From 0c36355842d530d8caaf4739ea5503aff371b635 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 Jan 2026 14:14:30 +0100 Subject: [PATCH] 6.6-stable patches added patches: alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch edac-x38-fix-a-resource-leak-in-x38_probe1.patch ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch scsi-core-fix-error-handler-encryption-support.patch tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch usb-dwc3-check-for-usb4-ip_name.patch usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch usb-serial-option-add-telit-le910-mbim-composition.patch x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch --- ...ce-of-buffer-access-at-pcm-oss-layer.patch | 73 +++++++++++ ...-when-bit-rate-is-higher-than-1-mbit.patch | 66 ++++++++++ ...ve_bulk_callback-fix-urb-memory-leak.patch | 43 ++++++ ...-fix-a-resource-leak-in-i3200_probe1.patch | 52 ++++++++ ...38-fix-a-resource-leak-in-x38_probe1.patch | 51 +++++++ ...-leak-in-ext4_xattr_inode_update_ref.patch | 34 +++++ ...ftirq-base-check-in-update_needs_ipi.patch | 37 ++++++ ...location-for-mixed-type-event-groups.patch | 124 ++++++++++++++++++ ...subdirs-on-context-dir-setup-failure.patch | 48 +++++++ ...gelist_high_fraction-reads-lock-free.patch | 60 +++++++++ ...ession-upon-receiving-the-second-rts.patch | 52 ++++++++ ...g-references-to-fault-configfs-items.patch | 85 ++++++++++++ ...-secondary-temp-for-wodposit-wpbsnm8.patch | 40 ++++++ ...cie-assert-phy-reset-during-power-on.patch | 46 +++++++ ...munication-disruption-in-gadget-mode.patch | 80 +++++++++++ ...sb2-fix-disconnection-in-gadget-mode.patch | 88 +++++++++++++ ...tly-configure-hs_discon_level-to-0x7.patch | 45 +++++++ ...fix-error-handler-encryption-support.patch | 105 +++++++++++++++ queue-6.6/series | 27 ++++ ...-for-role_sw-device-in-the-main-node.patch | 40 ++++++ ...-devices-that-hang-on-bos-descriptor.patch | 65 +++++++++ .../usb-dwc3-check-for-usb4-ip_name.patch | 44 +++++++ ...d-soft-dependencies-on-ehci_platform.patch | 89 +++++++++++++ ...-add-support-for-picaxe-axe027-cable.patch | 43 ++++++ ...ion-add-telit-le910-mbim-composition.patch | 62 +++++++++ ...e_device-users-as-physaddr-consumers.patch | 111 ++++++++++++++++ ...ing-resctrl-initialization-for-hygon.patch | 58 ++++++++ ...ry-bandwidth-counter-width-for-hygon.patch | 74 +++++++++++ 28 files changed, 1742 insertions(+) create mode 100644 queue-6.6/alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch create mode 100644 queue-6.6/can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch create mode 100644 queue-6.6/can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch create mode 100644 queue-6.6/edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch create mode 100644 queue-6.6/edac-x38-fix-a-resource-leak-in-x38_probe1.patch create mode 100644 queue-6.6/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch create mode 100644 queue-6.6/hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch create mode 100644 queue-6.6/loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch create mode 100644 queue-6.6/mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch create mode 100644 queue-6.6/mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch create mode 100644 queue-6.6/net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch create mode 100644 queue-6.6/null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch create mode 100644 queue-6.6/nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch create mode 100644 queue-6.6/phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch create mode 100644 queue-6.6/phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch create mode 100644 queue-6.6/phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch create mode 100644 queue-6.6/phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch create mode 100644 queue-6.6/scsi-core-fix-error-handler-encryption-support.patch create mode 100644 queue-6.6/tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch create mode 100644 queue-6.6/usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch create mode 100644 queue-6.6/usb-dwc3-check-for-usb4-ip_name.patch create mode 100644 queue-6.6/usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch create mode 100644 queue-6.6/usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch create mode 100644 queue-6.6/usb-serial-option-add-telit-le910-mbim-composition.patch create mode 100644 queue-6.6/x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch create mode 100644 queue-6.6/x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch create mode 100644 queue-6.6/x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch diff --git a/queue-6.6/alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch b/queue-6.6/alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch new file mode 100644 index 0000000000..c2714484cd --- /dev/null +++ b/queue-6.6/alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch @@ -0,0 +1,73 @@ +From 47c27c9c9c720bc93fdc69605d0ecd9382e99047 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Wed, 7 Jan 2026 22:36:42 +0100 +Subject: ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer + +From: Jaroslav Kysela + +commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream. + +Handle the error code from snd_pcm_buffer_access_lock() in +snd_pcm_runtime_buffer_set_silence() function. + +Found by Alexandros Panagiotou + +Fixes: 93a81ca06577 ("ALSA: pcm: Fix race of buffer access at PCM OSS layer") +Cc: stable@vger.kernel.org # 6.15 +Signed-off-by: Jaroslav Kysela +Link: https://patch.msgid.link/20260107213642.332954-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + include/sound/pcm.h | 2 +- + sound/core/oss/pcm_oss.c | 4 +++- + sound/core/pcm_native.c | 9 +++++++-- + 3 files changed, 11 insertions(+), 4 deletions(-) + +--- a/include/sound/pcm.h ++++ b/include/sound/pcm.h +@@ -1427,7 +1427,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc + #define snd_pcm_lib_mmap_iomem NULL + #endif + +-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); ++int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + + /** + * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1085,7 +1085,9 @@ static int snd_pcm_oss_change_params_loc + runtime->oss.params = 0; + runtime->oss.prepare = 1; + runtime->oss.buffer_used = 0; +- snd_pcm_runtime_buffer_set_silence(runtime); ++ err = snd_pcm_runtime_buffer_set_silence(runtime); ++ if (err < 0) ++ goto failure; + + runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -705,13 +705,18 @@ static void snd_pcm_buffer_access_unlock + } + + /* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) ++int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) + { +- snd_pcm_buffer_access_lock(runtime); ++ int err; ++ ++ err = snd_pcm_buffer_access_lock(runtime); ++ if (err < 0) ++ return err; + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); ++ return 0; + } + EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + diff --git a/queue-6.6/can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch b/queue-6.6/can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch new file mode 100644 index 0000000000..f642ab61d9 --- /dev/null +++ b/queue-6.6/can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch @@ -0,0 +1,66 @@ +From e707c591a139d1bfa4ddc83036fc820ca006a140 Mon Sep 17 00:00:00 2001 +From: Ondrej Ille +Date: Mon, 5 Jan 2026 12:16:20 +0100 +Subject: can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. + +From: Ondrej Ille + +commit e707c591a139d1bfa4ddc83036fc820ca006a140 upstream. + +The Secondary Sample Point Source field has been +set to an incorrect value by some mistake in the +past + + 0b01 - SSP_SRC_NO_SSP - SSP is not used. + +for data bitrates above 1 MBit/s. The correct/default +value already used for lower bitrates is + + 0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY + (Measured Transmitter delay) + SSP_OFFSET. + +The related configuration register structure is described +in section 3.1.46 SSP_CFG of the CTU CAN FD +IP CORE Datasheet. + +The analysis leading to the proper configuration +is described in section 2.8.3 Secondary sampling point +of the datasheet. + +The change has been tested on AMD/Xilinx Zynq +with the next CTU CN FD IP core versions: + + - 2.6 aka master in the "integration with Zynq-7000 system" test + 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git + driver (change already included in the driver repo) + - older 2.5 snapshot with mainline kernels with this patch + applied locally in the multiple CAN latency tester nightly runs + 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT + 6.19.0-rc3-dut + +The logs, the datasheet and sources are available at + + https://canbus.pages.fel.cvut.cz/ + +Signed-off-by: Ondrej Ille +Signed-off-by: Pavel Pisa +Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz +Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.") +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/ctucanfd/ctucanfd_base.c ++++ b/drivers/net/can/ctucanfd/ctucanfd_base.c +@@ -310,7 +310,7 @@ static int ctucan_set_secondary_sample_p + } + + ssp_cfg = FIELD_PREP(REG_TRV_DELAY_SSP_OFFSET, ssp_offset); +- ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x1); ++ ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x0); + } + + ctucan_write32(priv, CTUCANFD_TRV_DELAY, ssp_cfg); diff --git a/queue-6.6/can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch b/queue-6.6/can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch new file mode 100644 index 0000000000..dc057cc6f2 --- /dev/null +++ b/queue-6.6/can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch @@ -0,0 +1,43 @@ +From 7352e1d5932a0e777e39fa4b619801191f57e603 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 23 Dec 2025 21:21:39 +0100 +Subject: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak + +From: Marc Kleine-Budde + +commit 7352e1d5932a0e777e39fa4b619801191f57e603 upstream. + +In gs_can_open(), the URBs for USB-in transfers are allocated, added to the +parent->rx_submitted anchor and submitted. In the complete callback +gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In +gs_can_close() the URBs are freed by calling +usb_kill_anchored_urbs(parent->rx_submitted). + +However, this does not take into account that the USB framework unanchors +the URB before the complete function is called. This means that once an +in-URB has been completed, it is no longer anchored and is ultimately not +released in gs_can_close(). + +Fix the memory leak by anchoring the URB in the +gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor. + +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/gs_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -748,6 +748,8 @@ resubmit_urb: + hf, parent->hf_size_rx, + gs_usb_receive_bulk_callback, parent); + ++ usb_anchor_urb(urb, &parent->rx_submitted); ++ + rc = usb_submit_urb(urb, GFP_ATOMIC); + + /* USB failure take down all interfaces */ diff --git a/queue-6.6/edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch b/queue-6.6/edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch new file mode 100644 index 0000000000..6f83d19e77 --- /dev/null +++ b/queue-6.6/edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch @@ -0,0 +1,52 @@ +From d42d5715dcb559342ff356327b241c53a67584d9 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Tue, 23 Dec 2025 20:32:02 +0800 +Subject: EDAC/i3200: Fix a resource leak in i3200_probe1() + +From: Haoxiang Li + +commit d42d5715dcb559342ff356327b241c53a67584d9 upstream. + +If edac_mc_alloc() fails, also unmap the window. + + [ bp: Use separate labels, turning it into the classic unwind pattern. ] + +Fixes: dd8ef1db87a4 ("edac: i3200 memory controller driver") +Signed-off-by: Haoxiang Li +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251223123202.1492038-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/i3200_edac.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/edac/i3200_edac.c ++++ b/drivers/edac/i3200_edac.c +@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev * + layers[1].type = EDAC_MC_LAYER_CHANNEL; + layers[1].size = nr_channels; + layers[1].is_virt_csrow = false; +- mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, +- sizeof(struct i3200_priv)); ++ ++ rc = -ENOMEM; ++ mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct i3200_priv)); + if (!mci) +- return -ENOMEM; ++ goto unmap; + + edac_dbg(3, "MC: init mci\n"); + +@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev * + return 0; + + fail: ++ edac_mc_free(mci); ++unmap: + iounmap(window); +- if (mci) +- edac_mc_free(mci); + + return rc; + } diff --git a/queue-6.6/edac-x38-fix-a-resource-leak-in-x38_probe1.patch b/queue-6.6/edac-x38-fix-a-resource-leak-in-x38_probe1.patch new file mode 100644 index 0000000000..d4ee214caa --- /dev/null +++ b/queue-6.6/edac-x38-fix-a-resource-leak-in-x38_probe1.patch @@ -0,0 +1,51 @@ +From 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Tue, 23 Dec 2025 20:43:50 +0800 +Subject: EDAC/x38: Fix a resource leak in x38_probe1() + +From: Haoxiang Li + +commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream. + +If edac_mc_alloc() fails, also unmap the window. + + [ bp: Use separate labels, turning it into the classic unwind pattern. ] + +Fixes: df8bc08c192f ("edac x38: new MC driver module") +Signed-off-by: Haoxiang Li +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251223124350.1496325-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/x38_edac.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/edac/x38_edac.c ++++ b/drivers/edac/x38_edac.c +@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd + layers[1].type = EDAC_MC_LAYER_CHANNEL; + layers[1].size = x38_channel_num; + layers[1].is_virt_csrow = false; ++ ++ ++ rc = -ENOMEM; + mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, 0); + if (!mci) +- return -ENOMEM; ++ goto unmap; + + edac_dbg(3, "MC: init mci\n"); + +@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pd + return 0; + + fail: ++ edac_mc_free(mci); ++unmap: + iounmap(window); +- if (mci) +- edac_mc_free(mci); + + return rc; + } diff --git a/queue-6.6/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch b/queue-6.6/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch new file mode 100644 index 0000000000..08242577fc --- /dev/null +++ b/queue-6.6/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch @@ -0,0 +1,34 @@ +From d250bdf531d9cd4096fedbb9f172bb2ca660c868 Mon Sep 17 00:00:00 2001 +From: Yang Erkun +Date: Sat, 13 Dec 2025 13:57:06 +0800 +Subject: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref + +From: Yang Erkun + +commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream. + +The error branch for ext4_xattr_inode_update_ref forget to release the +refcount for iloc.bh. Find this when review code. + +Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update") +Signed-off-by: Yang Erkun +Reviewed-by: Baokun Li +Reviewed-by: Zhang Yi +Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/xattr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1037,6 +1037,7 @@ static int ext4_xattr_inode_update_ref(h + ext4_error_inode(ea_inode, __func__, __LINE__, 0, + "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", + ea_inode->i_ino, ref_count, ref_change); ++ brelse(iloc.bh); + ret = -EFSCORRUPTED; + goto out; + } diff --git a/queue-6.6/hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch b/queue-6.6/hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch new file mode 100644 index 0000000000..f95a380b0f --- /dev/null +++ b/queue-6.6/hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch @@ -0,0 +1,37 @@ +From 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Wed, 7 Jan 2026 11:39:24 +0100 +Subject: hrtimer: Fix softirq base check in update_needs_ipi() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream. + +The 'clockid' field is not the correct way to check for a softirq base. + +Fix the check to correctly compare the base type instead of the clockid. + +Fixes: 1e7f7fbcd40c ("hrtimer: Avoid more SMP function calls in clock_was_set()") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260107-hrtimer-clock-base-check-v1-1-afb5dbce94a1@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/hrtimer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -941,7 +941,7 @@ static bool update_needs_ipi(struct hrti + return true; + + /* Extra check for softirq clock bases */ +- if (base->clockid < HRTIMER_BASE_MONOTONIC_SOFT) ++ if (base->index < HRTIMER_BASE_MONOTONIC_SOFT) + continue; + if (cpu_base->softirq_activated) + continue; diff --git a/queue-6.6/loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch b/queue-6.6/loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch new file mode 100644 index 0000000000..ade857a349 --- /dev/null +++ b/queue-6.6/loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch @@ -0,0 +1,124 @@ +From a91f86e27087f250a5d9c89bb4a427b9c30fd815 Mon Sep 17 00:00:00 2001 +From: Lisa Robinson +Date: Sat, 17 Jan 2026 10:56:43 +0800 +Subject: