From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 12:29:36 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2790477c7d98aadcef1e3ed8f3ad54af78f811a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch asoc-sof-topology-validate-vendor-array-size-before-parsing.patch kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch loongarch-kvm-check-the-return-values-for-put_user.patch loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch --- diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch new file mode 100644 index 0000000000..5cc3808ace --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch @@ -0,0 +1,51 @@ +From c84f22405085d91cd5f0c5b967318371c07904ba Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:17 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference + +From: David Jander + +commit c84f22405085d91cd5f0c5b967318371c07904ba upstream. + +Switch the ADC reference supply from the general 3.3V rail to the +internal 2.5V VREFBUF regulator. The ADC circuits on this board are +designed for the internal 2.5V reference. Without this change, all ADC +measurement values are incorrect. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: +Link: https://lore.kernel.org/r/20260318105123.819807-2-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -95,7 +95,7 @@ + pinctrl-names = "default"; + vdd-supply = <&v3v3>; + vdda-supply = <&v3v3>; +- vref-supply = <&v3v3>; ++ vref-supply = <&vrefbuf>; + status = "okay"; + }; + +@@ -362,6 +362,13 @@ + phy-supply = <&v3v3>; + }; + ++&vrefbuf { ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ vdda-supply = <&v3v3>; ++ status = "okay"; ++}; ++ + &pinctrl { + adc12_pins_mecsbc: adc12-ain-mecsbc-0 { + pins { diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch new file mode 100644 index 0000000000..eb0134f149 --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch @@ -0,0 +1,151 @@ +From 8407e611faf80ce790a393addf7b44cc595742af Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:18 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times + +From: David Jander + +commit 8407e611faf80ce790a393addf7b44cc595742af upstream. + +Increase the minimum ADC sample times for all configured channels on +ADC1 and ADC2 to ensure measurement accuracy meets specifications. + +The default 5us sample time is insufficient for the internal sampling +capacitor to fully charge. Increase the default time to 20us to relax +the input impedance requirements. + +Additionally, the phint0_ain and phint1_ain channels require a much +longer sampling period due to their specific circuit design. Increase +their sample times to 200us. Remove stale comments regarding clock +cycles that no longer match the updated timings. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: +Link: https://lore.kernel.org/r/20260318105123.819807-3-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + .../arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 32 +++++++++---------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +index 1ce01bac9814..1b1299770ca0 100644 +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -104,80 +104,79 @@ &adc1 { + + channel@0 { + reg = <0>; +- /* 16.5 ck_cycles sampling time */ +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "p24v_stp"; + }; + + channel@1 { + reg = <1>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "p24v_hpdcm"; + }; + + channel@2 { + reg = <2>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "ain0"; + }; + + channel@3 { + reg = <3>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpdcm1_i2"; + }; + + channel@5 { + reg = <5>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpout1_i"; + }; + + channel@6 { + reg = <6>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "ain1"; + }; + + channel@9 { + reg = <9>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpout0_i"; + }; + + channel@10 { + reg = <10>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <200000>; + label = "phint0_ain"; + }; + + channel@13 { + reg = <13>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <200000>; + label = "phint1_ain"; + }; + + channel@15 { + reg = <15>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpdcm0_i1"; + }; + + channel@16 { + reg = <16>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "lsin"; + }; + + channel@18 { + reg = <18>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpdcm0_i2"; + }; + + channel@19 { + reg = <19>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "hpdcm1_i1"; + }; + }; +@@ -187,14 +186,13 @@ &adc2 { + + channel@2 { + reg = <2>; +- /* 16.5 ck_cycles sampling time */ +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "ain2"; + }; + + channel@6 { + reg = <6>; +- st,min-sample-time-ns = <5000>; ++ st,min-sample-time-ns = <20000>; + label = "ain3"; + }; + }; +-- +2.55.0 + diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch new file mode 100644 index 0000000000..52d8e13f4f --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch @@ -0,0 +1,45 @@ +From dfb93c4acce8ad9c4f573128b2cf7ddb936e0de7 Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:22 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo + +From: David Jander + +commit dfb93c4acce8ad9c4f573128b2cf7ddb936e0de7 upstream. + +Fix a copy-paste error in the GPIO line names for the TCA6416 expander +(gpio@20). + +The common mecio1-io include file was originally defined using the +mecio1r1 (Revision 1) hardware layout, but incorrectly labeled pin 13 +as "HSIN9_BIAS" instead of the actual "HSIN7_BIAS" present in the +schematics. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20260318105123.819807-7-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +index 69a502ec36d4..1808289f8193 100644 +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -186,7 +186,7 @@ gpio0: gpio@20 { + #gpio-cells = <2>; + gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS", + "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL", +- "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN9_BIAS", ++ "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS", + "", "", "", ""; + }; + +-- +2.55.0 + diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch new file mode 100644 index 0000000000..526610c7d7 --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch @@ -0,0 +1,52 @@ +From b04ccecb714de913e360f0866c66f38e1606e89b Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:20 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo + +From: David Jander + +commit b04ccecb714de913e360f0866c66f38e1606e89b upstream. + +The reset pins for the LPOUT lines were incorrectly prefixed with "GPOUT" +instead of "LPOUT" in the gpio-line-names array. Fix these typos so the +pin names consistently match the LPOUT0-4 signals they belong to. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: +Link: https://lore.kernel.org/r/20260318105123.819807-5-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +index f91b3d1f037b..e50e9ae085e8 100644 +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -185,14 +185,14 @@ &gpiod { + &gpioe { + gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "", + "", "", "HPOUT1_RESETN", +- "LPOUT0", "LPOUT0_ALERTN", "GPOUT0_RESETN", +- "LPOUT1", "LPOUT1_ALERTN", "GPOUT1_RESETN", +- "LPOUT2", "LPOUT2_ALERTN", "GPOUT2_RESETN"; ++ "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN", ++ "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN", ++ "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN"; + }; + + &gpiof { +- gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "GPOUT3_RESETN", +- "LPOUT4", "LPOUT4_ALERTN", "GPOUT4_RESETN", ++ gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN", ++ "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN", + "", "", + "", "", "", "", + "", "", "", ""; +-- +2.55.0 + diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch new file mode 100644 index 0000000000..78bd8b1044 --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch @@ -0,0 +1,248 @@ +From 70f1d8fcbd121a40f51b6c846d41e8cbb38ba210 Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:19 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files + +From: David Jander + +commit 70f1d8fcbd121a40f51b6c846d41e8cbb38ba210 upstream. + +Move the divergent adc1 channel definitions out of the common +mecio1-io.dtsi file and into the specific Revision 0 and Revision 1 +board files. + +The original common file contained incorrect schematic labels for the +Revision 0 hardware (e.g., labeling ana0 as p24v_hpdcm instead of +ain_aux0) and failed to account for physical signal routing changes +between the board revisions. + +Retain only the strictly shared channels in the common include file. Map +the correct channels and schematic labels directly within +stm32mp151c-mecio1r0.dts and stm32mp153c-mecio1r1.dts. + +Crucially, ensure that the required 200us sample time follows the +phint1_ain signal to its new physical location on channel 3 for the +Revision 1 hardware. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: +Link: https://lore.kernel.org/r/20260318105123.819807-4-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 50 +++++++++++++++++++++++++ + arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 50 +++++++++++++++++++++++++ + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 50 ------------------------- + 3 files changed, 101 insertions(+), 49 deletions(-) + +--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts ++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts +@@ -36,6 +36,56 @@ + }; + }; + ++&adc1 { ++ channel@0 { ++ reg = <0>; ++ st,min-sample-time-ns = <20000>; ++ label = "ain_aux0"; ++ }; ++ ++ channel@1 { ++ reg = <1>; ++ st,min-sample-time-ns = <20000>; ++ label = "ain_aux1"; ++ }; ++ ++ channel@3 { ++ reg = <3>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm1_i2"; ++ }; ++ ++ channel@5 { ++ reg = <5>; ++ st,min-sample-time-ns = <20000>; ++ label = "pout1_i"; ++ }; ++ ++ channel@9 { ++ reg = <9>; ++ st,min-sample-time-ns = <20000>; ++ label = "pout0_i"; ++ }; ++ ++ channel@13 { ++ reg = <13>; ++ st,min-sample-time-ns = <200000>; ++ label = "phint1_ain"; ++ }; ++ ++ channel@15 { ++ reg = <15>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm0_i1"; ++ }; ++ ++ channel@18 { ++ reg = <18>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm0_i2"; ++ }; ++}; ++ + &clk_hse { + clock-frequency = <25000000>; + }; +--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts ++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts +@@ -36,6 +36,56 @@ + }; + }; + ++&adc1 { ++ channel@0 { ++ reg = <0>; ++ st,min-sample-time-ns = <20000>; ++ label = "p24v_hpdcm"; ++ }; ++ ++ channel@1 { ++ reg = <1>; ++ st,min-sample-time-ns = <20000>; ++ label = "p24v_stp"; ++ }; ++ ++ channel@3 { ++ reg = <3>; ++ st,min-sample-time-ns = <200000>; ++ label = "phint1_ain"; ++ }; ++ ++ channel@5 { ++ reg = <5>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpout1_i"; ++ }; ++ ++ channel@9 { ++ reg = <9>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpout0_i"; ++ }; ++ ++ channel@13 { ++ reg = <13>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm0_i2"; ++ }; ++ ++ channel@15 { ++ reg = <15>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm1_i2"; ++ }; ++ ++ channel@18 { ++ reg = <18>; ++ st,min-sample-time-ns = <20000>; ++ label = "hpdcm0_i1"; ++ }; ++}; ++ + &clk_hse { + clock-frequency = <24000000>; + }; +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -90,7 +90,7 @@ + }; + + &adc { +- /* ANA0, ANA1 are dedicated pins and don't need pinctrl: only in6. */ ++ /* ANA0, ANA1 are dedicated pins and don't need pinctrl. */ + pinctrl-0 = <&adc12_pins_mecsbc>; + pinctrl-names = "default"; + vdd-supply = <&v3v3>; +@@ -102,78 +102,30 @@ + &adc1 { + status = "okay"; + +- channel@0 { +- reg = <0>; +- st,min-sample-time-ns = <20000>; +- label = "p24v_stp"; +- }; +- +- channel@1 { +- reg = <1>; +- st,min-sample-time-ns = <20000>; +- label = "p24v_hpdcm"; +- }; +- + channel@2 { + reg = <2>; + st,min-sample-time-ns = <20000>; + label = "ain0"; + }; + +- channel@3 { +- reg = <3>; +- st,min-sample-time-ns = <20000>; +- label = "hpdcm1_i2"; +- }; +- +- channel@5 { +- reg = <5>; +- st,min-sample-time-ns = <20000>; +- label = "hpout1_i"; +- }; +- + channel@6 { + reg = <6>; + st,min-sample-time-ns = <20000>; + label = "ain1"; + }; + +- channel@9 { +- reg = <9>; +- st,min-sample-time-ns = <20000>; +- label = "hpout0_i"; +- }; +- + channel@10 { + reg = <10>; + st,min-sample-time-ns = <200000>; + label = "phint0_ain"; + }; + +- channel@13 { +- reg = <13>; +- st,min-sample-time-ns = <200000>; +- label = "phint1_ain"; +- }; +- +- channel@15 { +- reg = <15>; +- st,min-sample-time-ns = <20000>; +- label = "hpdcm0_i1"; +- }; +- + channel@16 { + reg = <16>; + st,min-sample-time-ns = <20000>; + label = "lsin"; + }; + +- channel@18 { +- reg = <18>; +- st,min-sample-time-ns = <20000>; +- label = "hpdcm0_i2"; +- }; +- + channel@19 { + reg = <19>; + st,min-sample-time-ns = <20000>; diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch new file mode 100644 index 0000000000..bae904392a --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch @@ -0,0 +1,105 @@ +From a0d6c2a06fffff47bcca4d5bfdab4cc428a315fc Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:23 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files + +From: David Jander + +commit a0d6c2a06fffff47bcca4d5bfdab4cc428a315fc upstream. + +Move the gpio-line-names properties for the I2C GPIO expanders (gpio0 +and gpio1) out of the common mecio1-io.dtsi file and into the specific +board dts files. + +The layout originally defined in the common include file belonged to the +mecio1r1 (Revision 1) hardware. This layout is moved 1:1 into the +stm32mp153c-mecio1r1.dts file. + +The mecio1r0 (Revision 0) hardware utilizes a completely different +pinout for these expanders. A new, accurate mapping reflecting the +Revision 0 schematics is added to stm32mp151c-mecio1r0.dts. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20260318105123.819807-8-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 14 ++++++++++++++ + arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 14 ++++++++++++++ + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 8 -------- + 3 files changed, 28 insertions(+), 8 deletions(-) + +--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts ++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts +@@ -97,6 +97,20 @@ + st,eth-clk-sel; + }; + ++&gpio0 { ++ gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS", ++ "HSIN4_BIAS", "", "STP_VREF0_LVL", "HSIN_VREF0_LVL", ++ "STP0_FB_BIAS", "STP1_FB_BIAS", "STP2_FB_BIAS", "STP3_FB_BIAS", ++ "", "", "", ""; ++}; ++ ++&gpio1 { ++ gpio-line-names = "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS", "HSIN8_BIAS", ++ "HSIN9_BIAS", "", "STP_VREF1_LVL", "HSIN_VREF1_LVL", ++ "STP4_FB_BIAS", "STP5_FB_BIAS", "STP6_FB_BIAS", "", ++ "", "", "LSIN8_BIAS", "LSIN9_BIAS"; ++}; ++ + &gpiod { + gpio-line-names = "", "", "", "", + "", "", "", "", +--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts ++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts +@@ -90,6 +90,20 @@ + clock-frequency = <24000000>; + }; + ++&gpio0 { ++ gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS", ++ "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL", ++ "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS", ++ "", "", "", ""; ++}; ++ ++&gpio1 { ++ gpio-line-names = "HSIN8_BIAS", "HSIN9_BIAS", "HSIN10_BIAS", "HSIN11_BIAS", ++ "", "", "HSIN_VREF2_LVL", "HSIN_VREF3_LVL", ++ "HSIN12_BIAS", "HSIN13_BIAS", "HSIN14_BIAS", "HSIN15_BIAS", ++ "", "", "LSIN8_BIAS", "LSIN9_BIAS"; ++}; ++ + &gpioa { + gpio-line-names = "", "", "", "", + "", "", "", "", +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -184,10 +184,6 @@ + reg = <0x20>; + gpio-controller; + #gpio-cells = <2>; +- gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS", +- "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL", +- "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS", +- "", "", "", ""; + }; + + gpio1: gpio@21 { +@@ -195,10 +191,6 @@ + reg = <0x21>; + gpio-controller; + #gpio-cells = <2>; +- gpio-line-names = "HSIN8_BIAS", "HSIN9_BIAS", "HSIN10_BIAS", "HSIN11_BIAS", +- "", "", "HSIN_VREF2_LVL", "HSIN_VREF3_LVL", +- "HSIN12_BIAS", "HSIN13_BIAS", "HSIN14_BIAS", "HSIN15_BIAS", +- "", "", "LSIN8_BIAS", "LSIN9_BIAS"; + }; + }; + diff --git a/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch new file mode 100644 index 0000000000..2ede3559bf --- /dev/null +++ b/queue-6.12/arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch @@ -0,0 +1,265 @@ +From 4f5069609ac99894c0632d8b8c4c016f85199de9 Mon Sep 17 00:00:00 2001 +From: David Jander +Date: Wed, 18 Mar 2026 11:51:21 +0100 +Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files + +From: David Jander + +commit 4f5069609ac99894c0632d8b8c4c016f85199de9 upstream. + +Move the gpio-line-names properties out of the common mecio1-io.dtsi file +and into the specific board dts files. + +The pinout originally defined in the common include file belonged to the +mecio1r0 (Revision 0) hardware. This is moved 1:1 into the +stm32mp151c-mecio1r0.dts file without any modifications. + +A large number of GPIO pins are swapped on the mecio1r1 (Revision 1) +hardware, so a new, board-specific gpio-line-names mapping is added to +stm32mp153c-mecio1r1.dts to reflect those hardware changes. + +Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Cc: +Link: https://lore.kernel.org/r/20260318105123.819807-6-o.rempel@pengutronix.de +Signed-off-by: Alexandre Torgue +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 64 ++++++++++++++++++++ + arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 80 +++++++++++++++++++++++++ + arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 63 ------------------- + 3 files changed, 144 insertions(+), 63 deletions(-) + +--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts ++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts +@@ -96,3 +96,67 @@ + assigned-clock-rates = <125000000>; /* Clock PLL3 to 625Mhz in tf-a. */ + st,eth-clk-sel; + }; ++ ++&gpiod { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "", "", "", ++ "STP_RESETN", "STP_ENABLEN", "HPOUT0", "HPOUT0_ALERTN"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_hog_d_mecsbc>; ++}; ++ ++&gpioe { ++ gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "", ++ "", "", "HPOUT1_RESETN", ++ "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN", ++ "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN", ++ "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN"; ++}; ++ ++&gpiof { ++ gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN", ++ "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN", ++ "", "", ++ "", "", "", "", ++ "", "", "", ""; ++}; ++ ++&gpiog { ++ gpio-line-names = "LPOUT5", "LPOUT5_ALERTN", "", "LPOUT5_RESETN", ++ "", "", "", "", ++ "", "", "", "", ++ "", "", "", ""; ++}; ++ ++&gpioh { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "GPIO0_RESETN", "", "", "", ++ "", "", "", ""; ++}; ++ ++&gpioi { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "HPDCM0_SLEEPN", "HPDCM1_SLEEPN", "GPIO1_RESETN", "", ++ "", "", "", ""; ++}; ++ ++&gpioj { ++ gpio-line-names = "HSIN10", "HSIN11", "HSIN12", "HSIN13", ++ "HSIN14", "HSIN15", "", "", ++ "", "", "", "", ++ "", "RTD_RESETN", "", ""; ++}; ++ ++&gpiok { ++ gpio-line-names = "", "", "HSIN0", "HSIN1", ++ "HSIN2", "HSIN3", "HSIN4", "HSIN5"; ++}; ++ ++&gpioz { ++ gpio-line-names = "", "", "", "HSIN6", ++ "HSIN7", "HSIN8", "HSIN9", ""; ++}; ++ +--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts ++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts +@@ -90,6 +90,86 @@ + clock-frequency = <24000000>; + }; + ++&gpioa { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "", "GPIO1_RESETN", "", ++ "", "", "", "LPOUT5"; ++}; ++ ++&gpiob { ++ gpio-line-names = "", "", "", "", ++ "LPOUT4_RESETN", "", "", "", ++ "", "LPOUT4_ALERTN", "", "", ++ "", "", "", ""; ++}; ++ ++&gpioc { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "LPOUT4", "", "", ++ "", "", "", ""; ++}; ++ ++&gpiod { ++ gpio-line-names = "LPOUT2", "", "LPOUT3_RESETN", "", ++ "LPOUT2_ALERTN", "", "MECIO_ADDR0", "", ++ "HPOUT1_ALERTN", "HPOUT1_RESETN", "", "", ++ "", "", "HPOUT0", "HPOUT1"; ++}; ++ ++&gpioe { ++ gpio-line-names = "LPOUT0_RESETN", "", "", "", ++ "", "LPOUT3", "LPOUT5_ALERTN", "", ++ "", "", "", "", ++ "", "", "", "HSIN_RESETN"; ++}; ++ ++&gpiof { ++ gpio-line-names = "LPOUT5_RESETN", "", "", "HPOUT0_ALERTN", ++ "", "LPOUT1", "", "", ++ "", "", "", "", ++ "", "", "", ""; ++}; ++ ++&gpiog { ++ gpio-line-names = "", "", "", "HPOUT0_RESETN", ++ "", "", "LPOUT3_ALERTN", "", ++ "", "", "GPIO0_RESETN", "", ++ "", "", "", "LPOUT2_RESETN"; ++}; ++ ++&gpioh { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "LPOUT0", "", "", ++ "", "LPOUT0_ALERTN", "STP_ENABLEN", "STP_RESETN"; ++}; ++ ++&gpioi { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "", "SPE_RESETN", "", ++ "HPDCM0_SLEEPN", "", "", ""; ++}; ++ ++&gpioj { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "MECIO_ADDR1", ++ "", "", "", "", ++ "", "", "", "LPOUT1_RESETN"; ++}; ++ ++&gpiok { ++ gpio-line-names = "", "", "RTD_RESETN", "", ++ "", "LPOUT1_ALERTN", "", ""; ++}; ++ ++&gpioz { ++ gpio-line-names = "", "", "", "", ++ "HPDCM1_SLEEPN", "", "", ""; ++}; ++ + &m_can1 { + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&m_can1_pins_b>; +--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi +@@ -173,69 +173,6 @@ + }; + }; + +-&gpiod { +- gpio-line-names = "", "", "", "", +- "", "", "", "", +- "", "", "", "", +- "STP_RESETN", "STP_ENABLEN", "HPOUT0", "HPOUT0_ALERTN"; +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_hog_d_mecsbc>; +-}; +- +-&gpioe { +- gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "", +- "", "", "HPOUT1_RESETN", +- "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN", +- "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN", +- "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN"; +-}; +- +-&gpiof { +- gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN", +- "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN", +- "", "", +- "", "", "", "", +- "", "", "", ""; +-}; +- +-&gpiog { +- gpio-line-names = "LPOUT5", "LPOUT5_ALERTN", "", "LPOUT5_RESETN", +- "", "", "", "", +- "", "", "", "", +- "", "", "", ""; +-}; +- +-&gpioh { +- gpio-line-names = "", "", "", "", +- "", "", "", "", +- "GPIO0_RESETN", "", "", "", +- "", "", "", ""; +-}; +- +-&gpioi { +- gpio-line-names = "", "", "", "", +- "", "", "", "", +- "HPDCM0_SLEEPN", "HPDCM1_SLEEPN", "GPIO1_RESETN", "", +- "", "", "", ""; +-}; +- +-&gpioj { +- gpio-line-names = "HSIN10", "HSIN11", "HSIN12", "HSIN13", +- "HSIN14", "HSIN15", "", "", +- "", "", "", "", +- "", "RTD_RESETN", "", ""; +-}; +- +-&gpiok { +- gpio-line-names = "", "", "HSIN0", "HSIN1", +- "HSIN2", "HSIN3", "HSIN4", "HSIN5"; +-}; +- +-&gpioz { +- gpio-line-names = "", "", "", "HSIN6", +- "HSIN7", "HSIN8", "HSIN9", ""; +-}; +- + &i2c2 { + pinctrl-names = "default"; + pinctrl-0 = <&i2c2_pins_a>; diff --git a/queue-6.12/arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch b/queue-6.12/arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch new file mode 100644 index 0000000000..625802e756 --- /dev/null +++ b/queue-6.12/arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch @@ -0,0 +1,47 @@ +From b4f5c46163b3fe3ec7ed8a76dff8b7e80a776a1f Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 13 Apr 2026 11:07:24 +0200 +Subject: arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags + +From: Krzysztof Kozlowski + +commit b4f5c46163b3fe3ec7ed8a76dff8b7e80a776a1f upstream. + +IRQ_TYPE_xxx flags are not correct in the context of GPIO flags. +These are simple defines so they could be used in DTS but they will not +have the same meaning: IRQ_TYPE_EDGE_FALLING = 2 = GPIO_SINGLE_ENDED. + +Correct the Type-C int-gpios to use proper flags, assuming the author of +the code wanted similar logical behavior: + + IRQ_TYPE_EDGE_FALLING => GPIO_ACTIVE_LOW + +Fixes: c4b4593ecb0b ("arm64: dts: imx8ulp-evk: enable usb nodes and add ptn5150 nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Frank Li +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8ulp-evk.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts +@@ -130,7 +130,7 @@ + ptn5150_1: typec@1d { + compatible = "nxp,ptn5150"; + reg = <0x1d>; +- int-gpios = <&gpiof 3 IRQ_TYPE_EDGE_FALLING>; ++ int-gpios = <&gpiof 3 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_typec1>; + status = "disabled"; +@@ -146,7 +146,7 @@ + ptn5150_2: typec@3d { + compatible = "nxp,ptn5150"; + reg = <0x3d>; +- int-gpios = <&gpiof 5 IRQ_TYPE_EDGE_FALLING>; ++ int-gpios = <&gpiof 5 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_typec2>; + status = "disabled"; diff --git a/queue-6.12/arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch b/queue-6.12/arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch new file mode 100644 index 0000000000..3dd7689894 --- /dev/null +++ b/queue-6.12/arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch @@ -0,0 +1,44 @@ +From ce414263e9ebe5080381a50cbdf9065c29816202 Mon Sep 17 00:00:00 2001 +From: Nickolay Goppen +Date: Wed, 29 Apr 2026 12:30:11 +0300 +Subject: arm64: dts: qcom: sdm630: describe adsp_mem region properly + +From: Nickolay Goppen + +commit ce414263e9ebe5080381a50cbdf9065c29816202 upstream. + +Downstream [1] this region is marked as shared, reusable and dynamic so +describe it that way. + +[1]: https://github.com/xiaomi-sdm660/android_kernel_xiaomi_sdm660/blob/11-EAS/arch/arm/boot/dts/qcom/sdm660.dtsi#L448 + +Fixes: b190fb010664 ("arm64: dts: qcom: sdm630: Add sdm630 dts file") +Cc: stable@vger.kernel.org +Reviewed-by: Ekansh Gupta +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Nickolay Goppen +Link: https://lore.kernel.org/r/20260429-qcom-sdm660-cdsp-adsp-fastrpc-dts-fix-v5-4-16bc82e622ad@mainlining.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi +@@ -493,9 +493,12 @@ + no-map; + }; + +- adsp_mem: adsp-region@f6000000 { +- reg = <0x0 0xf6000000 0x0 0x800000>; +- no-map; ++ adsp_mem: adsp-region { ++ compatible = "shared-dma-pool"; ++ alloc-ranges = <0x0 0x80000000 0x0 0x80000000>; ++ alignment = <0x0 0x400000>; ++ size = <0x0 0x800000>; ++ reusable; + }; + + qseecom_mem: qseecom-region@f6800000 { diff --git a/queue-6.12/arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch b/queue-6.12/arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch new file mode 100644 index 0000000000..d34fb4daed --- /dev/null +++ b/queue-6.12/arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch @@ -0,0 +1,41 @@ +From d8fe8442366ffd8306575028bda92389d0dfb674 Mon Sep 17 00:00:00 2001 +From: Judith Mendez +Date: Tue, 24 Mar 2026 09:02:47 -0500 +Subject: arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc + +From: Judith Mendez + +commit d8fe8442366ffd8306575028bda92389d0dfb674 upstream. + +Add bootph-all property to vqmmc voltage regulator node and its +corresponding pinmux node to make it available during all boot +phases. This allows to run tuning early in SPL stages of boot. + +Fixes: 8f023012eb4a ("arm64: dts: ti: k3-am62a: Enable UHS mode support for SD cards") +Cc: stable@vger.kernel.org +Signed-off-by: Judith Mendez +Link: https://patch.msgid.link/20260324140247.1200631-1-jm@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +@@ -134,6 +134,7 @@ + gpios = <&main_gpio0 31 GPIO_ACTIVE_HIGH>; + states = <1800000 0x0>, + <3300000 0x1>; ++ bootph-all; + }; + + leds { +@@ -381,6 +382,7 @@ + pinctrl-single,pins = < + AM62AX_MCU_IOPAD(0x000, PIN_INPUT, 7) /* (E11) MCU_GPIO0_0 */ + >; ++ bootph-all; + }; + }; + diff --git a/queue-6.12/arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch b/queue-6.12/arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch new file mode 100644 index 0000000000..986a3e79be --- /dev/null +++ b/queue-6.12/arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch @@ -0,0 +1,76 @@ +From ae24f6b06e90681ec36b9c21c3f5c09618350f5a Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Wed, 3 Jun 2026 12:06:11 +0100 +Subject: arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() + +From: Mark Rutland + +commit ae24f6b06e90681ec36b9c21c3f5c09618350f5a upstream. + +The sve_save_state() and sve_load_state() functions take a 32-bit int +argument that describes whether to save/restore the FFR. Their assembly +implementations consume the entire 64-bit register containing this +32-bit value, and will attempt to save/restore the FFR if any bit of +that 64-bit register is non-zero. + +Per the AAPCS64 parameter passing rules, the callee is responsible for +any necessary widening, and the upper 32-bits are permitted to contain +arbitrary values. If the upper 32 bits are non-zero, this could result +in an unexpected attempt to save/restore the FFR, and consequently could +lead to unexpected traps/undefs/faults. + +In practice compilers are very unlikely to generate code where the upper +32-bits would be non-zero, but they are permitted to do so. + +Fix this by only consuming the low 32 bits of the register, and update +comments accordingly. + +The hyp code __sve_save_state() and __sve_restore_state() functions +don't have the same latent bug as they override the full 64-bit register +containing the argument. + +Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional") +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Fuad