79 +++++++++++++ ...-queue-re-enable-until-after-sendmsg.patch | 92 +++++++++++++++ queue-6.16/series | 15 +++ ...a-missing-lockdown-check-on-dynevent.patch | 36 ++++++ ...t-return-handler-from-recursion-loop.patch | 81 +++++++++++++ ...ecorded-module-addresses-from-filter.patch | 51 ++++++++ ...atched-before-enabling-notifications.patch | 43 +++++++ 16 files changed, 981 insertions(+) create mode 100644 queue-6.16/arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch create mode 100644 queue-6.16/arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch create mode 100644 queue-6.16/arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch create mode 100644 queue-6.16/arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch create mode 100644 queue-6.16/crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch create mode 100644 queue-6.16/drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch create mode 100644 queue-6.16/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch create mode 100644 queue-6.16/drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch create mode 100644 queue-6.16/pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch create mode 100644 queue-6.16/pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch create mode 100644 queue-6.16/revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch create mode 100644 queue-6.16/tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch create mode 100644 queue-6.16/tracing-fgraph-protect-return-handler-from-recursion-loop.patch create mode 100644 queue-6.16/tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch create mode 100644 queue-6.16/vhost-net-flush-batched-before-enabling-notifications.patch diff --git a/queue-6.16/arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch b/queue-6.16/arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch new file mode 100644 index 0000000000..0137e7ce51 --- /dev/null +++ b/queue-6.16/arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch @@ -0,0 +1,43 @@ +From ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 Mon Sep 17 00:00:00 2001 +From: Nobuhiro Iwamatsu +Date: Thu, 21 Nov 2024 16:13:25 +0900 +Subject: ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address + +From: Nobuhiro Iwamatsu + +commit ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 upstream. + +On SoCFPGA/Sodia board, mdio bus cannot be probed, so the PHY cannot be +found and the network device does not work. + +``` +stmmaceth ff702000.ethernet eth0: __stmmac_open: Cannot attach to PHY (error: -19) +``` + +To probe the mdio bus, add "snps,dwmac-mdio" as compatible string of the +mdio bus. Also the PHY address connected to this board is 4. Therefore, +change to 4. + +Cc: stable@vger.kernel.org # 6.3+ +Signed-off-by: Nobuhiro Iwamatsu +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts ++++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts +@@ -66,8 +66,10 @@ + mdio0 { + #address-cells = <1>; + #size-cells = <0>; +- phy0: ethernet-phy@0 { +- reg = <0>; ++ compatible = "snps,dwmac-mdio"; ++ ++ phy0: ethernet-phy@4 { ++ reg = <4>; + rxd0-skew-ps = <0>; + rxd1-skew-ps = <0>; + rxd2-skew-ps = <0>; diff --git a/queue-6.16/arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch b/queue-6.16/arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch new file mode 100644 index 0000000000..2171d9d169 --- /dev/null +++ b/queue-6.16/arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch @@ -0,0 +1,43 @@ +From 48b51799a5461707705454568453618cdd7307f4 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Thu, 11 Sep 2025 20:28:05 +0200 +Subject: arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes + +From: Josua Mayer + +commit 48b51799a5461707705454568453618cdd7307f4 upstream. + +Similar to MacchiatoBIN the high-speed modes are unstable on the CN9132 +CEX-7 module, leading to failed transactions under normal use. + +Disable all high-speed modes including UHS. + +Additionally add no-sdio and non-removable properties as appropriate for +eMMC. + +Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board") +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi ++++ b/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi +@@ -137,6 +137,14 @@ + pinctrl-0 = <&ap_mmc0_pins>; + pinctrl-names = "default"; + vqmmc-supply = <&v_1_8>; ++ /* ++ * Not stable in HS modes - phy needs "more calibration", so disable ++ * UHS (by preventing voltage switch), SDR104, SDR50 and DDR50 modes. ++ */ ++ no-1-8-v; ++ no-sd; ++ no-sdio; ++ non-removable; + status = "okay"; + }; + diff --git a/queue-6.16/arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch b/queue-6.16/arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch new file mode 100644 index 0000000000..46d252434f --- /dev/null +++ b/queue-6.16/arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch @@ -0,0 +1,65 @@ +From 794a066688038df46c01e177cc6faebded0acba4 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Thu, 11 Sep 2025 20:28:06 +0200 +Subject: arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports + +From: Josua Mayer + +commit 794a066688038df46c01e177cc6faebded0acba4 upstream. + +The mvebu-comphy driver does not currently know how to pass correct +lane-count to ATF while configuring the serdes lanes. + +This causes the system to hard reset during reconfiguration, if a pci +card is present and has established a link during bootloader. + +Remove the comphy handles from the respective pci nodes to avoid runtime +reconfiguration, relying solely on bootloader configuration - while +avoiding the hard reset. + +When bootloader has configured the lanes correctly, the pci ports are +functional under Linux. + +This issue may be addressed in the comphy driver at a future point. + +Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board") +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts ++++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts +@@ -413,7 +413,13 @@ + /* SRDS #0,#1,#2,#3 - PCIe */ + &cp0_pcie0 { + num-lanes = <4>; +- phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>; ++ /* ++ * The mvebu-comphy driver does not currently know how to pass correct ++ * lane-count to ATF while configuring the serdes lanes. ++ * Rely on bootloader configuration only. ++ * ++ * phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>; ++ */ + status = "okay"; + }; + +@@ -475,7 +481,13 @@ + /* SRDS #0,#1 - PCIe */ + &cp1_pcie0 { + num-lanes = <2>; +- phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>; ++ /* ++ * The mvebu-comphy driver does not currently know how to pass correct ++ * lane-count to ATF while configuring the serdes lanes. ++ * Rely on bootloader configuration only. ++ * ++ * phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>; ++ */ + status = "okay"; + }; + diff --git a/queue-6.16/arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch b/queue-6.16/arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch new file mode 100644 index 0000000000..124bbf5808 --- /dev/null +++ b/queue-6.16/arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch @@ -0,0 +1,103 @@ +From d3021e6aa11fecdafa85038a037c04d5bfeda9d5 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Thu, 11 Sep 2025 20:28:04 +0200 +Subject: arm64: dts: marvell: cn913x-solidrun: fix sata ports status + +From: Josua Mayer + +commit d3021e6aa11fecdafa85038a037c04d5bfeda9d5 upstream. + +Commit "arm64: dts: marvell: only enable complete sata nodes" changed +armada-cp11x.dtsi disabling all sata ports status by default. + +The author missed some dts which relied on the dtsi enabling all ports, +and just disabled unused ones instead. + +Update dts for SolidRun cn913x based boards to enable the available +ports, rather than disabling the unvavailable one. + +Further according to dt bindings the serdes phys are to be specified in +the port node, not the controller node. +Move those phys properties accordingly in clearfog base/pro/solidwan. + +Fixes: 30023876aef4 ("arm64: dts: marvell: only enable complete sata nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/marvell/cn9130-cf.dtsi | 7 ++++--- + arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts | 6 ++++-- + arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 6 ++---- + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi +index ad0ab34b6602..bd42bfbe408b 100644 +--- a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi ++++ b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi +@@ -152,11 +152,12 @@ expander0_pins: cp0-expander0-pins { + + /* SRDS #0 - SATA on M.2 connector */ + &cp0_sata0 { +- phys = <&cp0_comphy0 1>; + status = "okay"; + +- /* only port 1 is available */ +- /delete-node/ sata-port@0; ++ sata-port@1 { ++ phys = <&cp0_comphy0 1>; ++ status = "okay"; ++ }; + }; + + /* microSD */ +diff --git a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts +index 47234d0858dd..338853d3b179 100644 +--- a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts ++++ b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts +@@ -563,11 +563,13 @@ &cp1_rtc { + + /* SRDS #1 - SATA on M.2 (J44) */ + &cp1_sata0 { +- phys = <&cp1_comphy1 0>; + status = "okay"; + + /* only port 0 is available */ +- /delete-node/ sata-port@1; ++ sata-port@0 { ++ phys = <&cp1_comphy1 0>; ++ status = "okay"; ++ }; + }; + + &cp1_syscon0 { +diff --git a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts +index 0f53745a6fa0..115c55d73786 