LoongArch: Fix PMU counter allocation for mixed-type event groups + +From: Lisa Robinson + +commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 upstream. + +When validating a perf event group, validate_group() unconditionally +attempts to allocate hardware PMU counters for the leader, sibling +events and the new event being added. + +This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event +is part of the group, the current code still tries to allocate a hardware +PMU counter for it, which can wrongly consume hardware PMU resources and +cause spurious allocation failures. + +Fix this by only allocating PMU counters for hardware events during group +validation, and skipping software events. + +A trimmed down reproducer is as simple as this: + + #include + #include + #include + #include + #include + #include + + int main (int argc, char *argv[]) + { + struct perf_event_attr attr = { 0 }; + int fds[5]; + + attr.disabled = 1; + attr.exclude_kernel = 1; + attr.exclude_hv = 1; + attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED | + PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP; + attr.size = sizeof (attr); + + attr.type = PERF_TYPE_SOFTWARE; + attr.config = PERF_COUNT_SW_DUMMY; + fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0); + assert (fds[0] >= 0); + + attr.type = PERF_TYPE_HARDWARE; + attr.config = PERF_COUNT_HW_CPU_CYCLES; + fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); + assert (fds[1] >= 0); + + attr.type = PERF_TYPE_HARDWARE; + attr.config = PERF_COUNT_HW_INSTRUCTIONS; + fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); + assert (fds[2] >= 0); + + attr.type = PERF_TYPE_HARDWARE; + attr.config = PERF_COUNT_HW_BRANCH_MISSES; + fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); + assert (fds[3] >= 0); + + attr.type = PERF_TYPE_HARDWARE; + attr.config = PERF_COUNT_HW_CACHE_REFERENCES; + fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); + assert (fds[4] >= 0); + + printf ("PASSED\n"); + + return 0; + } + +Cc: stable@vger.kernel.org +Fixes: b37042b2bb7c ("LoongArch: Add perf events support") +Signed-off-by: Lisa Robinson +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/perf_event.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/arch/loongarch/kernel/perf_event.c ++++ b/arch/loongarch/kernel/perf_event.c +@@ -637,6 +637,18 @@ static const struct loongarch_perf_event + return pev; + } + ++static inline bool loongarch_pmu_event_requires_counter(const struct perf_event *event) ++{ ++ switch (event->attr.type) { ++ case PERF_TYPE_HARDWARE: ++ case PERF_TYPE_HW_CACHE: ++ case PERF_TYPE_RAW: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int validate_group(struct perf_event *event) + { + struct cpu_hw_events fake_cpuc; +@@ -644,15 +656,18 @@ static int validate_group(struct perf_ev + + memset(&fake_cpuc, 0, sizeof(fake_cpuc)); + +- if (loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0) ++ if (loongarch_pmu_event_requires_counter(leader) && ++ loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0) + return -EINVAL; + + for_each_sibling_event(sibling, leader) { +- if (loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0) ++ if (loongarch_pmu_event_requires_counter(sibling) && ++ loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0) + return -EINVAL; + } + +- if (loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0) ++ if (loongarch_pmu_event_requires_counter(event) && ++ loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0) + return -EINVAL; + + return 0; diff --git a/queue-6.6/mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch b/queue-6.6/mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch new file mode 100644 index 0000000000..e8e6f4a445 --- /dev/null +++ b/queue-6.6/mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch @@ -0,0 +1,48 @@ +From 9814cc832b88bd040fc2a1817c2b5469d0f7e862 Mon Sep 17 00:00:00 2001 +From: SeongJae Park +Date: Wed, 24 Dec 2025 18:30:35 -0800 +Subject: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure + +From: SeongJae Park + +commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 upstream. + +When a context DAMON sysfs directory setup is failed after setup of attrs/ +directory, subdirectories of attrs/ directory are not cleaned up. As a +result, DAMON sysfs interface is nearly broken until the system reboots, +and the memory for the unremoved directory is leaked. + +Cleanup the directories under such failures. + +Link: https://lkml.kernel.org/r/20251225023043.18579-3-sj@kernel.org +Fixes: c951cd3b8901 ("mm/damon: implement a minimal stub for sysfs-based DAMON interface") +Signed-off-by: SeongJae Park +Cc: chongjiapeng +Cc: # 5.18.x +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/sysfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/mm/damon/sysfs.c ++++ b/mm/damon/sysfs.c +@@ -716,7 +716,7 @@ static int damon_sysfs_context_add_dirs( + + err = damon_sysfs_context_set_targets(context); + if (err) +- goto put_attrs_out; ++ goto rmdir_put_attrs_out; + + err = damon_sysfs_context_set_schemes(context); + if (err) +@@ -726,7 +726,8 @@ static int damon_sysfs_context_add_dirs( + put_targets_attrs_out: + kobject_put(&context->targets->kobj); + context->targets = NULL; +-put_attrs_out: ++rmdir_put_attrs_out: ++ damon_sysfs_attrs_rm_dirs(context->attrs); + kobject_put(&context->attrs->kobj); + context->attrs = NULL; + return err; diff --git a/queue-6.6/mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch b/queue-6.6/mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch new file mode 100644 index 0000000000..32cb09681b --- /dev/null +++ b/queue-6.6/mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch @@ -0,0 +1,60 @@ +From b9efe36b5e3eb2e91aa3d706066428648af034fc Mon Sep 17 00:00:00 2001 +From: Aboorva Devarajan +Date: Mon, 1 Dec 2025 11:30:09 +0530 +Subject: mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free + +From: Aboorva Devarajan + +commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream. + +When page isolation loops indefinitely during memory offline, reading +/proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock, +causing hung task warnings. + +Make procfs reads lock-free since percpu_pagelist_high_fraction is a +simple integer with naturally atomic reads, writers still serialize via +the mutex. + +This prevents hung task warnings when reading the procfs file during +long-running memory offline operations. + +[akpm@linux-foundation.org: add comment, per Michal] + Link: https://lkml.kernel.org/r/aS_y9AuJQFydLEXo@tiehlicka +Link: https://lkml.kernel.org/r/20251201060009.1420792-1-aboorvad@linux.ibm.com +Signed-off-by: Aboorva Devarajan +Acked-by: Michal Hocko +Cc: Brendan Jackman +Cc: Johannes Weiner +Cc: Suren Baghdasaryan +Cc: Vlastimil Babka +Cc: Zi Yan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_alloc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -5936,11 +5936,19 @@ static int percpu_pagelist_high_fraction + int old_percpu_pagelist_high_fraction; + int ret; + ++ /* ++ * Avoid using pcp_batch_high_lock for reads as the value is read ++ * atomically and a race with offlining is harmless. ++ */ ++ ++ if (!write) ++ return proc_dointvec_minmax(table, write, buffer, length, ppos); ++ + mutex_lock(&pcp_batch_high_lock); + old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction; + + ret = proc_dointvec_minmax(table, write, buffer, length, ppos); +- if (!write || ret < 0) ++ if (ret < 0) + goto out; + + /* Sanity checking to avoid pcp imbalance */ diff --git a/queue-6.6/net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch b/queue-6.6/net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch new file mode 100644 index 0000000000..e33be67287 --- /dev/null +++ b/queue-6.6/net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch @@ -0,0 +1,52 @@ +From 1809c82aa073a11b7d335ae932d81ce51a588a4a Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Wed, 14 Jan 2026 00:28:47 +0900 +Subject: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts + +From: Tetsuo Handa + +commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream. + +Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is +called only when the timer is enabled, we need to call +j1939_session_deactivate_activate_next() if we cancelled the timer. +Otherwise, refcount for j1939_session leaks, which will later appear as + +| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2. + +problem. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 +Signed-off-by: Tetsuo Handa +Tested-by: Oleksij Rempel +Acked-by: Oleksij Rempel +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_acti + + j1939_session_timers_cancel(session); + j1939_session_cancel(session, J1939_XTP_ABORT_BUSY); +- if (session->transmission) ++ if (session->transmission) { + j1939_session_deactivate_activate_next(session); ++ } else if (session->state == J1939_SESSION_WAITING_ABORT) { ++ /* Force deactivation for the receiver. ++ * If we rely on the timer starting in j1939_session_cancel, ++ * a second RTS call here will cancel that timer and fail ++ * to restart it because the state is already WAITING_ABORT. ++ */ ++ j1939_session_deactivate_activate_next(session); ++ } + + return -EBUSY; + } diff --git a/queue-6.6/null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch b/queue-6.6/null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch new file mode 100644 index 0000000000..29f267fa00 --- /dev/null +++ b/queue-6.6/null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch @@ -0,0 +1,85 @@ +From 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 Mon Sep 17 00:00:00 2001 +From: Nilay Shroff +Date: Tue, 13 Jan 2026 12:27:22 +0530 +Subject: null_blk: fix kmemleak by releasing references to fault configfs items + +From: Nilay Shroff + +commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 upstream. + +When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk +driver sets up fault injection support by creating the timeout_inject, +requeue_inject, and init_hctx_fault_inject configfs items as children +of the top-level nullbX configfs group. + +However, when the nullbX device is removed, the references taken to +these fault-config configfs items are not released. As a result, +kmemleak reports a memory leak, for example: + +unreferenced object 0xc00000021ff25c40 (size 32): + comm "mkdir", pid 10665, jiffies 4322121578 + hex dump (first 32 bytes): + 69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_ + 69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject.......... + backtrace (crc 1a018c86): + __kmalloc_node_track_caller_noprof+0x494/0xbd8 + kvasprintf+0x74/0xf4 + config_item_set_name+0xf0/0x104 + config_group_init_type_name+0x48/0xfc + fault_config_init+0x48/0xf0 + 0xc0080000180559e4 + configfs_mkdir+0x304/0x814 + vfs_mkdir+0x49c/0x604 + do_mkdirat+0x314/0x3d0 + sys_mkdir+0xa0/0xd8 + system_call_exception+0x1b0/0x4f0 + system_call_vectored_common+0x15c/0x2ec + +Fix this by explicitly releasing the references to the fault-config +configfs items when dropping the reference to the top-level nullbX +configfs group. + +Cc: stable@vger.kernel.org +Reviewed-by: Chaitanya Kulkarni +Fixes: bb4c19e030f4 ("block: null_blk: make fault-injection dynamically configurable per device") +Signed-off-by: Nilay Shroff +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/null_blk/main.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -622,12 +622,22 @@ static void nullb_add_fault_config(struc + configfs_add_default_group(&dev->init_hctx_fault_config.group, &dev->group); + } + ++static void nullb_del_fault_config(struct nullb_device *dev) ++{ ++ config_item_put(&dev->init_hctx_fault_config.group.cg_item); ++ config_item_put(&dev->requeue_config.group.cg_item); ++ config_item_put(&dev->timeout_config.group.cg_item); ++} ++ + #else + + static void nullb_add_fault_config(struct nullb_device *dev) + { + } + ++static void nullb_del_fault_config(struct nullb_device *dev) ++{ ++} + #endif + + static struct +@@ -659,7 +669,7 @@ nullb_group_drop_item(struct config_grou + null_del_dev(dev->nullb); + mutex_unlock(&lock); + } +- ++ nullb_del_fault_config(dev); + config_item_put(item); + } + diff --git a/queue-6.6/nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch b/queue-6.6/nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch new file mode 100644 index 0000000000..7797b12f18 --- /dev/null +++ b/queue-6.6/nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch @@ -0,0 +1,40 @@ +From 340f4fc5508c2905a1f30de229e2a4b299d55735 Mon Sep 17 00:00:00 2001 +From: Ilikara Zheng +Date: Mon, 8 Dec 2025 21:23:40 +0800 +Subject: nvme-pci: disable secondary temp for Wodposit WPBSNM8 + +From: Ilikara Zheng + +commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream. + +Secondary temperature thresholds (temp2_{min,max}) were not reported +properly on this NVMe SSD. This resulted in an error while attempting to +read these values with sensors(1): + + ERROR: Can't get value of subfeature temp2_min: I/O error + ERROR: Can't get value of subfeature temp2_max: I/O error + +Add the device to the nvme_id_table with the +NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non- +composite temperature thresholds. + +Cc: stable@vger.kernel.org +Tested-by: Wu Haotian +Signed-off-by: Ilikara Zheng +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3563,6 +3563,8 @@ static const struct pci_device_id nvme_i + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, ++ { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */ ++ .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, }, + { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */ diff --git a/queue-6.6/phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch b/queue-6.6/phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch new file mode 100644 index 0000000000..84129c0b94 --- /dev/null +++ b/queue-6.6/phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch @@ -0,0 +1,46 @@ +From f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 Mon Sep 17 00:00:00 2001 +From: Rafael Beims +Date: Tue, 23 Dec 2025 12:02:54 -0300 +Subject: phy: freescale: imx8m-pcie: assert phy reset during power on + +From: Rafael Beims + +commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 upstream. + +After U-Boot initializes PCIe with "pcie enum", Linux fails to detect +an NVMe disk on some boot cycles with: + + phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110 + +Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to +lock when re-initialized without a reset cycle [1]. + +The issue reproduces on 7% of tested hardware platforms, with a 30-40% +failure rate per affected device across boot cycles. + +Insert a reset cycle in the power-on routine to ensure the PHY is +initialized from a known state. + +[1] https://community.nxp.com/t5/i-MX-Processors/iMX8MP-PCIe-initialization-in-U-Boot/m-p/2248437#M242401 + +Signed-off-by: Rafael Beims +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251223150254.1075221-1-rafael@beims.me +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c ++++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c +@@ -89,7 +89,8 @@ static int imx8_pcie_phy_power_on(struct + writel(imx8_phy->tx_deemph_gen2, + imx8_phy->base + PCIE_PHY_TRSV_REG6); + break; +- case IMX8MP: /* Do nothing. */ ++ case IMX8MP: ++ reset_control_assert(imx8_phy->reset); + break; + } + diff --git a/queue-6.6/phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch b/queue-6.6/phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch new file mode 100644 index 0000000000..562726cdea --- /dev/null +++ b/queue-6.6/phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch @@ -0,0 +1,80 @@ +From 7d8f725b79e35fa47e42c88716aad8711e1168d8 Mon Sep 17 00:00:00 2001 +From: Luca Ceresoli +Date: Thu, 27 Nov 2025 11:26:17 +0100 +Subject: phy: rockchip: inno-usb2: fix communication disruption in gadget mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Ceresoli + +commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream. + +When the OTG USB port is used to power to SoC, configured as peripheral and +used in gadget mode, communication stops without notice about 6 seconds +after the gadget is configured and enumerated. + +The problem was observed on a Radxa Rock Pi S board, which can only be +powered by the only USB-C connector. That connector is the only one usable +in gadget mode. This implies the USB cable is connected from before boot +and never disconnects while the kernel runs. + +The related code flow in the PHY driver code can be summarized as: + + * the first time chg_detect_work starts (6 seconds after gadget is + configured and enumerated) + -> rockchip_chg_detect_work(): + if chg_state is UNDEFINED: + property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y] + + * rockchip_chg_detect_work() changes state and re-triggers itself a few + times until it reaches the DETECTED state: + -> rockchip_chg_detect_work(): + if chg_state is DETECTED: + property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z] + +At [Y] all existing communications stop. E.g. using