Tabba +Cc: James Morse +Cc: Marc Zyngier +Cc: Mark Brown +Cc: Oliver Upton +Cc: Vladimir Murzin +Cc: Will Deacon +Cc: stable@vger.kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/entry-fpsimd.S | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm64/kernel/entry-fpsimd.S ++++ b/arch/arm64/kernel/entry-fpsimd.S +@@ -38,10 +38,10 @@ SYM_FUNC_END(fpsimd_load_state) + * + * x0 - pointer to buffer for state + * x1 - pointer to storage for FPSR +- * x2 - Save FFR if non-zero ++ * w2 - Save FFR if non-zero + */ + SYM_FUNC_START(sve_save_state) +- sve_save 0, x1, x2, 3 ++ sve_save 0, x1, w2, 3 + ret + SYM_FUNC_END(sve_save_state) + +@@ -50,10 +50,10 @@ SYM_FUNC_END(sve_save_state) + * + * x0 - pointer to buffer for state + * x1 - pointer to storage for FPSR +- * x2 - Restore FFR if non-zero ++ * w2 - Restore FFR if non-zero + */ + SYM_FUNC_START(sve_load_state) +- sve_load 0, x1, x2, 4 ++ sve_load 0, x1, w2, 4 + ret + SYM_FUNC_END(sve_load_state) + diff --git a/queue-6.12/asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch b/queue-6.12/asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch new file mode 100644 index 0000000000..1f54ba250b --- /dev/null +++ b/queue-6.12/asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch @@ -0,0 +1,85 @@ +From 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Tue, 9 Jun 2026 11:34:57 +0300 +Subject: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get + +From: Peter Ujfalusi + +commit 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 upstream. + +In sof_ipc3_bytes_put(), the size used for the memcpy is derived from +the old data->size already in the buffer, not the incoming new data's +size field. If the new data has a different size, the copy length is +wrong: it may truncate valid data or copy stale bytes. + +Similarly, sof_ipc3_bytes_get() checks data->size against max_size +without accounting for the sizeof(struct sof_ipc_ctrl_data) offset +of the flex array within the allocation. + +Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size +from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata) +from the bounds check to match the actual available space. + +Fixes: 544ac8858f24 ("ASoC: SOF: Add bytes_get/put control IPC ops for IPC3") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20260609083458.31193-6-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc3-control.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +--- a/sound/soc/sof/ipc3-control.c ++++ b/sound/soc/sof/ipc3-control.c +@@ -315,10 +315,13 @@ static int sof_ipc3_bytes_get(struct snd + } + + /* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */ +- if (data->size > scontrol->max_size - sizeof(*data)) { ++ if (data->size > scontrol->max_size - sizeof(*cdata) - ++ sizeof(*data)) { + dev_err_ratelimited(scomp->dev, + "%u bytes of control data is invalid, max is %zu\n", +- data->size, scontrol->max_size - sizeof(*data)); ++ data->size, ++ scontrol->max_size - sizeof(*cdata) - ++ sizeof(*data)); + return -EINVAL; + } + +@@ -336,6 +339,8 @@ static int sof_ipc3_bytes_put(struct snd + struct sof_ipc_ctrl_data *cdata = scontrol->ipc_control_data; + struct snd_soc_component *scomp = scontrol->scomp; + struct sof_abi_hdr *data = cdata->data; ++ const struct sof_abi_hdr *new_hdr = ++ (const struct sof_abi_hdr *)ucontrol->value.bytes.data; + size_t size; + + if (scontrol->max_size > sizeof(ucontrol->value.bytes.data)) { +@@ -344,14 +349,18 @@ static int sof_ipc3_bytes_put(struct snd + return -EINVAL; + } + +- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */ +- if (data->size > scontrol->max_size - sizeof(*data)) { +- dev_err_ratelimited(scomp->dev, "data size too big %u bytes max is %zu\n", +- data->size, scontrol->max_size - sizeof(*data)); ++ /* Validate the new data's size, not the old one */ ++ if (new_hdr->size > scontrol->max_size - sizeof(*cdata) - ++ sizeof(*new_hdr)) { ++ dev_err_ratelimited(scomp->dev, ++ "data size too big %u bytes max is %zu\n", ++ new_hdr->size, ++ scontrol->max_size - sizeof(*cdata) - ++ sizeof(*new_hdr)); + return -EINVAL; + } + +- size = data->size + sizeof(*data); ++ size = new_hdr->size + sizeof(*new_hdr); + + /* copy from kcontrol */ + memcpy(data, ucontrol->value.bytes.data, size); diff --git a/queue-6.12/asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch b/queue-6.12/asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch new file mode 100644 index 0000000000..0bfeb8b0c7 --- /dev/null +++ b/queue-6.12/asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch @@ -0,0 +1,65 @@ +From 8791977d7289f6e9d2b014f60a5455f053a7bc04 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Tue, 9 Jun 2026 11:34:55 +0300 +Subject: ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc + +From: Peter Ujfalusi + +commit 8791977d7289f6e9d2b014f60a5455f053a7bc04 upstream. + +In sof_ipc3_control_update(), the expected_size calculation uses +firmware-provided cdata->num_elems in arithmetic that could overflow +on 32-bit platforms, wrapping to a small value. This would allow the +cdata->rhdr.hdr.size comparison to pass with mismatched sizes, +potentially leading to out-of-bounds access in snd_sof_update_control. + +Use check_mul_overflow() and check_add_overflow() to detect and reject +overflowed size calculations. + +Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20260609083458.31193-4-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc3-control.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/sound/soc/sof/ipc3-control.c ++++ b/sound/soc/sof/ipc3-control.c +@@ -626,16 +626,28 @@ static void sof_ipc3_control_update(stru + return; + } + +- expected_size = sizeof(struct sof_ipc_ctrl_data); + switch (cdata->type) { + case SOF_CTRL_TYPE_VALUE_CHAN_GET: + case SOF_CTRL_TYPE_VALUE_CHAN_SET: +- expected_size += cdata->num_elems * +- sizeof(struct sof_ipc_ctrl_value_chan); ++ if (check_mul_overflow((size_t)cdata->num_elems, ++ sizeof(struct sof_ipc_ctrl_value_chan), ++ &expected_size)) ++ return; ++ if (check_add_overflow(expected_size, ++ sizeof(struct sof_ipc_ctrl_data), ++ &expected_size)) ++ return; + break; + case SOF_CTRL_TYPE_DATA_GET: + case SOF_CTRL_TYPE_DATA_SET: +- expected_size += cdata->num_elems + sizeof(struct sof_abi_hdr); ++ if (check_add_overflow((size_t)cdata->num_elems, ++ sizeof(struct sof_abi_hdr), ++ &expected_size)) ++ return; ++ if (check_add_overflow(expected_size, ++ sizeof(struct sof_ipc_ctrl_data), ++ &expected_size)) ++ return; + break; + default: + return; diff --git a/queue-6.12/asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch b/queue-6.12/asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch new file mode 100644 index 0000000000..dd8e160f2f --- /dev/null +++ b/queue-6.12/asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch @@ -0,0 +1,61 @@ +From 3ad673e7139cf214afd24321a829aad6575f4163 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Tue, 9 Jun 2026 11:34:53 +0300 +Subject: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put + +From: Peter Ujfalusi + +commit 3ad673e7139cf214afd24321a829aad6575f4163 upstream. + +In sof_ipc4_bytes_put(), the copy size is derived from the old +data->size in the buffer rather than the incoming new data's size +field from ucontrol. If the new data has a different size, the copy +uses the wrong length: it may truncate valid data or copy stale bytes. + +Fix by validating and using the incoming data's sof_abi_hdr.size from +ucontrol before copying. + +Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20260609083458.31193-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc4-control.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/sound/soc/sof/ipc4-control.c ++++ b/sound/soc/sof/ipc4-control.c +@@ -455,6 +455,8 @@ static int sof_ipc4_bytes_put(struct snd + struct snd_soc_component *scomp = scontrol->scomp; + struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp); + struct sof_abi_hdr *data = cdata->data; ++ const struct sof_abi_hdr *new_hdr = ++ (const struct sof_abi_hdr *)ucontrol->value.bytes.data; + size_t size; + int ret; + +@@ -465,15 +467,16 @@ static int sof_ipc4_bytes_put(struct snd + return -EINVAL; + } + +- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */ +- if (data->size > scontrol->max_size - sizeof(*data)) { ++ /* Validate the new data's size, not the old one */ ++ if (new_hdr->size > scontrol->max_size - sizeof(*new_hdr)) { + dev_err_ratelimited(scomp->dev, + "data size too big %u bytes max is %zu\n", +- data->size, scontrol->max_size - sizeof(*data)); ++ new_hdr->size, ++ scontrol->max_size - sizeof(*new_hdr)); + return -EINVAL; + } + +- size = data->size + sizeof(*data); ++ size = new_hdr->size + sizeof(*new_hdr); + + /* copy from kcontrol */ + memcpy(data, ucontrol->value.bytes.data, size); diff --git a/queue-6.12/asoc-sof-topology-validate-vendor-array-size-before-parsing.patch b/queue-6.12/asoc-sof-topology-validate-vendor-array-size-before-parsing.patch new file mode 100644 index 0000000000..3e4368cb08 --- /dev/null +++ b/queue-6.12/asoc-sof-topology-validate-vendor-array-size-before-parsing.patch @@ -0,0 +1,57 @@ +From 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 3 Jun 2026 14:57:54 -0300 +Subject: ASoC: SOF: topology: validate vendor array size before parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 upstream. + +sof_parse_token_sets() reads array->size while iterating over topology +private data. The loop condition only checks that some data remains, so a +malformed topology with a truncated trailing vendor array can make the +parser read the size field before a full vendor-array header is available. + +Validate that the remaining private data contains a complete +snd_soc_tplg_vendor_array header before reading array->size. + +The declared array size check also needs to remain signed. asize is an int, +but sizeof(*array) has type size_t, so comparing them directly promotes +negative asize values to unsigned and lets them pass the check, +as reported in the stable review thread reference below. + +Cast sizeof(*array) to int when validating the declared array size. This +rejects negative, zero and otherwise too-small sizes before the parser +dispatches to the tuple-specific code. + +Link: https://lore.kernel.org/stable/CANiDSCsjR5NHqu_Ui5cOqWdJgFqmYsQ9WR8O7m0WOhngaYXFpw@mail.gmail.com/t/#m9b3be379221e79327cc13fd71009287368ef4f23 +Fixes: 215e5fe75881 ("ASoC: SOF: topology: reject invalid vendor array size in token parser") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260603-sof-topology-array-size-signed-v1-1-84f97879a4ef@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/topology.