From: Greg Kroah-Hartman Date: Fri, 20 Jun 2025 10:44:43 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.4.295~136 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a7a3c3510653e6df3c0ee98f6705ead326a59b9;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: dummycon-trigger-redraw-when-switching-consoles-with-deferred-takeover.patch iio-adc-ad7606_spi-fix-reg-write-value-mask.patch iio-adc-ad7944-mask-high-bits-on-direct-read.patch iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch iio-imu-inv_icm42600-fix-temperature-calculation.patch mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch --- diff --git a/queue-6.12/dummycon-trigger-redraw-when-switching-consoles-with-deferred-takeover.patch b/queue-6.12/dummycon-trigger-redraw-when-switching-consoles-with-deferred-takeover.patch new file mode 100644 index 0000000000..966fa4ae0d --- /dev/null +++ b/queue-6.12/dummycon-trigger-redraw-when-switching-consoles-with-deferred-takeover.patch @@ -0,0 +1,90 @@ +From 03bcbbb3995ba5df43af9aba45334e35f2dfe27b Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 20 May 2025 09:14:00 +0200 +Subject: dummycon: Trigger redraw when switching consoles with deferred takeover + +From: Thomas Zimmermann + +commit 03bcbbb3995ba5df43af9aba45334e35f2dfe27b upstream. + +Signal vt subsystem to redraw console when switching to dummycon +with deferred takeover enabled. Makes the console switch to fbcon +and displays the available output. + +With deferred takeover enabled, dummycon acts as the placeholder +until the first output to the console happens. At that point, fbcon +takes over. If the output happens while dummycon is not active, it +cannot inform fbcon. This is the case if the vt subsystem runs in +graphics mode. + +A typical graphical boot starts plymouth, a display manager and a +compositor; all while leaving out dummycon. Switching to a text-mode +console leaves the console with dummycon even if a getty terminal +has been started. + +Returning true from dummycon's con_switch helper signals the vt +subsystem to redraw the screen. If there's output available dummycon's +con_putc{s} helpers trigger deferred takeover of fbcon, which sets a +display mode and displays the output. If no output is available, +dummycon remains active. + +v2: +- make the comment slightly more verbose (Javier) + +Signed-off-by: Thomas Zimmermann +Reported-by: Andrei Borzenkov +Closes: https://bugzilla.suse.com/show_bug.cgi?id=1242191 +Tested-by: Andrei Borzenkov +Acked-by: Javier Martinez Canillas +Fixes: 83d83bebf401 ("console/fbcon: Add support for deferred console takeover") +Cc: Hans de Goede +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Cc: # v4.19+ +Link: https://lore.kernel.org/r/20250520071418.8462-1-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/console/dummycon.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/video/console/dummycon.c ++++ b/drivers/video/console/dummycon.c +@@ -85,6 +85,15 @@ static bool dummycon_blank(struct vc_dat + /* Redraw, so that we get putc(s) for output done while blanked */ + return true; + } ++ ++static bool dummycon_switch(struct vc_data *vc) ++{ ++ /* ++ * Redraw, so that we get putc(s) for output done while switched ++ * away. Informs deferred consoles to take over the display. ++ */ ++ return true; ++} + #else + static void dummycon_putc(struct vc_data *vc, u16 c, unsigned int y, + unsigned int x) { } +@@ -95,6 +104,10 @@ static bool dummycon_blank(struct vc_dat + { + return false; + } ++static bool dummycon_switch(struct vc_data *vc) ++{ ++ return false; ++} + #endif + + static const char *dummycon_startup(void) +@@ -123,11 +136,6 @@ static bool dummycon_scroll(struct vc_da + { + return false; + } +- +-static bool dummycon_switch(struct vc_data *vc) +-{ +- return false; +-} + + /* + * The console `switch' structure for the dummy console diff --git a/queue-6.12/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch b/queue-6.12/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch new file mode 100644 index 0000000000..b9bb7e6e0c --- /dev/null +++ b/queue-6.12/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch @@ -0,0 +1,35 @@ +From 