a CDC serial gadget, +the /dev/tty* devices are still present on both host and device, but no +data is transferred anymore. The later call with a 'true' argument at [Z] +does not restore it. + +Due to the lack of documentation, what chg_det.opmode does exactly is not +clear, however by code inspection it seems reasonable that is disables +something needed to keep the communication working, and testing proves that +disabling these lines lets gadget mode keep working. So prevent changes to +chg_det.opmode when there is a cable connected (VBUS present). + +Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ +Signed-off-by: Luca Ceresoli +Reviewed-by: Théo Lebrun +Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-2-dac8a02cd2ca@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +@@ -799,7 +799,8 @@ static void rockchip_chg_detect_work(str + if (!rport->suspended) + rockchip_usb2phy_power_off(rport->phy); + /* put the controller in non-driving mode */ +- property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); ++ if (!vbus_attach) ++ property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); + /* Start DCD processing stage 1 */ + rockchip_chg_enable_dcd(rphy, true); + rphy->chg_state = USB_CHG_STATE_WAIT_FOR_DCD; +@@ -862,7 +863,8 @@ static void rockchip_chg_detect_work(str + fallthrough; + case USB_CHG_STATE_DETECTED: + /* put the controller in normal mode */ +- property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); ++ if (!vbus_attach) ++ property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); + rockchip_usb2phy_otg_sm_work(&rport->otg_sm_work.work); + dev_dbg(&rport->phy->dev, "charger = %s\n", + chg_to_string(rphy->chg_type)); diff --git a/queue-6.6/phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch b/queue-6.6/phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch new file mode 100644 index 0000000000..cac5033226 --- /dev/null +++ b/queue-6.6/phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch @@ -0,0 +1,88 @@ +From 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc Mon Sep 17 00:00:00 2001 +From: Louis Chauvet +Date: Thu, 27 Nov 2025 11:26:16 +0100 +Subject: phy: rockchip: inno-usb2: fix disconnection in gadget mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Louis Chauvet + +commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream. + +When the OTG USB port is used to power the SoC, configured as peripheral +and used in gadget mode, there is a disconnection about 6 seconds after the +gadget is configured and enumerated. + +The problem was observed on a Radxa Rock Pi S board, which can only be +powered by the only USB-C connector. That connector is the only one usable +in gadget mode. This implies the USB cable is connected from before boot +and never disconnects while the kernel runs. + +The problem happens because of the PHY driver code flow, summarized as: + + * UDC start code (triggered via configfs at any time after boot) + -> phy_init + -> rockchip_usb2phy_init + -> schedule_delayed_work(otg_sm_work [A], 6 sec) + -> phy_power_on + -> rockchip_usb2phy_power_on + -> enable clock + -> rockchip_usb2phy_reset + + * Now the gadget interface is up and running. + + * 6 seconds later otg_sm_work starts [A] + -> rockchip_usb2phy_otg_sm_work(): + if (B_IDLE state && VBUS present && ...): + schedule_delayed_work(&rport->chg_work [B], 0); + + * immediately the chg_detect_work starts [B] + -> rockchip_chg_detect_work(): + if chg_state is UNDEFINED: + if (!rport->suspended): + rockchip_usb2phy_power_off() <--- [X] + +At [X], the PHY is powered off, causing a disconnection. This quickly +triggers a new connection and following re-enumeration, but any connection +that had been established during the 6 seconds is broken. + +The code already checks for !rport->suspended (which, somewhat +counter-intuitively, means the PHY is powered on), so add a guard for VBUS +as well to avoid a disconnection when a cable is connected. + +Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ +Signed-off-by: Louis Chauvet +Co-developed-by: Luca Ceresoli +Signed-off-by: Luca Ceresoli +Reviewed-by: Théo Lebrun +Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-1-dac8a02cd2ca@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +@@ -789,14 +789,16 @@ static void rockchip_chg_detect_work(str + container_of(work, struct rockchip_usb2phy_port, chg_work.work); + struct rockchip_usb2phy *rphy = dev_get_drvdata(rport->phy->dev.parent); + struct regmap *base = get_reg_base(rphy); +- bool is_dcd, tmout, vout; ++ bool is_dcd, tmout, vout, vbus_attach; + unsigned long delay; + ++ vbus_attach = property_enabled(rphy->grf, &rport->port_cfg->utmi_bvalid); ++ + dev_dbg(&rport->phy->dev, "chg detection work state = %d\n", + rphy->chg_state); + switch (rphy->chg_state) { + case USB_CHG_STATE_UNDEFINED: +- if (!rport->suspended) ++ if (!rport->suspended && !vbus_attach) + rockchip_usb2phy_power_off(rport->phy); + /* put the controller in non-driving mode */ + if (!vbus_attach) diff --git a/queue-6.6/phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch b/queue-6.6/phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch new file mode 100644 index 0000000000..115786f86e --- /dev/null +++ b/queue-6.6/phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch @@ -0,0 +1,45 @@ +From b246caa68037aa495390a60d080acaeb84f45fff Mon Sep 17 00:00:00 2001 +From: Wayne Chang +Date: Fri, 12 Dec 2025 11:21:16 +0800 +Subject: phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 + +From: Wayne Chang + +commit b246caa68037aa495390a60d080acaeb84f45fff upstream. + +The USB2 Bias Pad Control register manages analog parameters for signal +detection. Previously, the HS_DISCON_LEVEL relied on hardware reset +values, which may lead to the detection failure. + +Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect +threshold is sufficient to guarantee reliable detection. + +Fixes: bbf711682cd5 ("phy: tegra: xusb: Add Tegra186 support") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Link: https://patch.msgid.link/20251212032116.768307-1-waynec@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra186.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/phy/tegra/xusb-tegra186.c ++++ b/drivers/phy/tegra/xusb-tegra186.c +@@ -84,6 +84,7 @@ + #define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284 + #define BIAS_PAD_PD BIT(11) + #define HS_SQUELCH_LEVEL(x) (((x) & 0x7) << 0) ++#define HS_DISCON_LEVEL(x) (((x) & 0x7) << 3) + + #define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288 + #define USB2_TRK_START_TIMER(x) (((x) & 0x7f) << 12) +@@ -623,6 +624,8 @@ static void tegra186_utmi_bias_pad_power + value &= ~BIAS_PAD_PD; + value &= ~HS_SQUELCH_LEVEL(~0); + value |= HS_SQUELCH_LEVEL(priv->calib.hs_squelch); ++ value &= ~HS_DISCON_LEVEL(~0); ++ value |= HS_DISCON_LEVEL(0x7); + padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL0); + + udelay(1); diff --git a/queue-6.6/scsi-core-fix-error-handler-encryption-support.patch b/queue-6.6/scsi-core-fix-error-handler-encryption-support.patch new file mode 100644 index 0000000000..30299da880 --- /dev/null +++ b/queue-6.6/scsi-core-fix-error-handler-encryption-support.patch @@ -0,0 +1,105 @@ +From 9a49157deeb23581fc5c8189b486340d7343264a Mon Sep 17 00:00:00 2001 +From: Brian Kao +Date: Thu, 18 Dec 2025 03:17:23 +0000 +Subject: scsi: core: Fix error handler encryption support + +From: Brian Kao + +commit 9a49157deeb23581fc5c8189b486340d7343264a upstream. + +Some low-level drivers (LLD) access block layer crypto fields, such as +rq->crypt_keyslot and rq->crypt_ctx within `struct request`, to +configure hardware for inline encryption. However, SCSI Error Handling +(EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not +involve any encryption setup. + +To prevent drivers from erroneously applying crypto settings during EH, +this patch saves the original values of rq->crypt_keyslot and +rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd(). +These fields in the 'struct request' are then set to NULL. The original +values are restored in scsi_eh_restore_cmnd() after the EH command +completes. + +This ensures that the block layer crypto context does not leak into EH +command execution. + +Signed-off-by: Brian Kao +Link: https://patch.msgid.link/20251218031726.2642834-1-powenkao@google.com +Cc: stable@vger.kernel.org +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_error.c | 24 ++++++++++++++++++++++++ + include/scsi/scsi_eh.h | 6 ++++++ + 2 files changed, 30 