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -721,10 +721,13 @@ static int sof_parse_token_sets(struct s + int ret; + + while (array_size > 0 && total < count * token_instance_num) { ++ if (array_size < (int)sizeof(*array)) ++ return -EINVAL; ++ + asize = le32_to_cpu(array->size); + + /* validate asize */ +- if (asize < sizeof(*array)) { ++ if (asize < (int)sizeof(*array)) { + dev_err(scomp->dev, "error: invalid array size 0x%x\n", + asize); + return -EINVAL; diff --git a/queue-6.12/kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch b/queue-6.12/kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch new file mode 100644 index 0000000000..af7853ffbb --- /dev/null +++ b/queue-6.12/kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch @@ -0,0 +1,37 @@ +From 9f1667098c6ae7ec81a9a56859cfdacb822aa0d0 Mon Sep 17 00:00:00 2001 +From: Oliver Upton +Date: Sun, 14 Jun 2026 22:13:24 -0700 +Subject: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 + +From: Oliver Upton + +commit 9f1667098c6ae7ec81a9a56859cfdacb822aa0d0 upstream. + +It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias +while in a nested context, as it is expected if FEAT_NV2 is advertised +to the L1 hypervisor. + +Get rid of the bogus WARN which, since the hyp vectors were installed at +this point, has the effect of a hyp_panic... + +Cc: stable@vger.kernel.org +Fixes: 0cfc85b8f5cf ("KVM: arm64: nv: Load guest FP state for ZCR_EL2 trap") +Signed-off-by: Oliver Upton +Link: https://patch.msgid.link/20260615051324.830045-1-oupton@kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/hyp/include/hyp/switch.h | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm64/kvm/hyp/include/hyp/switch.h ++++ b/arch/arm64/kvm/hyp/include/hyp/switch.h +@@ -451,8 +451,6 @@ static inline bool kvm_hyp_handle_fpsimd + return false; + break; + case ESR_ELx_EC_SYS64: +- if (WARN_ON_ONCE(!is_hyp_ctxt(vcpu))) +- return false; + fallthrough; + case ESR_ELx_EC_SVE: + if (!sve_guest) diff --git a/queue-6.12/kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch b/queue-6.12/kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch new file mode 100644 index 0000000000..740db7f1fe --- /dev/null +++ b/queue-6.12/kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch @@ -0,0 +1,60 @@ +From ff1022c3de46753eb7eba2f6efd990569e66ff95 Mon Sep 17 00:00:00 2001 +From: Weiming Shi +Date: Wed, 17 Jun 2026 12:08:21 +0800 +Subject: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() + +From: Weiming Shi + +commit ff1022c3de46753eb7eba2f6efd990569e66ff95 upstream. + +kvm_hyp_handle_mops() resets the single-step state machine as part of +rewinding state for a MOPS exception by modifying vcpu_cpsr() and +writing the result directly into hardware. + +In the case of nested virtualization, vcpu_cpsr() is a synthetic value +such that the rest of KVM can deal with vEL2 cleanly. That means the +value requires translation before being written into hardware, which is +unfortunately missing from the MOPS handler. + +Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state +altogether, which will be resynchronized on the next 'full' exit back +to KVM. + +Fixes: 2de451a329cf ("KVM: arm64: Add handler for MOPS exceptions") +Reported-by: Zhong Wang +Reported-by: Xuanqing Shi +Link: https://lore.kernel.org/all/ajE4lHQevXNHpl1M@Air.local/ +Cc: stable@vger.kernel.org +Signed-off-by: Weiming Shi +Link: https://patch.msgid.link/20260617040820.2194831-2-bestswngs@gmail.com +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/hyp/include/hyp/switch.h | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kvm/hyp/include/hyp/switch.h ++++ b/arch/arm64/kvm/hyp/include/hyp/switch.h +@@ -297,16 +297,19 @@ static inline bool __populate_fault_info + + static inline bool kvm_hyp_handle_mops(struct kvm_vcpu *vcpu, u64 *exit_code) + { ++ u64 spsr; ++ + *vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR); + arm64_mops_reset_regs(vcpu_gp_regs(vcpu), vcpu->arch.fault.esr_el2); + write_sysreg_el2(*vcpu_pc(vcpu), SYS_ELR); + + /* + * Finish potential single step before executing the prologue +- * instruction. ++ * instruction. Modify the hardware SPSR_EL2 directly, as vcpu_cpsr() ++ * may hold a synthetic (vEL2) value for a guest hypervisor. + */ +- *vcpu_cpsr(vcpu) &= ~DBG_SPSR_SS; +- write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); ++ spsr = read_sysreg_el2(SYS_SPSR); ++ write_sysreg_el2(spsr & ~DBG_SPSR_SS, SYS_SPSR); + + return true; + } diff --git a/queue-6.12/kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch b/queue-6.12/kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch new file mode 100644 index 0000000000..2d3d909a8b --- /dev/null +++ b/queue-6.12/kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch @@ -0,0 +1,60 @@ +From 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Fri, 5 Jun 2026 05:59:15 +0900 +Subject: KVM: arm64: vgic: Check the interrupt is still ours before migrating it + +From: Hyunwoo Kim + +commit 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe upstream. + +vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating +an interrupt to another vCPU. After reacquiring the locks it only checks +that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq)) +before moving the interrupt, which assumes that an interrupt whose affinity +is preserved is still queued on this vCPU's ap_list. + +That assumption no longer holds if the interrupt is taken off the ap_list +while the locks are dropped. vgic_flush_pending_lpis() removes the +interrupt from the list and sets irq->vcpu to NULL, but leaves +enabled/pending/target_vcpu untouched. As the interrupt is still enabled +and pending, vgic_target_oracle() returns the same target_vcpu, so the +affinity check passes and list_del() is run a second time on an entry that +has already been removed. + +Also check that the interrupt is still assigned to this vCPU +(irq->vcpu == vcpu) before moving it. + +Fixes: 0919e84c0fc1 ("KVM: arm/arm64: vgic-new: Add IRQ sync/flush framework") +Signed-off-by: Hyunwoo Kim +Link: https://patch.msgid.link/aiHnI1mu6SGQrgnz@v4bel +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/vgic/vgic.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/arch/arm64/kvm/vgic/vgic.c ++++ b/arch/arm64/kvm/vgic/vgic.c +@@ -684,15 +684,16 @@ retry: + raw_spin_lock(&irq->irq_lock); + + /* +- * If the affinity has been preserved, move the +- * interrupt around. Otherwise, it means things have +- * changed while the interrupt was unlocked, and we +- * need to replay this. ++ * If the interrupt is still ours and its affinity has ++ * been preserved, move it around. Otherwise, it means ++ * things have changed while the interrupt was unlocked ++ * (it may even have been taken off the list with its ++ * affinity left untouched), and we need to replay this. + * + * In all cases, we cannot trust the list not to have + * changed, so we restart from the beginning. + */ +- if (target_vcpu == vgic_target_oracle(irq)) { ++ if (irq->vcpu == vcpu && target_vcpu == vgic_target_oracle(irq)) { + struct vgic_cpu *new_cpu = &target_vcpu->arch.vgic_cpu; + + list_del(&irq->ap_list); diff --git a/queue-6.12/kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch b/queue-6.12/kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch new file mode 100644 index 0000000000..5ac153c86e --- /dev/null +++ b/queue-6.12/kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch @@ -0,0 +1,76 @@ +From 7258770e5814f15e8308ebda82ac9acf6964ba8e Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 15 Jun 2026 19:16:25 +0100 +Subject: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling + +From: Marc Zyngier + +commit 7258770e5814f15e8308ebda82ac9acf6964ba8e upstream. + +Hyunwoo Kim reports some really bad races should the following +situation occur: + +- LPI-I is pending in vcpu-B's AP list +- vcpu-A writes to vcpu-B's RD to disable its LPIs +- vcpu-C moves I from B to C + +If the last two race nicely enough, vgic_prune_ap_list() can drop +the irq and AP list locks, reacquire them, and in the interval +the irq has been freed. UAF follows. + +The fix is two-fold: + +- Before dropping the irq and ap_list locks, take a reference on + the irq + +- Do not try to handle migration of the pending bit: there is no + expectation that this state is retained, as per the architecture + +With that, we're sure that the interrupt is still around, and we +safely remove it from the AP list as it has no target at this +stage (unless another interrupt fires, but that's another story). + +Reported-by: Hyunwoo Kim +Tested-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/ailsCnyoS82r_QRz@v4bel +Link: https://patch.msgid.link/20260615181625.3029352-1-maz@kernel.org +Fixes: 5dd4b924e390a ("KVM: arm/arm64: vgic: Add refcounting for IRQs") +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/vgic/vgic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kvm/vgic/vgic.c ++++ b/arch/arm64/kvm/vgic/vgic.c +@@ -144,6 +144,7 @@ void vgic_flush_pending_lpis(struct