89944d88f8795c6c89b9514cb365998145511cd4 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Mon, 28 Apr 2025 20:55:34 -0500 +Subject: iio: adc: ad7606_spi: fix reg write value mask + +From: David Lechner + +commit 89944d88f8795c6c89b9514cb365998145511cd4 upstream. + +Fix incorrect value mask for register write. Register values are 8-bit, +not 9. If this function was called with a value > 0xFF and an even addr, +it would cause writing to the next register. + +Fixes: f2a22e1e172f ("iio: adc: ad7606: Add support for software mode for ad7616") +Signed-off-by: David Lechner +Reviewed-by: Angelo Dureghello +Link: https://patch.msgid.link/20250428-iio-adc-ad7606_spi-fix-write-value-mask-v1-1-a2d5e85a809f@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7606_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7606_spi.c ++++ b/drivers/iio/adc/ad7606_spi.c +@@ -151,7 +151,7 @@ static int ad7606_spi_reg_write(struct a + struct spi_device *spi = to_spi_device(st->dev); + + st->d16[0] = cpu_to_be16((st->bops->rd_wr_cmd(addr, 1) << 8) | +- (val & 0x1FF)); ++ (val & 0xFF)); + + return spi_write(spi, &st->d16[0], sizeof(st->d16[0])); + } diff --git a/queue-6.12/iio-adc-ad7944-mask-high-bits-on-direct-read.patch b/queue-6.12/iio-adc-ad7944-mask-high-bits-on-direct-read.patch new file mode 100644 index 0000000000..7795af17df --- /dev/null +++ b/queue-6.12/iio-adc-ad7944-mask-high-bits-on-direct-read.patch @@ -0,0 +1,40 @@ +From 7cdfbc0113d087348b8e65dd79276d0f57b89a10 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Mon, 5 May 2025 13:28:40 -0500 +Subject: iio: adc: ad7944: mask high bits on direct read +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Lechner + +commit 7cdfbc0113d087348b8e65dd79276d0f57b89a10 upstream. + +Apply a mask to the raw value received over the SPI bus for unsigned +direct reads. As we found recently, SPI controllers may not set unused +bits to 0 when reading with bits_per_word != {8,16,32}. The ad7944 uses +bits_per_word of 14 and 18, so we need to mask the value to be sure we +returning the correct value to userspace during a direct read. + +Fixes: d1efcf8871db ("iio: adc: ad7944: add driver for AD7944/AD7985/AD7986") +Signed-off-by: David Lechner +Reviewed-by: Nuno Sá +Link: https://patch.msgid.link/20250505-iio-adc-ad7944-max-high-bits-on-direct-read-v1-1-b173facceefe@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7944.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/adc/ad7944.c ++++ b/drivers/iio/adc/ad7944.c +@@ -290,6 +290,8 @@ static int ad7944_single_conversion(stru + + if (chan->scan_type.sign == 's') + *val = sign_extend32(*val, chan->scan_type.realbits - 1); ++ else ++ *val &= GENMASK(chan->scan_type.realbits - 1, 0); + + return IIO_VAL_INT; + } diff --git a/queue-6.12/iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch b/queue-6.12/iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch new file mode 100644 index 0000000000..9466f0dc18 --- /dev/null +++ b/queue-6.12/iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch @@ -0,0 +1,37 @@ +From 3c5dfea39a245b2dad869db24e2830aa299b1cf2 Mon Sep 17 00:00:00 2001 +From: Arthur-Prince +Date: Wed, 30 Apr 2025 16:07:37 -0300 +Subject: iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arthur-Prince + +commit 3c5dfea39a245b2dad869db24e2830aa299b1cf2 upstream. + +Add dependency to Kconfig’s ti-ads1298 because compiling it as a module +failed with an undefined kfifo symbol. + +Fixes: 00ef7708fa60 ("iio: adc: ti-ads1298: Add driver") +Signed-off-by: Arthur-Prince +Co-developed-by: Mariana Valério +Signed-off-by: Mariana Valério +Link: https://patch.msgid.link/20250430191131.120831-1-r2.arthur.prince@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -1452,6 +1452,7 @@ config TI_ADS1298 + tristate "Texas Instruments ADS1298" + depends on SPI + select IIO_BUFFER ++ select IIO_KFIFO_BUF + help + If you say yes here you get support for Texas Instruments ADS1298 + medical ADC chips diff --git a/queue-6.12/iio-imu-inv_icm42600-fix-temperature-calculation.patch b/queue-6.12/iio-imu-inv_icm42600-fix-temperature-calculation.patch new file mode 100644 index 0000000000..f7475695dc --- /dev/null +++ b/queue-6.12/iio-imu-inv_icm42600-fix-temperature-calculation.patch @@ -0,0 +1,49 @@ +From e2f820014239df9360064079ae93f838ff3b7f8c Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Fri, 2 May 2025 11:37:26 +0200 +Subject: iio: imu: inv_icm42600: Fix temperature calculation + +From: Sean Nyekjaer + +commit e2f820014239df9360064079ae93f838ff3b7f8c upstream. + +>From the documentation: +"offset to be added to [Y]_raw prior toscaling by [Y]_scale" +Offset should be applied before multiplying scale, so divide offset by +scale to make this correct. + +Fixes: bc3eb0207fb5 ("iio: imu: inv_icm42600: add temperature sensor support") +Signed-off-by: Sean Nyekjaer +Acked-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20250502-imu-v1-1-129b8391a4e3@geanix.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c +@@ -67,16 +67,18 @@ int inv_icm42600_temp_read_raw(struct ii + return IIO_VAL_INT; + /* + * T°C = (temp / 132.48) + 25 +- * Tm°C = 1000 * ((temp * 100 / 13248) + 25) ++ * Tm°C = 1000 * ((temp / 132.48) + 25) ++ * Tm°C = 7.548309 * temp + 25000 ++ * Tm°C = (temp + 3312) * 7.548309 + * scale: 100000 / 13248 ~= 7.548309 +- * offset: 25000 ++ * offset: 3312 + */ + case IIO_CHAN_INFO_SCALE: + *val = 7; + *val2 = 548309; + return IIO_VAL_INT_PLUS_MICRO; + case IIO_CHAN_INFO_OFFSET: +- *val = 25000; ++ *val = 3312; + return IIO_VAL_INT; + default: + return -EINVAL; diff --git a/queue-6.12/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch b/queue-6.12/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch new file mode 100644 index 0000000000..e0323931fe --- /dev/null +++ b/queue-6.12/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch @@ -0,0 +1,55 @@ +From 1013af4f585fccc4d3e5c5824d174de2257f7d6d Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Tue, 27 May 2025 23:23:54 +0200 +Subject: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race + +From: Jann Horn + +commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d upstream. + +huge_pmd_unshare() drops a reference on a page table that may have +previously been shared across processes, potentially turning it into a +normal page table used in another process in which unrelated VMAs can +afterwards be installed. + +If this happens in the middle of a concurrent gup_fast(), gup_fast() could +end up walking the page tables of another process. While I don't see any +way in which that immediately leads to kernel memory corruption, it is +really weird and unexpected. + +Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), +just like we do in khugepaged when removing page tables for a THP +collapse. + +Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1a@google.com +Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58a@google.com +Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") +Signed-off-by: Jann Horn +Reviewed-by: Lorenzo Stoakes +Cc: Liam Howlett +Cc: Muchun Song +Cc: Oscar Salvador +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/hugetlb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -7252,6 +7252,13 @@ int huge_pmd_unshare(struct mm_struct *m + return 0; + + pud_clear(pud); ++ /* ++ * Once our caller drops the rmap lock, some other process might be ++ * using this page table as a normal, non-hugetlb page table. ++ * Wait for pending gup_fast() in other threads to finish before letting ++ * that happen. ++ */ ++ tlb_remove_table_sync_one(); + ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); + mm_dec_nr_pmds(mm); + return 1; diff --git a/queue-6.12/series b/queue-6.12/series index efad1ccb18..cdc4eb062b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -158,3 +158,9 @@ accel-ivpu-improve-buffer-object-logging.patch accel-ivpu-use-firmware-names-from-upstream-repo.patch accel-ivpu-use-dma_resv_lock-instead-of-a-custom-mutex.patch accel-ivpu-fix-warning-in-ivpu_gem_bo_free.patch +dummycon-trigger-redraw-when-switching-consoles-with-deferred-takeover.patch +mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch +iio-imu-inv_icm42600-fix-temperature-calculation.patch +iio-adc-ad7944-mask-high-bits-on-direct-read.patch +iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch +iio-adc-ad7606_spi-fix-reg-write-value-mask.patch