100644 +--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts ++++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts +@@ -512,10 +512,9 @@ &cp1_sata0 { + status = "okay"; + + /* only port 1 is available */ +- /delete-node/ sata-port@0; +- + sata-port@1 { + phys = <&cp1_comphy3 1>; ++ status = "okay"; + }; + }; + +@@ -631,9 +630,8 @@ &cp2_sata0 { + status = "okay"; + + /* only port 1 is available */ +- /delete-node/ sata-port@0; +- + sata-port@1 { ++ status = "okay"; + phys = <&cp2_comphy3 1>; + }; + }; +-- +2.51.0 + diff --git a/queue-6.16/crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch b/queue-6.16/crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch new file mode 100644 index 0000000000..c505c6a69d --- /dev/null +++ b/queue-6.16/crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch @@ -0,0 +1,43 @@ +From d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Wed, 24 Sep 2025 13:18:22 -0700 +Subject: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx + +From: Eric Biggers + +commit d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb upstream. + +Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in +af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of +type u32. + +However, some assignments to these fields, specifically 'more' and +'merge', assign values greater than 1. These relied on C's implicit +conversion to bool, such that zero becomes false and nonzero becomes +true. + +With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken +instead, resulting in 0 being assigned in some cases when 1 was intended. + +Fix this by restoring the bool type. + +Fixes: 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/crypto/if_alg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -152,7 +152,7 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- u32 more:1, ++ bool more:1, + merge:1, + enc:1, + write:1, diff --git a/queue-6.16/drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch b/queue-6.16/drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch new file mode 100644 index 0000000000..d9f1be7dec --- /dev/null +++ b/queue-6.16/drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch @@ -0,0 +1,110 @@ +From 44b0fed0a5947f54fd14255cd0766df952267bc5 Mon Sep 17 00:00:00 2001 +From: Matthew Schwartz +Date: Thu, 11 Sep 2025 10:48:51 -0700 +Subject: drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume + +From: Matthew Schwartz + +commit 44b0fed0a5947f54fd14255cd0766df952267bc5 upstream. + +On clients that utilize AMD_PRIVATE_COLOR properties for HDR support, +brightness sliders can include a hardware controlled portion and a +gamma-based portion. This is the case on the Steam Deck OLED when using +gamescope with Steam as a client. + +When a user sets a brightness level while HDR is active, the gamma-based +portion and/or hardware portion are adjusted to achieve the desired +brightness. However, when a modeset takes place while the gamma-based +portion is in-use, restoring the hardware brightness level overrides the +user's overall brightness level and results in a mismatch between what +the slider reports and the display's current brightness. + +To avoid overriding gamma-based brightness, only restore HW backlight +level after boot or resume. This ensures that the backlight level is +set correctly after the DC layer resets it while avoiding interference +with subsequent modesets. + +Fixes: 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4551 +Signed-off-by: Matthew Schwartz +Reviewed-by: Mario Limonciello +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit a490c8d77d500b5981e739be3d59c60cfe382536) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++---- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 +++++++ + 2 files changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2035,6 +2035,8 @@ static int amdgpu_dm_init(struct amdgpu_ + + dc_hardware_init(adev->dm.dc); + ++ adev->dm.restore_backlight = true; ++ + adev->dm.hpd_rx_offload_wq = hpd_rx_irq_create_workqueue(adev); + if (!adev->dm.hpd_rx_offload_wq) { + drm_err(adev_to_drm(adev), "amdgpu: failed to create hpd rx offload workqueue.