kvm_ + list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) { + if (irq->intid >= VGIC_MIN_LPI) { + raw_spin_lock(&irq->irq_lock); ++ irq->pending_latch = false; + list_del(&irq->ap_list); + irq->vcpu = NULL; + raw_spin_unlock(&irq->irq_lock); +@@ -661,7 +662,11 @@ retry: + continue; + } + +- /* This interrupt looks like it has to be migrated. */ ++ /* ++ * This interrupt looks like it has to be migrated, ++ * make sure it is kept alive while locks are dropped. ++ */ ++ vgic_get_irq_ref(irq); + + raw_spin_unlock(&irq->irq_lock); + raw_spin_unlock(&vgic_cpu->ap_list_lock); +@@ -706,6 +711,8 @@ retry: + raw_spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock); + raw_spin_unlock(&vcpuA->arch.vgic_cpu.ap_list_lock); + ++ deleted_lpis |= vgic_put_irq_norelease(vcpu->kvm, irq); ++ + if (target_vcpu_needs_kick) { + kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu); + kvm_vcpu_kick(target_vcpu); diff --git a/queue-6.12/kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch b/queue-6.12/kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch new file mode 100644 index 0000000000..2c506415e1 --- /dev/null +++ b/queue-6.12/kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch @@ -0,0 +1,41 @@ +From 7b69729046a4c58f4cb457184e5ac4aaa179bff4 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:19:10 +0800 +Subject: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure + +From: Haoxiang Li + +commit 7b69729046a4c58f4cb457184e5ac4aaa179bff4 upstream. + +kvm_s390_gisc_register() registers the guest ISC before pinning +the guest interrupt forwarding pages and allocating the AISB bit. +If any of the later setup steps fails, the function unwinds the +pinned pages and other local state, but does not unregister the +GISC reference. Add the missing kvm_s390_gisc_unregister() to the +error unwind path. + +Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Matthew Rosato +Tested-by: Matthew Rosato +Acked-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +Signed-off-by: Claudio Imbrenda +Message-ID: <20260624061910.2794734-1-haoxiang_li2024@163.com> +Signed-off-by: Christian Borntraeger +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kvm/pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kvm/pci.c ++++ b/arch/s390/kvm/pci.c +@@ -330,6 +330,7 @@ unpin2: + unpin1: + unpin_user_page(aibv_page); + out: ++ kvm_s390_gisc_unregister(kvm, fib->fmt0.isc); + return rc; + } + diff --git a/queue-6.12/kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch b/queue-6.12/kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch new file mode 100644 index 0000000000..4952a0c72f --- /dev/null +++ b/queue-6.12/kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch @@ -0,0 +1,43 @@ +From 3e3aa6da87d30a0064a17b836685cd43c90a3572 Mon Sep 17 00:00:00 2001 +From: Matthew Rosato +Date: Thu, 9 Jul 2026 09:54:04 -0400 +Subject: KVM: s390: pci: Fix handling of AIF enable without AISB + +From: Matthew Rosato + +commit 3e3aa6da87d30a0064a17b836685cd43c90a3572 upstream. + +When a guest seeks to register IRQs without a summary bit specified, +ensure that the associated GAITE then stores 0 for the guest AISB +location instead of virt_to_phys(page_address(NULL)). + +Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") +Cc: stable@vger.kernel.org +Reviewed-by: Farhan Ali +Signed-off-by: Matthew Rosato +Signed-off-by: Christian Borntraeger +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kvm/pci.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/arch/s390/kvm/pci.c ++++ b/arch/s390/kvm/pci.c +@@ -302,9 +302,14 @@ static int kvm_s390_pci_aif_enable(struc + + gaite->gisc = fib->fmt0.isc; + gaite->count++; +- gaite->aisbo = fib->fmt0.aisbo; +- gaite->aisb = virt_to_phys(page_address(aisb_page) + (fib->fmt0.aisb & +- ~PAGE_MASK)); ++ if (fib->fmt0.sum == 1) { ++ gaite->aisbo = fib->fmt0.aisbo; ++ gaite->aisb = virt_to_phys(page_address(aisb_page) + ++ (fib->fmt0.aisb & ~PAGE_MASK)); ++ } else { ++ gaite->aisbo = 0; ++ gaite->aisb = 0; ++ } + aift->kzdev[zdev->aisb] = zdev->kzdev; + spin_unlock_irq(&aift->gait_lock); + diff --git a/queue-6.12/kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch b/queue-6.12/kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch new file mode 100644 index 0000000000..1ec9f5ac19 --- /dev/null +++ b/queue-6.12/kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch @@ -0,0 +1,60 @@ +From 6ee4140788234a6fabf59e6a50e38cdb936008cd Mon Sep 17 00:00:00 2001 +From: Atish Patra +Date: Tue, 2 Jun 2026 15:36:32 -0700 +Subject: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs + +From: Atish Patra + +commit 6ee4140788234a6fabf59e6a50e38cdb936008cd upstream. + +The intra-host migration/mirroring feature is not fully implemented for +SEV-SNP VMs. The proper migration requires additional SNP-specific +state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be +transferred or initialized on the destination. + +The SNP VM mirroring requires vmsa features to be copied as well otherwise +ASID would be bound to SNP range while VM is detected as a SEV VM. + +Reject SNP source VMs in migration/mirroring until proper SNP state +transfer is implemented. + +Fixes: 1dfe571c12cf ("KVM: SEV: Add initial SEV-SNP support") + +Reported-by: Chris Mason +Reported-by: Sashiko +Assisted-by: Claude:claude-opus-4-6 +Reviewed-by: Tom Lendacky +Signed-off-by: Atish Patra +Link: https://patch.msgid.link/20260602-sev_snp_fixes-v3-1-24bfd3ae047c@meta.com +Cc: stable@vger.kernel.org +[sean: let lines poke past 80 chars, tag for stable] +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/sev.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -2101,8 +2101,9 @@ int sev_vm_move_enc_context_from(struct + if (ret) + return ret; + ++ /* Do not allow SNP VM migration until additional state transfer is implemented */ + if (kvm->arch.vm_type != source_kvm->arch.vm_type || +- sev_guest(kvm) || !sev_guest(source_kvm)) { ++ sev_guest(kvm) || !sev_guest(source_kvm) || sev_snp_guest(source_kvm)) { + ret = -EINVAL; + goto out_unlock; + } +@@ -2830,8 +2831,9 @@ int sev_vm_copy_enc_context_from(struct + * disallow out-of-band SEV/SEV-ES init if the target is already an + * SEV guest, or if vCPUs have been created. KVM relies on vCPUs being + * created after SEV/SEV-ES initialization, e.g. to init intercepts. ++ * Also do not allow SNP VM mirroring until additional state transfer is implemented. + */ +- if (sev_guest(kvm) || !sev_guest(source_kvm) || ++ if (sev_guest(kvm) || !sev_guest(source_kvm) || sev_snp_guest(source_kvm) || + is_mirroring_enc_context(source_kvm) || kvm->created_vcpus) { + ret = -EINVAL; + goto e_unlock; diff --git a/queue-6.12/kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch b/queue-6.12/kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch new file mode 100644 index 0000000000..e3a34a27dc --- /dev/null +++ b/queue-6.12/kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch @@ -0,0 +1,65 @@ +From 9285e4070df2c40585c3d7ec9571faa7a2b97e17 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Wed, 24 Jun 2026 15:05:16 -0700 +Subject: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs + +From: Sean Christopherson + +commit 9285e4070df2c40585c3d7ec9571faa7a2b97e17 upstream. + +Ignore KVM's internal "service pending PV EOI" request if the vCPU has +disabled PV EOIs since the request was made. Asserting that PV EOIs are +enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. +if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables +PV EOIs. + + kernel BUG at arch/x86/kvm/lapic.c:3338! + Oops: invalid opcode: 0000 [#1] SMP + CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] + Call Trace: + + kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] + kvm_vcpu_ioctl+0x2d5/0x980 [kvm] + __x64_sys_ioctl+0x8a/0xd0 + do_syscall_64+0xb5/0xb40 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + + Modules linked in: kvm_intel kvm irqbypass + ---[ end trace 0000000000000000 ]--- + +Fixes: ae7a2a3fb6f8 ("KVM: host side for eoi optimization") +Cc: stable@vger.kernel.org +Reviewed-by: Kai Huang +Link: https://patch.msgid.link/20260624220516.3033391-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -3169,6 +3169,12 @@ static void apic_sync_pv_eoi_from_guest( + struct kvm_lapic *apic) + { + int vector; ++ ++ if (unlikely(!pv_eoi_enabled(vcpu))) { ++ __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention); ++ return; ++ } ++ + /* + * PV EOI state is derived from KVM_APIC_PV_EOI_PENDING in host + * and KVM_PV_EOI_ENABLED in guest memory as follows: +@@ -3180,8 +3186,6 @@ static void apic_sync_pv_eoi_from_guest( + * KVM_APIC_PV_EOI_PENDING is set, KVM_PV_EOI_ENABLED is unset: + * -> host enabled PV EOI, guest executed EOI. + */ +- BUG_ON(!pv_eoi_enabled(vcpu)); +- + if (pv_eoi_test_and_clr_pending(vcpu)) + return; + vector = apic_set_eoi(apic); diff --git a/queue-6.12/loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch b/queue-6.12/loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch new file mode 100644 index 0000000000..2ad8f480c7 --- /dev/null +++ b/queue-6.12/loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch @@ -0,0 +1,34 @@ +From 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 Mon Sep 17 00:00:00 2001 +From: Bibo Mao +Date: Thu, 11 Jun 2026 20:46:40 +0800 +Subject: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() + +From: Bibo Mao + +commit 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 upstream. + +Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here +add irq validility cheking in kvm_vcpu_ioctl_interrupt(). + +Cc: stable@vger.kernel.org +Fixes: f45ad5b8aa93 ("LoongArch: KVM: Implement vcpu interrupt operations") +Signed-off-by: Bibo Mao +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/vcpu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/loongarch/kvm/vcpu.c ++++ b/arch/loongarch/kvm/vcpu.c +@@ -1429,6 +1429,10 @@ void kvm_lose_fpu(struct kvm_vcpu *vcpu) + int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, struct kvm_interrupt *irq) + { + int intr = (int)irq->irq; ++ unsigned int vector = abs(intr); ++ ++ if (vector >= EXCCODE_INT_NUM) ++ return -EINVAL; + + if (intr > 0) + kvm_queue_irq(vcpu, intr); diff --git a/queue-6.12/loongarch-kvm-check-the-return-values-for-put_user.patch b/queue-6.12/loongarch-kvm-check-the-return-values-for-put_user.patch new file mode 100644 index 0000000000..7f49b36b41 --- /dev/null +++ b/queue-6.12/loongarch-kvm-check-the-return-values-for-put_user.patch @@ -0,0 +1,33 @@ +From fb89e0fe2dc4246c86ad0eb0fa2b7cb2f8ba9728 Mon Sep 17 00:00:00 2001 +From: Qiang Ma +Date: Thu, 11 Jun 2026 20:46:43 +0800 +Subject: LoongArch: KVM: Check the return values for put_user() + +From: Qiang Ma + +commit fb89e0fe2dc4246c86ad0eb0fa2b7cb2f8ba9728 upstream. + +put_user() may return -EFAULT, so, when the user space address is +invalid, the caller should return -EFAULT. + +Cc: stable@vger.kernel.org +Reviewed-by: Bibo Mao +Signed-off-by: Qiang Ma +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/vcpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/loongarch/kvm/vcpu.c ++++ b/arch/loongarch/kvm/vcpu.c +@@ -1029,7 +1029,8 @@ static int kvm_loongarch_cpucfg_get_attr + return -ENXIO; + } + +- put_user(val, uaddr); ++ if (put_user(val, uaddr)) ++ return -EFAULT; + + return ret; + } diff --git a/queue-6.12/loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch b/queue-6.12/loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch new file mode 100644 index 0000000000..724443c065 --- /dev/null +++ b/queue-6.12/loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch @@ -0,0 +1,44 @@ +From f4caaac76379daf4a617d9134b6087fb2636fb31 Mon Sep 17 00:00:00 2001 +From: Bibo Mao +Date: Thu, 11 Jun 2026 20:46:40 +0800 +Subject: LoongArch: KVM: Fix FPU register width with user access API + +From: Bibo Mao + +commit f4caaac76379daf4a617d9134b6087fb2636fb31 upstream. + +At the beginning, only 64 bit FPU is supported. With FPU register get +interface, 64 bit FPU data is copied to user space, the same with FPU +register set API. However with LSX and LASX supported in later, there +should be FPU data copied with bigger width. So here fixes this issue, +copy the whole 256 bit FPU data from/to user space. + +Cc: stable@vger.kernel.org +Fixes: db1ecca22edf ("LoongArch: KVM: Add LSX (128bit SIMD) support") +Signed-off-by: Bibo Mao +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/vcpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/loongarch/kvm/vcpu.c ++++ b/arch/loongarch/kvm/vcpu.c +@@ -1234,7 +1234,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct k + fpu->fcc = vcpu->arch.fpu.fcc; + fpu->fcsr = vcpu->arch.fpu.fcsr; + for (i = 0; i < NUM_FPU_REGS; i++) +- memcpy(&fpu->fpr[i], &vcpu->arch.fpu.fpr[i], FPU_REG_WIDTH / 64); ++ memcpy(&fpu->fpr[i], &vcpu->arch.fpu.fpr[i], sizeof(union fpureg)); + + return 0; + } +@@ -1246,7 +1246,7 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct k + vcpu->arch.fpu.fcc = fpu->fcc; + vcpu->arch.fpu.fcsr = fpu->fcsr; + for (i = 0; i < NUM_FPU_REGS; i++) +- memcpy(&vcpu->arch.fpu.fpr[i], &fpu->fpr[i], FPU_REG_WIDTH / 64); ++ memcpy(&vcpu->arch.fpu.fpr[i], &fpu->fpr[i], sizeof(union fpureg)); + + return 0; + } diff --git a/queue-6.12/loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch b/queue-6.12/loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch new file mode 100644 index 0000000000..ca80ddfb53 --- /dev/null +++ b/queue-6.12/loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch @@ -0,0 +1,38 @@ +From ebd50de14f1a06b7e0206083904bcc62b9ba65be Mon Sep 17 00:00:00 2001 +From: Qiang Ma +Date: Thu, 11 Jun 2026 20:46:43 +0800 +Subject: LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr() + +From: Qiang Ma + +commit ebd50de14f1a06b7e0206083904bcc62b9ba65be upstream. + +The LoongArch CSRXCHG instruction returns the full old CSR value in rd +after applying the masked update. kvm_emu_xchg_csr() currently masks +the saved value before returning it to the guest, so rd receives only +the bits selected by the write mask. + +That breaks the architectural behavior and makes a zero mask return 0 +instead of the previous CSR value. So, keep the masked CSR update, but +return the unmodified old CSR value. + +Cc: stable@vger.kernel.org +Fixes: da50f5a693ff ("LoongArch: KVM: Implement handle csr exception") +Reviewed-by: Bibo Mao +Signed-off-by: Qiang Ma +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/exit.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/loongarch/kvm/exit.c ++++ b/arch/loongarch/kvm/exit.c +@@ -103,7 +103,6 @@ static unsigned long kvm_emu_xchg_csr(st + old = kvm_read_sw_gcsr(csr, csrid); + val = (old & ~csr_mask) | (val & csr_mask); + kvm_write_sw_gcsr(csr, csrid, val); +- old = old & csr_mask; + } else + pr_warn_once("Unsupported csrxchg 0x%x with pc %lx\n", csrid, vcpu->arch.pc); + diff --git a/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch b/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch new file mode 100644 index 0000000000..10c68f013a --- /dev/null +++ b/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch @@ -0,0 +1,40 @@ +From 41c8c1d65b32beacd8d916a22457b4f6e47f45af Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Tue, 9 Jun 2026 08:37:09 +0000 +Subject: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() + +From: Wentao Liang + +commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af upstream. + +When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() +returns an error without releasing the lag reference obtained by +the earlier mlxsw_sp_lag_get(). All other error paths in the +function jump to the cleanup label that ends with +mlxsw_sp_lag_put(), so this is a single missed release. + +Fix the leak by replacing the bare 'return err' with a goto to the +existing error cleanup label, which will drop the reference safely. + +Cc: stable@vger.kernel.org +Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave") +Signed-off-by: Wentao Liang +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/20260609083709.209743-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -4507,7 +4507,7 @@ static int mlxsw_sp_port_lag_join(struct + lag_id = lag->lag_id; + err = mlxsw_sp_port_lag_index_get(mlxsw_sp, lag_id, &port_index); + if (err) +- return err; ++ goto err_lag_uppers_bridge_join; + + err = mlxsw_sp_lag_uppers_bridge_join(mlxsw_sp_port, lag_dev, + extack); diff --git a/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch b/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch new file mode 100644 index 0000000000..b86c663ae9 --- /dev/null +++ b/queue-6.12/mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch @@ -0,0 +1,47 @@ +From 21cf8dc478a49e8de039c2739b1646a774cb1944 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Tue, 9 Jun 2026 08:47:30 +0000 +Subject: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() + +From: Wentao Liang + +commit 21cf8dc478a49e8de039c2739b1646a774cb1944 upstream. + +When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, +the error rollback loop does not correctly revert the preceding +replacements. The loop decrements the index but fails to update the +vr pointer, which still points to the VR that caused the failure. As +a result, the condition and the rollback call always operate on the +same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple +times on it while never rolling back the earlier VRs. Those VRs +continue to hold a reference to new_tree acquired via +mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. + +Fix by reinitializing vr inside the error loop with the updated index: + + vr = &mlxsw_sp->router->vrs[i]; + +so that the loop correctly iterates over all VRs that were actually +replaced. + +Cc: stable@vger.kernel.org +Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers") +Signed-off-by: Wentao Liang +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/20260609084730.215732-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -1019,6 +1019,7 @@ static int mlxsw_sp_vrs_lpm_tree_replace + + err_tree_replace: + for (i--; i >= 0; i--) { ++ vr = &mlxsw_sp->router->vrs[i]; + if (!mlxsw_sp_vr_lpm_tree_should_replace(vr, proto, new_id)) + continue; + mlxsw_sp_vr_lpm_tree_replace(mlxsw_sp, diff --git a/queue-6.12/net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch b/queue-6.12/net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch new file mode 100644 index 0000000000..15d830ffae --- /dev/null +++ b/queue-6.12/net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch @@ -0,0 +1,46 @@ +From cdf19f380e46192e7084be559638aab1f6ed86a2 Mon Sep 17 00:00:00 2001 +From: Zhengchuan Liang +Date: Tue, 9 Jun 2026 16:34:37 +0800 +Subject: net: atm: reject out-of-range traffic classes in QoS validation + +From: Zhengchuan Liang + +commit cdf19f380e46192e7084be559638aab1f6ed86a2 upstream. + +Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). +SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so +accepting larger values leaves invalid traffic_class values in +vcc->qos. + +That bad state later reaches pvc_info(), which indexes class_name[] +with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause +an out-of-bounds read when /proc/net/atm/pvc is read. + +Tighten the existing QoS validation so invalid traffic_class values +are rejected at the point where user supplied QoS is accepted. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Xin Liu +Signed-off-by: Zhengchuan Liang +Signed-off-by: Ren Wei +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/58f02c6f73d9818fd5d2022e1116759fdde6116b.1780965530.git.zcliangcn@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/atm/common.