insertions(+) + +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -1039,6 +1039,9 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd + unsigned char *cmnd, int cmnd_size, unsigned sense_bytes) + { + struct scsi_device *sdev = scmd->device; ++#ifdef CONFIG_BLK_INLINE_ENCRYPTION ++ struct request *rq = scsi_cmd_to_rq(scmd); ++#endif + + /* + * We need saved copies of a number of fields - this is because +@@ -1091,6 +1094,18 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd + (sdev->lun << 5 & 0xe0); + + /* ++ * Encryption must be disabled for the commands submitted by the error handler. ++ * Hence, clear the encryption context information. ++ */ ++#ifdef CONFIG_BLK_INLINE_ENCRYPTION ++ ses->rq_crypt_keyslot = rq->crypt_keyslot; ++ ses->rq_crypt_ctx = rq->crypt_ctx; ++ ++ rq->crypt_keyslot = NULL; ++ rq->crypt_ctx = NULL; ++#endif ++ ++ /* + * Zero the sense buffer. The scsi spec mandates that any + * untransferred sense data should be interpreted as being zero. + */ +@@ -1107,6 +1122,10 @@ EXPORT_SYMBOL(scsi_eh_prep_cmnd); + */ + void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses) + { ++#ifdef CONFIG_BLK_INLINE_ENCRYPTION ++ struct request *rq = scsi_cmd_to_rq(scmd); ++#endif ++ + /* + * Restore original data + */ +@@ -1119,6 +1138,11 @@ void scsi_eh_restore_cmnd(struct scsi_cm + scmd->underflow = ses->underflow; + scmd->prot_op = ses->prot_op; + scmd->eh_eflags = ses->eh_eflags; ++ ++#ifdef CONFIG_BLK_INLINE_ENCRYPTION ++ rq->crypt_keyslot = ses->rq_crypt_keyslot; ++ rq->crypt_ctx = ses->rq_crypt_ctx; ++#endif + } + EXPORT_SYMBOL(scsi_eh_restore_cmnd); + +--- a/include/scsi/scsi_eh.h ++++ b/include/scsi/scsi_eh.h +@@ -41,6 +41,12 @@ struct scsi_eh_save { + unsigned char cmnd[32]; + struct scsi_data_buffer sdb; + struct scatterlist sense_sgl; ++ ++ /* struct request fields */ ++#ifdef CONFIG_BLK_INLINE_ENCRYPTION ++ struct bio_crypt_ctx *rq_crypt_ctx; ++ struct blk_crypto_keyslot *rq_crypt_keyslot; ++#endif + }; + + extern void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, diff --git a/queue-6.6/series b/queue-6.6/series index d19fbbc5d4..cc5c5160b4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -42,3 +42,30 @@ dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch i2c-qcom-geni-make-sure-i2c-hub-controllers-can-t-us.patch hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch +scsi-core-fix-error-handler-encryption-support.patch +alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch +null_blk-fix-kmemleak-by-releasing-references-to-fault-configfs-items.patch +can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch +can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch +net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch +x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch +phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch +phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch +phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch +phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch +usb-dwc3-check-for-usb4-ip_name.patch +usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch +usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch +usb-serial-option-add-telit-le910-mbim-composition.patch +usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch +nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch +ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch +hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch +edac-x38-fix-a-resource-leak-in-x38_probe1.patch +edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch +tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch +x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch +x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch +mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch +mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch +loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch diff --git a/queue-6.6/tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch b/queue-6.6/tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch new file mode 100644 index 0000000000..35159cce79 --- /dev/null +++ b/queue-6.6/tcpm-allow-looking-for-role_sw-device-in-the-main-node.patch @@ -0,0 +1,40 @@ +From 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f Mon Sep 17 00:00:00 2001 +From: Arnaud Ferraris +Date: Mon, 5 Jan 2026 09:43:23 +0100 +Subject: tcpm: allow looking for role_sw device in the main node + +From: Arnaud Ferraris + +commit 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f upstream. + +If ports are defined in the tcpc main node, fwnode_usb_role_switch_get() +returns an error, meaning usb_role_switch_get() (which would succeed) +never gets a chance to run as port->role_sw isn't NULL, causing a +regression on devices where this is the case. + +Fix this by turning the NULL check into IS_ERR_OR_NULL(), so +usb_role_switch_get() can actually run and the device get properly probed. + +Fixes: 2d8713f807a4 ("tcpm: switch check for role_sw device with fw_node") +Cc: stable +Reviewed-by: Heikki Krogerus +Reviewed-by: Dragan Simic +Signed-off-by: Arnaud Ferraris +Link: https://patch.msgid.link/20260105-fix-ppp-power-v2-1-6924f5a41224@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -6637,7 +6637,7 @@ struct tcpm_port *tcpm_register_port(str + port->port_type = port->typec_caps.type; + + port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); +- if (!port->role_sw) ++ if (IS_ERR_OR_NULL(port->role_sw)) + port->role_sw = usb_role_switch_get(port->dev); + if (IS_ERR(port->role_sw)) { + err = PTR_ERR(port->role_sw); diff --git a/queue-6.6/usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch b/queue-6.6/usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch new file mode 100644 index 0000000000..df95773656 --- /dev/null +++ b/queue-6.6/usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch @@ -0,0 +1,65 @@ +From 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Johannes=20Br=C3=BCderl?= +Date: Sun, 7 Dec 2025 10:02:20 +0100 +Subject: usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johannes Brüderl + +commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd upstream. + +Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor +for devices that cannot handle it. + +Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when +the BOS descriptor is requested at SuperSpeed Plus (10Gbps). + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220027 +Cc: stable +Signed-off-by: Johannes Brüderl +Link: https://patch.msgid.link/20251207090220.14807-1-johannes.bruederl@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/config.c | 5 +++++ + drivers/usb/core/quirks.c | 3 +++ + include/linux/usb/quirks.h | 3 +++ + 3 files changed, 11 insertions(+) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -1004,6 +1004,11 @@ int usb_get_bos_descriptor(struct usb_de + __u8 cap_type; + int ret; + ++ if (dev->quirks & USB_QUIRK_NO_BOS) { ++ dev_dbg(ddev, "skipping BOS descriptor\n"); ++ return -ENOMSG; ++ } ++ + bos = kzalloc(sizeof(*bos), GFP_KERNEL); + if (!bos) + return -ENOMEM; +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -447,6 +447,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0c45, 0x7056), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Elgato 4K X - BOS descriptor fetch hangs at SuperSpeed Plus */ ++ { USB_DEVICE(0x0fd9, 0x009b), .driver_info = USB_QUIRK_NO_BOS }, ++ + /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ + { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM }, + +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -75,4 +75,7 @@ + /* short SET_ADDRESS request timeout */ + #define USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT BIT(16) + ++/* skip BOS descriptor request */ ++#define USB_QUIRK_NO_BOS BIT(17) ++ + #endif /* __LINUX_USB_QUIRKS_H */ diff --git a/queue-6.6/usb-dwc3-check-for-usb4-ip_name.patch b/queue-6.6/usb-dwc3-check-for-usb4-ip_name.patch new file mode 100644 index 0000000000..1e3b1a7486 --- /dev/null +++ b/queue-6.6/usb-dwc3-check-for-usb4-ip_name.patch @@ -0,0 +1,44 @@ +From 0ed91d47959cb7573c17e06487f0fb891d59dfb3 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Fri, 2 Jan 2026 21:53:46 +0000 +Subject: usb: dwc3: Check for USB4 IP_NAME + +From: Thinh Nguyen + +commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream. + +Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No +functional change except checking for the IP_NAME here. The driver will +treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4 +will be introduced and checked separately. + +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://patch.msgid.link/e6f1827754c7a7ddc5eb7382add20bfe3a9b312f.1767390747.