\n"); +@@ -3396,6 +3398,7 @@ static int dm_resume(struct amdgpu_ip_bl + dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0); + + dc_resume(dm->dc); ++ adev->dm.restore_backlight = true; + + amdgpu_dm_irq_resume_early(adev); + +@@ -9801,7 +9804,6 @@ static void amdgpu_dm_commit_streams(str + bool mode_set_reset_required = false; + u32 i; + struct dc_commit_streams_params params = {dc_state->streams, dc_state->stream_count}; +- bool set_backlight_level = false; + + /* Disable writeback */ + for_each_old_connector_in_state(state, connector, old_con_state, i) { +@@ -9921,7 +9923,6 @@ static void amdgpu_dm_commit_streams(str + acrtc->hw_mode = new_crtc_state->mode; + crtc->hwmode = new_crtc_state->mode; + mode_set_reset_required = true; +- set_backlight_level = true; + } else if (modereset_required(new_crtc_state)) { + drm_dbg_atomic(dev, + "Atomic commit: RESET. crtc id %d:[%p]\n", +@@ -9978,13 +9979,16 @@ static void amdgpu_dm_commit_streams(str + * to fix a flicker issue. + * It will cause the dm->actual_brightness is not the current panel brightness + * level. (the dm->brightness is the correct panel level) +- * So we set the backlight level with dm->brightness value after set mode ++ * So we set the backlight level with dm->brightness value after initial ++ * set mode. Use restore_backlight flag to avoid setting backlight level ++ * for every subsequent mode set. + */ +- if (set_backlight_level) { ++ if (dm->restore_backlight) { + for (i = 0; i < dm->num_of_edps; i++) { + if (dm->backlight_dev[i]) + amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]); + } ++ dm->restore_backlight = false; + } + } + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -611,6 +611,13 @@ struct amdgpu_display_manager { + u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP]; + + /** ++ * @restore_backlight: ++ * ++ * Flag to indicate whether to restore backlight after modeset. ++ */ ++ bool restore_backlight; ++ ++ /** + * @aux_hpd_discon_quirk: + * + * quirk for hpd discon while aux is on-going. diff --git a/queue-6.16/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch b/queue-6.16/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch new file mode 100644 index 0000000000..9716652d4e --- /dev/null +++ b/queue-6.16/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch @@ -0,0 +1,40 @@ +From c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 Mon Sep 17 00:00:00 2001 +From: Nirmoy Das +Date: Wed, 17 Sep 2025 12:43:46 -0700 +Subject: drm/ast: Use msleep instead of mdelay for edid read + +From: Nirmoy Das + +commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 upstream. + +The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts +during boot. + +Signed-off-by: Nirmoy Das +Reviewed-by: Thomas Zimmermann +Tested-by: Carol L Soto csoto@nvidia.com +Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port") +Cc: KuoHsiang Chou +Cc: Thomas Zimmermann +Cc: Dave Airlie +Cc: Jocelyn Falempe +Cc: dri-devel@lists.freedesktop.org +Cc: # v5.19+ +Signed-off-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ast/ast_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ast/ast_dp.c ++++ b/drivers/gpu/drm/ast/ast_dp.c +@@ -134,7 +134,7 @@ static int ast_astdp_read_edid_block(voi + * 3. The Delays are often longer a lot when system resume from S3/S4. + */ + if (j) +- mdelay(j + 1); ++ msleep(j + 1); + + /* Wait for EDID offset to show up in mirror register */ + vgacrd7 = ast_get_index_reg(ast, AST_IO_VGACRI, 0xd7); diff --git a/queue-6.16/drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch b/queue-6.16/drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch new file mode 100644 index 0000000000..555dca576d --- /dev/null +++ b/queue-6.16/drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch @@ -0,0 +1,57 @@ +From 77c8ede611c6a70a95f7b15648551d0121b40d6c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= +Date: Thu, 18 Sep 2025 11:22:05 +0200 +Subject: drm/xe: Don't copy pinned kernel bos twice on suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Hellström + +commit 77c8ede611c6a70a95f7b15648551d0121b40d6c upstream. + +We were copying the bo content the bos on the list +"xe->pinned.late.kernel_bo_present" twice on suspend. + +Presumingly the intent is to copy the pinned external bos on +the first pass. + +This is harmless since we (currently) should have no pinned +external bos needing copy since +a) exernal system bos don't have compressed content, +b) We do not (yet) allow pinning of VRAM bos. + +Still, fix this up so that we copy pinned external bos on +the first pass. We're about to allow bos pinned in VRAM. + +Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") +Cc: Matthew Auld +Cc: # v6.16+ +Signed-off-by: Thomas Hellström +Reviewed-by: Matthew Auld +Link: https://lore.kernel.org/r/20250918092207.54472-2-thomas.hellstrom@linux.intel.com +(cherry picked from commit 9e69bafece43dcefec864f00b3ec7e088aa7fcbc) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_bo_evict.