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/atm/common.c ++++ b/net/atm/common.c +@@ -720,6 +720,8 @@ static int atm_change_qos(struct atm_vcc + static int check_tp(const struct atm_trafprm *tp) + { + /* @@@ Should be merged with adjust_tp */ ++ if (tp->traffic_class > ATM_ANYCLASS) ++ return -EINVAL; + if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS) + return 0; + if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr && diff --git a/queue-6.12/net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch b/queue-6.12/net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch new file mode 100644 index 0000000000..76b3da82cd --- /dev/null +++ b/queue-6.12/net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch @@ -0,0 +1,45 @@ +From 9406f6012b7343661efb516a11c62d4db2b62f75 Mon Sep 17 00:00:00 2001 +From: Yong Wang +Date: Thu, 11 Jun 2026 02:37:43 +0800 +Subject: net: ife: require ETH_HLEN to be pullable in ife_decode() + +From: Yong Wang + +commit 9406f6012b7343661efb516a11c62d4db2b62f75 upstream. + +ife decode may return after making only the outer IFE header and +metadata pullable. The caller then passes the decapsulated packet to +eth_type_trans(), which expects the inner Ethernet header to be +accessible from the linear data area. + +With a malformed IFE frame, the inner Ethernet header may still be +shorter than ETH_HLEN in the linear area, which can lead to a crash in +the original code. + +Fix this by extending the pull check in ife_decode() so that the inner +Ethernet header is also guaranteed to be pullable before returning. + +Fixes: ef6980b6becb ("introduce IFE action") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Xin Liu +Signed-off-by: Yong Wang +Signed-off-by: Ren Wei +Link: https://patch.msgid.link/20260610183814.1648888-2-n05ec@lzu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ife/ife.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ife/ife.c ++++ b/net/ife/ife.c +@@ -79,7 +79,7 @@ void *ife_decode(struct sk_buff *skb, u1 + if (unlikely(ifehdrln < 2)) + return NULL; + +- if (unlikely(!pskb_may_pull(skb, total_pull))) ++ if (unlikely(!pskb_may_pull(skb, total_pull + ETH_HLEN))) + return NULL; + + ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len); diff --git a/queue-6.12/net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch b/queue-6.12/net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch new file mode 100644 index 0000000000..19cd376179 --- /dev/null +++ b/queue-6.12/net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch @@ -0,0 +1,46 @@ +From 20054869770c7df060c5ecee3e8bbf9029c47191 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Thu, 11 Jun 2026 08:54:55 -0400 +Subject: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() + +From: Michael Bommarito + +commit 20054869770c7df060c5ecee3e8bbf9029c47191 upstream. + +qrtr_endpoint_post() validates an incoming packet with + + if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + +where size comes from the wire. On 32-bit, size_t is 32 bits and +ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check +passes and skb_put_data(skb, data + hdrlen, size) writes past the +hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. + +This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB +Read in qrtr_endpoint_post"), which fixed only the 64-bit case. + +Reject any size that cannot fit the buffer before the ALIGN. + +Fixes: ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Bommarito +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260611125455.2352279-1-michael.bommarito@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/af_qrtr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/qrtr/af_qrtr.c ++++ b/net/qrtr/af_qrtr.c +@@ -496,7 +496,7 @@ int qrtr_endpoint_post(struct qrtr_endpo + if (cb->dst_port == QRTR_PORT_CTRL_LEGACY) + cb->dst_port = QRTR_PORT_CTRL; + +- if (!size || len != ALIGN(size, 4) + hdrlen) ++ if (!size || size > len || len != ALIGN(size, 4) + hdrlen) + goto err; + + if ((cb->type == QRTR_TYPE_NEW_SERVER || diff --git a/queue-6.12/series b/queue-6.12/series index 73c6dc9523..e229f801d1 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -806,3 +806,36 @@ net-mlx5-fix-l3-tunnel-entropy-refcount-leak.patch octeontx2-af-fix-vf-bringup-affecting-pf-promiscuous.patch drm-xe-remove-duplicate-kunit-test-bug.h-include.patch smb-client-fix-overflow-in-passthrough-ioctl-bounds-.patch +mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch +mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch +vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch +asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch +asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch +asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch +asoc-sof-topology-validate-vendor-array-size-before-parsing.patch +net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch +net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch +net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch +arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch +arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch +arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch +arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch +arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch +arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch +arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch +arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch +arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch +arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch +arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch +loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch +loongarch-kvm-check-the-return-values-for-put_user.patch +loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch +loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch +kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch +kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch +kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch +kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch +kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch +kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch +kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch +kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch diff --git a/queue-6.12/vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch b/queue-6.12/vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch new file mode 100644 index 0000000000..0d8beeea87 --- /dev/null +++ b/queue-6.12/vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch @@ -0,0 +1,108 @@ +From ae9c13b6fd79087cc5a216ee1649b6f012c2a238 Mon Sep 17 00:00:00 2001 +From: Zhang Tianci +Date: Thu, 26 Feb 2026 19:55:50 +0800 +Subject: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhang Tianci + +commit ae9c13b6fd79087cc5a216ee1649b6f012c2a238 upstream. + +There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter: + +vduse_dev_read_iter(): + lock(msg_lock); + dequeue_msg(send_list); + unlock(msg_lock); +vduse_dev_msg_sync(): + wait_timeout() finish + lock(msg_lock); + check msg->complete is false + list_del(msg); <- double list_del() crash! + +To fix this case, we shall ensure vduse_msg is on send_list or recv_list +outside the msg_lock critical section. + +Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Tianci +Reviewed-by: Xie Yongji +Acked-by: Jason Wang +Acked-by: Eugenio Pérez +Acked-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Message-ID: <20260226115550.1814-3-zhangtianci.1997@bytedance.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vdpa/vdpa_user/vduse_dev.c | 37 +++++++++++++++++++++++++++---------- + 1 file changed, 27 insertions(+), 10 deletions(-) + +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -330,6 +330,7 @@ static ssize_t vduse_dev_read_iter(struc + struct file *file = iocb->ki_filp; + struct vduse_dev *dev = file->private_data; + struct vduse_dev_msg *msg; ++ struct vduse_dev_request req; + int size = sizeof(struct vduse_dev_request); + ssize_t ret; + +@@ -341,12 +342,11 @@ static ssize_t vduse_dev_read_iter(struc + msg = vduse_dequeue_msg(&dev->send_list); + if (msg) + break; ++ spin_unlock(&dev->msg_lock); + +- ret = -EAGAIN; + if (file->f_flags & O_NONBLOCK) +- goto unlock; ++ return -EAGAIN; + +- spin_unlock(&dev->msg_lock); + ret = wait_event_interruptible_exclusive(dev->waitq, + !list_empty(&dev->send_list)); + if (ret) +@@ -354,17 +354,34 @@ static ssize_t vduse_dev_read_iter(struc + + spin_lock(&dev->msg_lock); + } ++ ++ memcpy(&req, &msg->req, sizeof(req)); ++ /* ++ * We must ensure vduse_msg is on send_list or recv_list before unlock ++ * dev->msg_lock. Because vduse_dev_msg_sync() may be timeout when we ++ * copy data to userspace, and will call list_del() for this msg. ++ */ ++ vduse_enqueue_msg(&dev->recv_list, msg); + spin_unlock(&dev->msg_lock); +- ret = copy_to_iter(&msg->req, size, to); +- spin_lock(&dev->msg_lock); ++ ++ ret = copy_to_iter(&req, size, to); + if (ret != size) { ++ /* ++ * Roll back: move msg back to send_list if still pending. ++ * ++ * NOTE: ++ * vduse_find_msg() must use req.request_id instead of `msg`. ++ * A malicious userspace may reply to this request, and wake up ++ * the caller, after which `msg` will have already been freed. ++ * And here vduse_find_msg() will return NULL then do nothing. ++ */ ++ spin_lock(&dev->msg_lock); ++ msg = vduse_find_msg(&dev->recv_list, req.request_id); ++ if (msg) ++ vduse_enqueue_msg_head(&dev->send_list, msg); ++ spin_unlock(&dev->msg_lock); + ret = -EFAULT; +- vduse_enqueue_msg_head(&dev->send_list, msg); +- goto unlock; + } +- vduse_enqueue_msg(&dev->recv_list, msg); +-unlock: +- spin_unlock(&dev->msg_lock); + + return ret; + }