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 2 ++ + drivers/usb/dwc3/core.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -892,6 +892,8 @@ static bool dwc3_core_is_valid(struct dw + + reg = dwc3_readl(dwc->regs, DWC3_GSNPSID); + dwc->ip = DWC3_GSNPS_ID(reg); ++ if (dwc->ip == DWC4_IP) ++ dwc->ip = DWC32_IP; + + /* This should read as U3 followed by revision number */ + if (DWC3_IP_IS(DWC3)) { +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1221,6 +1221,7 @@ struct dwc3 { + #define DWC3_IP 0x5533 + #define DWC31_IP 0x3331 + #define DWC32_IP 0x3332 ++#define DWC4_IP 0x3430 + + u32 revision; + diff --git a/queue-6.6/usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch b/queue-6.6/usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch new file mode 100644 index 0000000000..a87998998c --- /dev/null +++ b/queue-6.6/usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch @@ -0,0 +1,89 @@ +From 01ef7f1b8713a78ab1a9512cf8096d2474c70633 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Mon, 12 Jan 2026 16:48:02 +0800 +Subject: USB: OHCI/UHCI: Add soft dependencies on ehci_platform + +From: Huacai Chen + +commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream. + +Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not +loaded first") said that ehci-hcd should be loaded before ohci-hcd and +uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft +dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci- +pci, which is not enough and we may still see the warnings in boot log. + +To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on +ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f +is bogus, we only need the soft dependencies in the PCI level rather +than the HCD level. + +However, there is really another neccessary soft dependencies between +ohci-platform/uhci-platform and ehci-platform, which is added by this +patch. The boot logs are below. + +1. ohci-platform loaded before ehci-platform: + + ohci-platform 1f058000.usb: Generic Platform OHCI controller + ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1 + ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000 + hub 1-0:1.0: USB hub found + hub 1-0:1.0: 4 ports detected + Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after + usb 1-4: new low-speed USB device number 2 using ohci-platform + ehci-platform 1f050000.usb: EHCI Host Controller + ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2 + ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000 + ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00 + usb 1-4: device descriptor read/all, error -62 + hub 2-0:1.0: USB hub found + hub 2-0:1.0: 4 ports detected + usb 1-4: new low-speed USB device number 3 using ohci-platform + input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0 + hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0 + +2. ehci-platform loaded before ohci-platform: + + ehci-platform 1f050000.usb: EHCI Host Controller + ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1 + ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000 + ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00 + hub 1-0:1.0: USB hub found + hub 1-0:1.0: 4 ports detected + ohci-platform 1f058000.usb: Generic Platform OHCI controller + ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2 + ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000 + hub 2-0:1.0: USB hub found + hub 2-0:1.0: 4 ports detected + usb 2-4: new low-speed USB device number 2 using ohci-platform + input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0 + hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0 + +In the later case, there is no re-connection for USB-1.0/1.1 devices, +which is expected. + +Cc: stable +Reported-by: Shengwen Xiao +Signed-off-by: Huacai Chen +Reviewed-by: Alan Stern +Link: https://patch.msgid.link/20260112084802.1995923-1-chenhuacai@loongson.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ohci-platform.c | 1 + + drivers/usb/host/uhci-platform.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/host/ohci-platform.c ++++ b/drivers/usb/host/ohci-platform.c +@@ -376,3 +376,4 @@ MODULE_DESCRIPTION(DRIVER_DESC); + MODULE_AUTHOR("Hauke Mehrtens"); + MODULE_AUTHOR("Alan Stern"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: ehci_platform"); +--- a/drivers/usb/host/uhci-platform.c ++++ b/drivers/usb/host/uhci-platform.c +@@ -191,3 +191,4 @@ static struct platform_driver uhci_platf + .of_match_table = platform_uhci_ids, + }, + }; ++MODULE_SOFTDEP("pre: ehci_platform"); diff --git a/queue-6.6/usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch b/queue-6.6/usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch new file mode 100644 index 0000000000..1c96f0a56b --- /dev/null +++ b/queue-6.6/usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch @@ -0,0 +1,43 @@ +From c0afe95e62984ceea171c3ea319beaf84a21181c Mon Sep 17 00:00:00 2001 +From: Ethan Nelson-Moore +Date: Wed, 10 Dec 2025 18:01:17 -0800 +Subject: USB: serial: ftdi_sio: add support for PICAXE AXE027 cable + +From: Ethan Nelson-Moore + +commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream. + +The vendor provides instructions to write "0403 bd90" to +/sys/bus/usb-serial/drivers/ftdi_sio/new_id; see: +https://picaxe.com/docs/picaxe_linux_instructions.pdf + +Cc: stable@vger.kernel.org +Signed-off-by: Ethan Nelson-Moore +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -850,6 +850,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, ++ { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -96,6 +96,8 @@ + #define LMI_LM3S_EVAL_BOARD_PID 0xbcd9 + #define LMI_LM3S_ICDI_BOARD_PID 0xbcda + ++#define FTDI_AXE027_PID 0xBD90 /* PICAXE AXE027 USB download cable */ ++ + #define FTDI_TURTELIZER_PID 0xBDC8 /* JTAG/RS-232 adapter by egnite GmbH */ + + /* OpenDCC (www.opendcc.de) product id */ diff --git a/queue-6.6/usb-serial-option-add-telit-le910-mbim-composition.patch b/queue-6.6/usb-serial-option-add-telit-le910-mbim-composition.patch new file mode 100644 index 0000000000..f6cc5f36bf --- /dev/null +++ b/queue-6.6/usb-serial-option-add-telit-le910-mbim-composition.patch @@ -0,0 +1,62 @@ +From 8af4274ab5999831f4757dfd5bd11665ba3b1569 Mon Sep 17 00:00:00 2001 +From: Ulrich Mohr +Date: Tue, 9 Dec 2025 21:08:41 +0100 +Subject: USB: serial: option: add Telit LE910 MBIM composition + +From: Ulrich Mohr + +commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream. + +Add support for Telit LE910 module when operating in MBIM composition +with additional ttys. This USB product ID is used by the module +when AT#USBCFG is set to 7. + +0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP + +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1252 Rev=03.18 +S: Manufacturer=Android +S: Product=LE910C1-EU +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +Signed-off-by: Ulrich Mohr +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1505,6 +1505,7 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), diff --git a/queue-6.6/x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch b/queue-6.6/x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch new file mode 100644 index 0000000000..2e1811f2fe --- /dev/null +++ b/queue-6.6/x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch @@ -0,0 +1,111 @@ +From 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 6 Nov 2025 15:13:50 -0800 +Subject: x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers + +From: Dan Williams + +commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream. + +Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") +is too narrow. The effect being mitigated in that commit is caused by +ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general, +lets any physical address be added to the direct-map. I.e. not only ACPI +hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but +also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update +the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases. + +Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of +this problem is limited to the PCI_P2PDMA=n case. + +A potential path to recover entropy would be to walk ACPI and determine the +limits for hotplug and PCI MMIO before kernel_randomize_memory(). On +smaller systems that could yield some KASLR address bits. This needs +additional investigation to determine if some limited ACPI table scanning +can happen