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c +index 7484ce55a303..d5dbc51e8612 100644 +--- a/drivers/gpu/drm/xe/xe_bo_evict.c ++++ b/drivers/gpu/drm/xe/xe_bo_evict.c +@@ -158,8 +158,8 @@ int xe_bo_evict_all(struct xe_device *xe) + if (ret) + return ret; + +- ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present, +- &xe->pinned.late.evicted, xe_bo_evict_pinned); ++ ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.external, ++ &xe->pinned.late.external, xe_bo_evict_pinned); + + if (!ret) + ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present, +-- +2.51.0 + diff --git a/queue-6.16/pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch b/queue-6.16/pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch new file mode 100644 index 0000000000..35c50c2a02 --- /dev/null +++ b/queue-6.16/pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch @@ -0,0 +1,80 @@ +From a061e739d36220c002da8b2429d5f16f637eb59a Mon Sep 17 00:00:00 2001 +From: Christian Marangi +Date: Mon, 8 Sep 2025 13:37:19 +0200 +Subject: pinctrl: airoha: fix wrong MDIO function bitmaks + +From: Christian Marangi + +commit a061e739d36220c002da8b2429d5f16f637eb59a upstream. + +With further testing with an attached Aeonsemi it was discovered that +the pinctrl MDIO function applied the wrong bitmask. The error was +probably caused by the confusing documentation related to these bits. + +Inspecting what the bootloader actually configure, the SGMII_MDIO_MODE +is never actually set but instead it's set force enable to the 2 GPIO +(gpio 1-2) for MDC and MDIO pin. + +The usage of GPIO might be confusing but this is just to instruct the +SoC to not mess with those 2 PIN and as Benjamin reported it's also an +Errata of 7581. The FORCE_GPIO_EN doesn't set them as GPIO function +(that is configured by a different register) but it's really to actually +""enable"" those lines. + +Normally the SoC should autodetect this by HW but it seems AN7581 have +problem with this and require this workaround to force enable the 2 pin. + +Applying this configuration permits correct functionality of any +externally attached PHY. + +Cc: stable@vger.kernel.org +Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC") +Signed-off-by: Christian Marangi +Acked-by: Benjamin Larsson +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/mediatek/pinctrl-airoha.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c +index ee5b9bab4552..b405dfa20891 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c ++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c +@@ -108,6 +108,9 @@ + #define JTAG_UDI_EN_MASK BIT(4) + #define JTAG_DFD_EN_MASK BIT(3) + ++#define REG_FORCE_GPIO_EN 0x0228 ++#define FORCE_GPIO_EN(n) BIT(n) ++ + /* LED MAP */ + #define REG_LAN_LED0_MAPPING 0x027c + #define REG_LAN_LED1_MAPPING 0x0280 +@@ -718,17 +721,17 @@ static const struct airoha_pinctrl_func_group mdio_func_group[] = { + { + .name = "mdio", + .regmap[0] = { +- AIROHA_FUNC_MUX, +- REG_GPIO_PON_MODE, +- GPIO_SGMII_MDIO_MODE_MASK, +- GPIO_SGMII_MDIO_MODE_MASK +- }, +- .regmap[1] = { + AIROHA_FUNC_MUX, + REG_GPIO_2ND_I2C_MODE, + GPIO_MDC_IO_MASTER_MODE_MODE, + GPIO_MDC_IO_MASTER_MODE_MODE + }, ++ .regmap[1] = { ++ AIROHA_FUNC_MUX, ++ REG_FORCE_GPIO_EN, ++ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2), ++ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2) ++ }, + .regmap_size = 2, + }, + }; +-- +2.51.0 + diff --git a/queue-6.16/pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch b/queue-6.16/pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch new file mode 100644 index 0000000000..7cb2c066b7 --- /dev/null +++ b/queue-6.16/pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch @@ -0,0 +1,79 @@ +From 6f9674aa69ad0178ca8fc6995942ba9848c324f4 Mon Sep 17 00:00:00 2001 +From: Christian Marangi +Date: Mon, 8 Sep 2025 13:34:24 +0200 +Subject: pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 + +From: Christian Marangi + +commit 6f9674aa69ad0178ca8fc6995942ba9848c324f4 upstream. + +In all the MUX value for LED1 GPIO46 there is a Copy-Paste error where +the MUX value is set to LED0_MODE_MASK instead of LED1_MODE_MASK. + +This wasn't notice as there were no board that made use of the +secondary PHY LED but looking at the internal Documentation the actual +value should be LED1_MODE_MASK similar to the other GPIO entry. + +Fix the wrong value to apply the correct MUX configuration. + +Cc: stable@vger.kernel.org +Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC") +Signed-off-by: Christian Marangi +Acked-by: Lorenzo Bianconi +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/mediatek/pinctrl-airoha.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c +index 1b2f132d76f0..ee5b9bab4552 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c ++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c +@@ -1752,8 +1752,8 @@ static const struct airoha_pinctrl_func_group phy1_led1_func_group[] = { + .regmap[0] = { + AIROHA_FUNC_MUX, + REG_GPIO_2ND_I2C_MODE, +- GPIO_LAN3_LED0_MODE_MASK, +- GPIO_LAN3_LED0_MODE_MASK ++ GPIO_LAN3_LED1_MODE_MASK, ++ GPIO_LAN3_LED1_MODE_MASK + }, + .regmap[1] = { + AIROHA_FUNC_MUX, +@@ -1816,8 +1816,8 @@ static const struct airoha_pinctrl_func_group phy2_led1_func_group[] = { + .regmap[0] = { + AIROHA_FUNC_MUX, + REG_GPIO_2ND_I2C_MODE, +- GPIO_LAN3_LED0_MODE_MASK, +- GPIO_LAN3_LED0_MODE_MASK ++ GPIO_LAN3_LED1_MODE_MASK, ++ GPIO_LAN3_LED1_MODE_MASK + }, + .regmap[1] = { + AIROHA_FUNC_MUX, +@@ -1880,8 +1880,8 @@ static const struct airoha_pinctrl_func_group phy3_led1_func_group[] = { + .regmap[0] = { + AIROHA_FUNC_MUX, + REG_GPIO_2ND_I2C_MODE, +- GPIO_LAN3_LED0_MODE_MASK, +- GPIO_LAN3_LED0_MODE_MASK ++ GPIO_LAN3_LED1_MODE_MASK, ++ GPIO_LAN3_LED1_MODE_MASK + }, + .regmap[1] = { + AIROHA_FUNC_MUX, +@@ -1944,8 +1944,8 @@ static const struct airoha_pinctrl_func_group phy4_led1_func_group[] = { + .regmap[0] = { + AIROHA_FUNC_MUX, + REG_GPIO_2ND_I2C_MODE, +- GPIO_LAN3_LED0_MODE_MASK, +- GPIO_LAN3_LED0_MODE_MASK ++ GPIO_LAN3_LED1_MODE_MASK, ++ GPIO_LAN3_LED1_MODE_MASK + }, + .regmap[1] = { + AIROHA_FUNC_MUX, +-- +2.51.0 + diff --git a/queue-6.16/revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch b/queue-6.16/revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch new file mode 100644 index 0000000000..5f59bc625d --- /dev/null +++ b/queue-6.16/revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch @@ -0,0 +1,92 @@ +From 4174152771bf0d014d58f7d7e148bb0c8830fe53 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Wed, 17 Sep 2025 14:30:44 +0800 +Subject: Revert "vhost/net: Defer TX queue re-enable until after sendmsg" + +From: Michael S. Tsirkin + +commit 4174152771bf0d014d58f7d7e148bb0c8830fe53 upstream. + +This reverts commit 8c2e6b26ffe243be1e78f5a4bfb1a857d6e6f6d6. It tries +to defer the notification enabling by moving the logic out of the loop +after the vhost_tx_batch() when nothing new is spotted. This will +bring side effects as the new logic would be reused for several other +error conditions. + +One example is the IOTLB: when there's an IOTLB miss, get_tx_bufs() +might return -EAGAIN and exit the loop and see there's still available +buffers, so it will queue the tx work again until userspace feed the +IOTLB entry correctly. This will slowdown the tx processing and +trigger the TX watchdog in the guest as reported in +https://lkml.org/lkml/2025/9/10/1596. + +To fix, revert the change. A follow up patch will bring the performance +back in a safe way. + +Reported-by: Jon Kohler +Cc: stable@vger.kernel.org +Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg") +Signed-off-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Message-Id: <20250917063045.2042-2-jasowang@redhat.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/net.c | 30 +++++++++--------------------- + 1 file changed, 9 insertions(+), 21 deletions(-) + +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -760,10 +760,10 @@ static void handle_tx_copy(struct vhost_ + int err; + int sent_pkts = 0; + bool sock_can_batch = (sock->sk->sk_sndbuf == INT_MAX); +- bool busyloop_intr; + + do { +- busyloop_intr = false; ++ bool busyloop_intr = false; ++ + if (nvq->done_idx == VHOST_NET_BATCH) + vhost_tx_batch(net, nvq, sock, &msg); + +@@ -774,10 +774,13 @@ static void handle_tx_copy(struct vhost_ + break; + /* Nothing new? Wait for eventfd to tell us they refilled. */ + if (head == vq->num) { +- /* Kicks are disabled at this point, break loop and +- * process any remaining batched packets. Queue will +- * be re-enabled afterwards. +- */ ++ if (unlikely(busyloop_intr)) { ++ vhost_poll_queue(&vq->poll); ++ } else if (unlikely(vhost_enable_notify(&net->dev, ++ vq))) { ++ vhost_disable_notify(&net->dev, vq); ++ continue; ++ } + break; + } + +@@ -827,22 +830,7 @@ done: + ++nvq->done_idx; + } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len))); + +- /* Kicks are still disabled, dispatch any remaining batched msgs. */ + vhost_tx_batch(net, nvq, sock, &msg); +- +- if (unlikely(busyloop_intr)) +- /* If interrupted while doing busy polling, requeue the +- * handler to be fair handle_rx as well as other tasks +- * waiting on cpu. +- */ +- vhost_poll_queue(&vq->poll); +- else +- /* All of our work has been completed; however, before +- * leaving the TX handler, do one last check for work, +- * and requeue handler if necessary. If there is no work, +- * queue will be reenabled. +- */ +- vhost_net_busy_poll_try_queue(net, vq); + } + + static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) diff --git a/queue-6.16/series b/queue-6.16/series index 7d6446b4c3..e1b6a09b31 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -107,3 +107,18 @@ i40e-fix-validation-of-vf-state-in-get-resources.patch