this early without an open coded solution like +arch/x86/boot/compressed/acpi.c needs to deploy. + +Cc: Ingo Molnar +Cc: Kees Cook +Cc: Bjorn Helgaas +Cc: Peter Zijlstra +Cc: Andy Lutomirski +Cc: Logan Gunthorpe +Cc: Andrew Morton +Cc: David Hildenbrand +Cc: Lorenzo Stoakes +Cc: "Liam R. Howlett" +Cc: Vlastimil Babka +Cc: Mike Rapoport +Cc: Suren Baghdasaryan +Cc: Michal Hocko +Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") +Cc: +Signed-off-by: Dan Williams +Reviewed-by: Balbir Singh +Tested-by: Yasunori Goto +Acked-by: Dave Hansen +Link: http://patch.msgid.link/692e08b2516d4_261c1100a3@dwillia2-mobl4.notmuch +Signed-off-by: Dave Jiang +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/kaslr.c | 10 +++++----- + drivers/pci/Kconfig | 6 ------ + mm/Kconfig | 10 +++++++--- + 3 files changed, 12 insertions(+), 14 deletions(-) + +--- a/arch/x86/mm/kaslr.c ++++ b/arch/x86/mm/kaslr.c +@@ -111,12 +111,12 @@ void __init kernel_randomize_memory(void + + /* + * Adapt physical memory region size based on available memory, +- * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the +- * device BAR space assuming the direct map space is large enough +- * for creating a ZONE_DEVICE mapping in the direct map corresponding +- * to the physical BAR address. ++ * except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map ++ * any physical address into the direct-map. KASLR wants to reliably ++ * steal some physical address bits. Those design choices are in direct ++ * conflict. + */ +- if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb)) ++ if (!IS_ENABLED(CONFIG_ZONE_DEVICE) && (memory_tb < kaslr_regions[0].size_tb)) + kaslr_regions[0].size_tb = memory_tb; + + /* +--- a/drivers/pci/Kconfig ++++ b/drivers/pci/Kconfig +@@ -180,12 +180,6 @@ config PCI_P2PDMA + P2P DMA transactions must be between devices behind the same root + port. + +- Enabling this option will reduce the entropy of x86 KASLR memory +- regions. For example - on a 46 bit system, the entropy goes down +- from 16 bits to 15 bits. The actual reduction in entropy depends +- on the physical address bits, on processor features, kernel config +- (5 level page table) and physical memory present on the system. +- + If unsure, say N. + + config PCI_LABEL +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -1067,10 +1067,14 @@ config ZONE_DEVICE + Device memory hotplug support allows for establishing pmem, + or other device driver discovered memory regions, in the + memmap. This allows pfn_to_page() lookups of otherwise +- "device-physical" addresses which is needed for using a DAX +- mapping in an O_DIRECT operation, among other things. ++ "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and ++ DEVICE_PRIVATE features among others. + +- If FS_DAX is enabled, then say Y. ++ Enabling this option will reduce the entropy of x86 KASLR memory ++ regions. For example - on a 46 bit system, the entropy goes down ++ from 16 bits to 15 bits. The actual reduction in entropy depends ++ on the physical address bits, on processor features, kernel config ++ (5 level page table) and physical memory present on the system. + + # + # Helpers to mirror range of the CPU page tables of a process into device page diff --git a/queue-6.6/x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch b/queue-6.6/x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch new file mode 100644 index 0000000000..29a727f404 --- /dev/null +++ b/queue-6.6/x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch @@ -0,0 +1,58 @@ +From 6ee98aabdc700b5705e4f1833e2edc82a826b53b Mon Sep 17 00:00:00 2001 +From: Xiaochen Shen +Date: Tue, 9 Dec 2025 14:26:49 +0800 +Subject: x86/resctrl: Add missing resctrl initialization for Hygon + +From: Xiaochen Shen + +commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream. + +Hygon CPUs supporting Platform QoS features currently undergo partial resctrl +initialization through resctrl_cpu_detect() in the Hygon BSP init helper and +AMD/Hygon common initialization code. However, several critical data +structures remain uninitialized for Hygon CPUs in the following paths: + + - get_mem_config()-> __rdt_get_mem_config_amd(): + rdt_resource::membw,alloc_capable + hw_res::num_closid + + - rdt_init_res_defs()->rdt_init_res_defs_amd(): + rdt_resource::cache + hw_res::msr_base,msr_update + +Add the missing AMD/Hygon common initialization to ensure proper Platform QoS +functionality on Hygon CPUs. + +Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper") +Signed-off-by: Xiaochen Shen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Reinette Chatre +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251209062650.1536952-2-shenxiaochen@open-hieco.net +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/resctrl/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/resctrl/core.c ++++ b/arch/x86/kernel/cpu/resctrl/core.c +@@ -755,7 +755,8 @@ static __init bool get_mem_config(void) + + if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) + return __get_mem_config_intel(&hw_res->r_resctrl); +- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) ++ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || ++ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) + return __rdt_get_mem_config_amd(&hw_res->r_resctrl); + + return false; +@@ -907,7 +908,8 @@ static __init void rdt_init_res_defs(voi + { + if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) + rdt_init_res_defs_intel(); +- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) ++ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || ++ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) + rdt_init_res_defs_amd(); + } + diff --git a/queue-6.6/x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch b/queue-6.6/x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch new file mode 100644 index 0000000000..0e6becd716 --- /dev/null +++ b/queue-6.6/x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch @@ -0,0 +1,74 @@ +From 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c Mon Sep 17 00:00:00 2001 +From: Xiaochen Shen +Date: Tue, 9 Dec 2025 14:26:50 +0800 +Subject: x86/resctrl: Fix memory bandwidth counter width for Hygon + +From: Xiaochen Shen + +commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream. + +The memory bandwidth calculation relies on reading the hardware counter +and measuring the delta between samples. To ensure accurate measurement, +the software reads the counter frequently enough to prevent it from +rolling over twice between reads. + +The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits. +Hygon CPUs provide a 32-bit width counter, but they do not support the +MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset +(from 24 bits). + +Consequently, the kernel falls back to the 24-bit default counter width, +which causes incorrect overflow handling on Hygon CPUs. + +Fix this by explicitly setting the counter width offset to 8 bits (resulting +in a 32-bit total counter width) for Hygon CPUs. + +Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper") +Signed-off-by: Xiaochen Shen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Tony Luck +Reviewed-by: Reinette Chatre +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20251209062650.1536952-3-shenxiaochen@open-hieco.net +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++-- + arch/x86/kernel/cpu/resctrl/internal.h | 3 +++ + 2 files changed, 16 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/resctrl/core.c ++++ b/arch/x86/kernel/cpu/resctrl/core.c +@@ -940,8 +940,19 @@ void resctrl_cpu_detect(struct cpuinfo_x + c->x86_cache_occ_scale = ebx; + c->x86_cache_mbm_width_offset = eax & 0xff; + +- if (c->x86_vendor == X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset) +- c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD; ++ if (!c->x86_cache_mbm_width_offset) { ++ switch (c->x86_vendor) { ++ case X86_VENDOR_AMD: ++ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD; ++ break; ++ case X86_VENDOR_HYGON: ++ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_HYGON; ++ break; ++ default: ++ /* Leave c->x86_cache_mbm_width_offset as 0 */ ++ break; ++ } ++ } + } + } + +--- a/arch/x86/kernel/cpu/resctrl/internal.h ++++ b/arch/x86/kernel/cpu/resctrl/internal.h +@@ -20,6 +20,9 @@ + #define MBA_IS_LINEAR 0x4 + #define MBM_CNTR_WIDTH_OFFSET_AMD 20 + ++/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */ ++#define MBM_CNTR_WIDTH_OFFSET_HYGON 8 ++ + #define RMID_VAL_ERROR BIT_ULL(63) + #define RMID_VAL_UNAVAIL BIT_ULL(62) + /* -- 2.47.3