i40e-add-max-boundary-check-for-vf-filters.patch i40e-add-mask-to-apply-valid-bits-for-itr_idx.patch i40e-improve-vf-mac-filters-accounting.patch +crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch +tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch +tracing-fgraph-protect-return-handler-from-recursion-loop.patch +tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch +arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch +arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch +arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch +arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch +drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch +drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch +drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch +pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch +pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch +revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch +vhost-net-flush-batched-before-enabling-notifications.patch diff --git a/queue-6.16/tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch b/queue-6.16/tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch new file mode 100644 index 0000000000..5b2057d950 --- /dev/null +++ b/queue-6.16/tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch @@ -0,0 +1,36 @@ +From 456c32e3c4316654f95f9d49c12cbecfb77d5660 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Fri, 19 Sep 2025 10:15:56 +0900 +Subject: tracing: dynevent: Add a missing lockdown check on dynevent + +From: Masami Hiramatsu (Google) + +commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 upstream. + +Since dynamic_events interface on tracefs is compatible with +kprobe_events and uprobe_events, it should also check the lockdown +status and reject if it is set. + +Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@devnote2/ + +Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_dynevent.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/trace/trace_dynevent.c ++++ b/kernel/trace/trace_dynevent.c +@@ -230,6 +230,10 @@ static int dyn_event_open(struct inode * + { + int ret; + ++ ret = security_locked_down(LOCKDOWN_TRACEFS); ++ if (ret) ++ return ret; ++ + ret = tracing_check_open_get_tr(NULL); + if (ret) + return ret; diff --git a/queue-6.16/tracing-fgraph-protect-return-handler-from-recursion-loop.patch b/queue-6.16/tracing-fgraph-protect-return-handler-from-recursion-loop.patch new file mode 100644 index 0000000000..e7e9fa0d61 --- /dev/null +++ b/queue-6.16/tracing-fgraph-protect-return-handler-from-recursion-loop.patch @@ -0,0 +1,81 @@ +From 0db0934e7f9bb624ed98a665890dbe249f65b8fd Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Mon, 22 Sep 2025 15:35:22 +0900 +Subject: tracing: fgraph: Protect return handler from recursion loop + +From: Masami Hiramatsu (Google) + +commit 0db0934e7f9bb624ed98a665890dbe249f65b8fd upstream. + +function_graph_enter_regs() prevents itself from recursion by +ftrace_test_recursion_trylock(), but __ftrace_return_to_handler(), +which is called at the exit, does not prevent such recursion. +Therefore, while it can prevent recursive calls from +fgraph_ops::entryfunc(), it is not able to prevent recursive calls +to fgraph from fgraph_ops::retfunc(), resulting in a recursive loop. +This can lead an unexpected recursion bug reported by Menglong. + + is_endbr() is called in __ftrace_return_to_handler -> fprobe_return + -> kprobe_multi_link_exit_handler -> is_endbr. + +To fix this issue, acquire ftrace_test_recursion_trylock() in the +__ftrace_return_to_handler() after unwind the shadow stack to mark +this section must prevent recursive call of fgraph inside user-defined +fgraph_ops::retfunc(). + +This is essentially a fix to commit 4346ba160409 ("fprobe: Rewrite +fprobe on function-graph tracer"), because before that fgraph was +only used from the function graph tracer. Fprobe allowed user to run +any callbacks from fgraph after that commit. + +Reported-by: Menglong Dong +Closes: https://lore.kernel.org/all/20250918120939.1706585-1-dongml2@chinatelecom.cn/ +Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") +Cc: stable@vger.kernel.org +Cc: Peter Zijlstra +Link: https://lore.kernel.org/175852292275.307379.9040117316112640553.stgit@devnote2 +Signed-off-by: Masami Hiramatsu (Google) +Acked-by: Jiri Olsa +Tested-by: Menglong Dong +Acked-by: Menglong Dong +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/fgraph.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/kernel/trace/fgraph.c ++++ b/kernel/trace/fgraph.c +@@ -815,6 +815,7 @@ __ftrace_return_to_handler(struct ftrace + unsigned long bitmap; + unsigned long ret; + int offset; ++ int bit; + int i; + + ret_stack = ftrace_pop_return_trace(&trace, &ret, frame_pointer, &offset); +@@ -829,6 +830,15 @@ __ftrace_return_to_handler(struct ftrace + if (fregs) + ftrace_regs_set_instruction_pointer(fregs, ret); + ++ bit = ftrace_test_recursion_trylock(trace.func, ret); ++ /* ++ * This can fail because ftrace_test_recursion_trylock() allows one nest ++ * call. If we are already in a nested call, then we don't probe this and ++ * just return the original return address. ++ */ ++ if (unlikely(bit < 0)) ++ goto out; ++ + #ifdef CONFIG_FUNCTION_GRAPH_RETVAL + trace.retval = ftrace_regs_get_return_value(fregs); + #endif +@@ -852,6 +862,8 @@ __ftrace_return_to_handler(struct ftrace + } + } + ++ ftrace_test_recursion_unlock(bit); ++out: + /* + * The ftrace_graph_return() may still access the current + * ret_stack structure, we need to make sure the update of diff --git a/queue-6.16/tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch b/queue-6.16/tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch new file mode 100644 index 0000000000..bbb370950a --- /dev/null +++ b/queue-6.16/tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch @@ -0,0 +1,51 @@ +From c539feff3c8f8c86213eee2b237410714712c326 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Wed, 24 Sep 2025 09:26:39 +0900 +Subject: tracing: fprobe: Fix to remove recorded module addresses from filter + +From: Masami Hiramatsu (Google) + +commit c539feff3c8f8c86213eee2b237410714712c326 upstream. + +Even if there is a memory allocation failure in fprobe_addr_list_add(), +there is a partial list of module addresses. So remove the recorded +addresses from filter if exists. +This also removes the redundant ret local variable. + +Fixes: a3dc2983ca7b ("tracing: fprobe: Cleanup fprobe hash when module unloading") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Reviewed-by: Menglong Dong +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/fprobe.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c +index c8034dfc1070..5a807d62e76d 100644 +--- a/kernel/trace/fprobe.c ++++ b/kernel/trace/fprobe.c +@@ -428,8 +428,9 @@ static int fprobe_addr_list_add(struct fprobe_addr_list *alist, unsigned long ad + { + unsigned long *addrs; + +- if (alist->index >= alist->size) +- return -ENOMEM; ++ /* Previously we failed to expand the list. */ ++ if (alist->index == alist->size) ++ return -ENOSPC; + + alist->addrs[alist->index++] = addr; + if (alist->index < alist->size) +@@ -489,7 +490,7 @@ static int fprobe_module_callback(struct notifier_block *nb, + for (i = 0; i < FPROBE_IP_TABLE_SIZE; i++) + fprobe_remove_node_in_module(mod, &fprobe_ip_table[i], &alist); + +- if (alist.index < alist.size && alist.index > 0) ++ if (alist.index > 0) + ftrace_set_filter_ips(&fprobe_graph_ops.ops, + alist.addrs, alist.index, 1, 0); + mutex_unlock(&fprobe_mutex); +-- +2.51.0 + diff --git a/queue-6.16/vhost-net-flush-batched-before-enabling-notifications.patch b/queue-6.16/vhost-net-flush-batched-before-enabling-notifications.patch new file mode 100644 index 0000000000..731986e1ab --- /dev/null +++ b/queue-6.16/vhost-net-flush-batched-before-enabling-notifications.patch @@ -0,0 +1,43 @@ +From e430451613c7a27beeadd00d707bcf7ceec6328e Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Wed, 17 Sep 2025 14:30:45 +0800 +Subject: vhost-net: flush batched before enabling notifications + +From: Jason Wang + +commit e430451613c7a27beeadd00d707bcf7ceec6328e upstream. + +Commit 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after +sendmsg") tries to defer the notification enabling by moving the logic +out of the loop after the vhost_tx_batch() when nothing new is spotted. +This caused unexpected side effects as the new logic is reused for +several other error conditions. + +A previous patch reverted 8c2e6b26ffe2. Now, bring the performance +back up by flushing batched buffers before enabling notifications. + +Reported-by: Jon Kohler +Cc: stable@vger.kernel.org +Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg") +Signed-off-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Message-Id: <20250917063045.2042-3-jasowang@redhat.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/net.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -774,6 +774,11 @@ static void handle_tx_copy(struct vhost_ + break; + /* Nothing new? Wait for eventfd to tell us they refilled. */ + if (head == vq->num) { ++ /* Flush batched packets to handle pending RX ++ * work (if busyloop_intr is set) and to avoid ++ * unnecessary virtqueue kicks. ++ */ ++ vhost_tx_batch(net, nvq, sock, &msg); + if (unlikely(busyloop_intr)) { + vhost_poll_queue(&vq->poll); + } else if (unlikely(vhost_enable_notify(&net->dev, -- 2.47.3