From 85f5a63cef9720e4781b7d4801c4b2f780f0d68d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 7 Feb 2026 16:02:06 +0100 Subject: [PATCH] 6.6-stable patches added patches: arm-9468-1-fix-memset64-on-big-endian.patch platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch x86-kfence-fix-booting-on-32bit-non-pae-systems.patch --- ...rm-9468-1-fix-memset64-on-big-endian.patch | 40 +++++++ ...try-fix-swapped-arrays-in-pss-output.patch | 54 +++++++++ ...m-gpu-hang-due-to-wrong-adb400-reset.patch | 67 +++++++++++ ...ix-out-of-range-access-of-bc-domains.patch | 32 +++++ ...pc-power-domain-on-for-system-wakeup.patch | 109 ++++++++++++++++++ ...hy-power-domain-on-for-system-wakeup.patch | 52 +++++++++ ...ror-in-clamping-to-the-highest-state.patch | 40 +++++++ ...exclusive-lock-is-ensured-to-be-held.patch | 94 +++++++++++++++ ...-aspm-is-enabled-from-pcie-subsystem.patch | 46 ++++++++ queue-6.6/series | 10 ++ ...fix-booting-on-32bit-non-pae-systems.patch | 68 +++++++++++ 11 files changed, 612 insertions(+) create mode 100644 queue-6.6/arm-9468-1-fix-memset64-on-big-endian.patch create mode 100644 queue-6.6/platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch create mode 100644 queue-6.6/pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch create mode 100644 queue-6.6/pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch create mode 100644 queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch create mode 100644 queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch create mode 100644 queue-6.6/pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch create mode 100644 queue-6.6/rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch create mode 100644 queue-6.6/revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch create mode 100644 queue-6.6/x86-kfence-fix-booting-on-32bit-non-pae-systems.patch diff --git a/queue-6.6/arm-9468-1-fix-memset64-on-big-endian.patch b/queue-6.6/arm-9468-1-fix-memset64-on-big-endian.patch new file mode 100644 index 0000000000..665d71ad3f --- /dev/null +++ b/queue-6.6/arm-9468-1-fix-memset64-on-big-endian.patch @@ -0,0 +1,40 @@ +From 23ea2a4c72323feb6e3e025e8a6f18336513d5ad Mon Sep 17 00:00:00 2001 +From: Thomas Weissschuh +Date: Wed, 7 Jan 2026 11:01:49 +0100 +Subject: ARM: 9468/1: fix memset64() on big-endian +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weissschuh + +commit 23ea2a4c72323feb6e3e025e8a6f18336513d5ad upstream. + +On big-endian systems the 32-bit low and high halves need to be swapped +for the underlying assembly implementation to work correctly. + +Fixes: fd1d362600e2 ("ARM: implement memset32 & memset64") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Weißschuh +Reviewed-by: Matthew Wilcox (Oracle) +Reviewed-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/string.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/arm/include/asm/string.h ++++ b/arch/arm/include/asm/string.h +@@ -42,7 +42,10 @@ static inline void *memset32(uint32_t *p + extern void *__memset64(uint64_t *, uint32_t low, __kernel_size_t, uint32_t hi); + static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n) + { +- return __memset64(p, v, n * 8, v >> 32); ++ if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN)) ++ return __memset64(p, v, n * 8, v >> 32); ++ else ++ return __memset64(p, v >> 32, n * 8, v); + } + + /* diff --git a/queue-6.6/platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch b/queue-6.6/platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch new file mode 100644 index 0000000000..c47d1f9e60 --- /dev/null +++ b/queue-6.6/platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch @@ -0,0 +1,54 @@ +From 25e9e322d2ab5c03602eff4fbf4f7c40019d8de2 Mon Sep 17 00:00:00 2001 +From: Kaushlendra Kumar +Date: Wed, 24 Dec 2025 08:50:53 +0530 +Subject: platform/x86: intel_telemetry: Fix swapped arrays in PSS output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kaushlendra Kumar + +commit 25e9e322d2ab5c03602eff4fbf4f7c40019d8de2 upstream. + +The LTR blocking statistics and wakeup event counters are incorrectly +cross-referenced during debugfs output rendering. The code populates +pss_ltr_blkd[] with LTR blocking data and pss_s0ix_wakeup[] with wakeup +data, but the display loops reference the wrong arrays. + +This causes the "LTR Blocking Status" section to print wakeup events +and the "Wakes Status" section to print LTR blockers, misleading power +management analysis and S0ix residency debugging. + +Fix by aligning array usage with the intended output section labels. + +Fixes: 87bee290998d ("platform:x86: Add Intel Telemetry Debugfs interfaces") +Cc: stable@vger.kernel.org +Signed-off-by: Kaushlendra Kumar +Link: https://patch.msgid.link/20251224032053.3915900-1-kaushlendra.kumar@intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/telemetry/debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/intel/telemetry/debugfs.c ++++ b/drivers/platform/x86/intel/telemetry/debugfs.c +@@ -449,7 +449,7 @@ static int telem_pss_states_show(struct + for (index = 0; index < debugfs_conf->pss_ltr_evts; index++) { + seq_printf(s, "%-32s\t%u\n", + debugfs_conf->pss_ltr_data[index].name, +- pss_s0ix_wakeup[index]); ++ pss_ltr_blkd[index]); + } + + seq_puts(s, "\n--------------------------------------\n"); +@@ -459,7 +459,7 @@ static int telem_pss_states_show(struct + for (index = 0; index < debugfs_conf->pss_wakeup_evts; index++) { + seq_printf(s, "%-32s\t%u\n", + debugfs_conf->pss_wakeup[index].name, +- pss_ltr_blkd[index]); ++ pss_s0ix_wakeup[index]); + } + + return 0; diff --git a/queue-6.6/pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch b/queue-6.6/pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch new file mode 100644 index 0000000000..213f208fd7 --- /dev/null +++ b/queue-6.6/pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch @@ -0,0 +1,67 @@ +From ae0a24c5a8dcea20bf8e344eadf6593e6d1959c3 Mon Sep 17 00:00:00 2001 +From: Jacky Bai +Date: Fri, 23 Jan 2026 10:51:26 +0800 +Subject: pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacky Bai + +commit ae0a24c5a8dcea20bf8e344eadf6593e6d1959c3 upstream. + +On i.MX8MM, the GPUMIX, GPU2D, and GPU3D blocks share a common reset +domain. Due to this hardware limitation, powering off/on GPU2D or GPU3D +also triggers a reset of the GPUMIX domain, including its ADB400 port. +However, the ADB400 interface must always be placed into power‑down mode +before being reset. + +Currently the GPUMIX and GPU2D/3D power domains rely on runtime PM to +handle dependency ordering. In some corner cases, the GPUMIX power off +sequence is skipped, leaving the ADB400 port active when GPU2D/3D reset. +This causes the GPUMIX ADB400 port to be reset while still active, +leading to unpredictable bus behavior and GPU hangs. + +To avoid this, refine the power‑domain control logic so that the GPUMIX +ADB400 port is explicitly powered down and powered up as part of the GPU +power domain on/off sequence. This ensures proper ordering and prevents +incorrect ADB400 reset. + +Suggested-by: Lucas Stach +Signed-off-by: Jacky Bai +Reviewed-by: Lucas Stach +Tested-by: Philipp Zabel +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/gpcv2.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/pmdomain/imx/gpcv2.c ++++ b/drivers/pmdomain/imx/gpcv2.c +@@ -165,13 +165,11 @@ + #define IMX8M_VPU_HSK_PWRDNREQN BIT(5) + #define IMX8M_DISP_HSK_PWRDNREQN BIT(4) + +-#define IMX8MM_GPUMIX_HSK_PWRDNACKN BIT(29) +-#define IMX8MM_GPU_HSK_PWRDNACKN (BIT(27) | BIT(28)) ++#define IMX8MM_GPU_HSK_PWRDNACKN GENMASK(29, 27) + #define IMX8MM_VPUMIX_HSK_PWRDNACKN BIT(26) + #define IMX8MM_DISPMIX_HSK_PWRDNACKN BIT(25) + #define IMX8MM_HSIO_HSK_PWRDNACKN (BIT(23) | BIT(24)) +-#define IMX8MM_GPUMIX_HSK_PWRDNREQN BIT(11) +-#define IMX8MM_GPU_HSK_PWRDNREQN (BIT(9) | BIT(10)) ++#define IMX8MM_GPU_HSK_PWRDNREQN GENMASK(11, 9) + #define IMX8MM_VPUMIX_HSK_PWRDNREQN BIT(8) + #define IMX8MM_DISPMIX_HSK_PWRDNREQN BIT(7) + #define IMX8MM_HSIO_HSK_PWRDNREQN (BIT(5) | BIT(6)) +@@ -783,8 +781,6 @@ static const struct imx_pgc_domain imx8m + .bits = { + .pxx = IMX8MM_GPUMIX_SW_Pxx_REQ, + .map = IMX8MM_GPUMIX_A53_DOMAIN, +- .hskreq = IMX8MM_GPUMIX_HSK_PWRDNREQN, +- .hskack = IMX8MM_GPUMIX_HSK_PWRDNACKN, + }, + .pgc = BIT(IMX8MM_PGC_GPUMIX), + .keep_clocks = true, diff --git a/queue-6.6/pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch b/queue-6.6/pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch new file mode 100644 index 0000000000..40be20dbed --- /dev/null +++ b/queue-6.6/pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch @@ -0,0 +1,32 @@ +From 6bd8b4a92a901fae1a422e6f914801063c345e8d Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Fri, 30 Jan 2026 13:11:07 +0800 +Subject: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains + +From: Xu Yang + +commit 6bd8b4a92a901fae1a422e6f914801063c345e8d upstream. + +Fix out-of-range access of bc->domains in imx8m_blk_ctrl_remove(). + +Fixes: 2684ac05a8c4 ("soc: imx: add i.MX8M blk-ctrl driver") +Cc: stable@kernel.org +Signed-off-by: Xu Yang +Reviewed-by: Daniel Baluta +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/imx8m-blk-ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c +@@ -337,7 +337,7 @@ static int imx8m_blk_ctrl_remove(struct + + of_genpd_del_provider(pdev->dev.of_node); + +- for (i = 0; bc->onecell_data.num_domains; i++) { ++ for (i = 0; i < bc->onecell_data.num_domains; i++) { + struct imx8m_blk_ctrl_domain *domain = &bc->domains[i]; + + pm_genpd_remove(&domain->genpd); diff --git a/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch b/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch new file mode 100644 index 0000000000..cb3d9ec251 --- /dev/null +++ b/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch @@ -0,0 +1,109 @@ +From e9ab2b83893dd03cf04d98faded81190e635233f Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Wed, 4 Feb 2026 19:11:41 +0800 +Subject: pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup + +From: Xu Yang + +commit e9ab2b83893dd03cf04d98faded81190e635233f upstream. + +Current design will power off all dependent GPC power domains in +imx8mp_blk_ctrl_suspend(), even though the user device has enabled +wakeup capability. The result is that wakeup function never works +for such device. + +An example will be USB wakeup on i.MX8MP. PHY device '382f0040.usb-phy' +is attached to power domain 'hsioblk-usb-phy2' which is spawned by hsio +block control. A virtual power domain device 'genpd:3:32f10000.blk-ctrl' +is created to build connection with 'hsioblk-usb-phy2' and it depends on +GPC power domain 'usb-otg2'. If device '382f0040.usb-phy' enable wakeup, +only power domain 'hsioblk-usb-phy2' keeps on during system suspend, +power domain 'usb-otg2' is off all the time. So the wakeup event can't +happen. + +In order to further establish a connection between the power domains +related to GPC and block control during system suspend, register a genpd +power on/off notifier for the power_dev. This allows us to prevent the GPC +power domain from being powered off, in case the block control power +domain is kept on to serve system wakeup. + +Suggested-by: Ulf Hansson +Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Yang +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c +@@ -65,6 +65,7 @@ struct imx8mp_blk_ctrl_domain { + struct icc_bulk_data paths[DOMAIN_MAX_PATHS]; + struct device *power_dev; + struct imx8mp_blk_ctrl *bc; ++ struct notifier_block power_nb; + int num_paths; + int id; + }; +@@ -594,6 +595,20 @@ static int imx8mp_blk_ctrl_power_off(str + return 0; + } + ++static int imx8mp_blk_ctrl_gpc_notifier(struct notifier_block *nb, ++ unsigned long action, void *data) ++{ ++ struct imx8mp_blk_ctrl_domain *domain = ++ container_of(nb, struct imx8mp_blk_ctrl_domain, power_nb); ++ ++ if (action == GENPD_NOTIFY_PRE_OFF) { ++ if (domain->genpd.status == GENPD_STATE_ON) ++ return NOTIFY_BAD; ++ } ++ ++ return NOTIFY_OK; ++} ++ + static struct lock_class_key blk_ctrl_genpd_lock_class; + + static int imx8mp_blk_ctrl_probe(struct platform_device *pdev) +@@ -695,6 +710,14 @@ static int imx8mp_blk_ctrl_probe(struct + goto cleanup_pds; + } + ++ domain->power_nb.notifier_call = imx8mp_blk_ctrl_gpc_notifier; ++ ret = dev_pm_genpd_add_notifier(domain->power_dev, &domain->power_nb); ++ if (ret) { ++ dev_err_probe(dev, ret, "failed to add power notifier\n"); ++ dev_pm_domain_detach(domain->power_dev, true); ++ goto cleanup_pds; ++ } ++ + domain->genpd.name = data->name; + domain->genpd.power_on = imx8mp_blk_ctrl_power_on; + domain->genpd.power_off = imx8mp_blk_ctrl_power_off; +@@ -704,6 +727,7 @@ static int imx8mp_blk_ctrl_probe(struct + ret = pm_genpd_init(&domain->genpd, NULL, true); + if (ret) { + dev_err_probe(dev, ret, "failed to init power domain\n"); ++ dev_pm_genpd_remove_notifier(domain->power_dev); + dev_pm_domain_detach(domain->power_dev, true); + goto cleanup_pds; + } +@@ -752,6 +776,7 @@ cleanup_provider: + cleanup_pds: + for (i--; i >= 0; i--) { + pm_genpd_remove(&bc->domains[i].genpd); ++ dev_pm_genpd_remove_notifier(bc->domains[i].power_dev); + dev_pm_domain_detach(bc->domains[i].power_dev, true); + } + +@@ -771,6 +796,7 @@ static int imx8mp_blk_ctrl_remove(struct + struct imx8mp_blk_ctrl_domain *domain = &bc->domains[i]; + + pm_genpd_remove(&domain->genpd); ++ dev_pm_genpd_remove_notifier(domain->power_dev); + dev_pm_domain_detach(domain->power_dev, true); + } + diff --git a/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch b/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch new file mode 100644 index 0000000000..d8e746d075 --- /dev/null +++ b/queue-6.6/pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch @@ -0,0 +1,52 @@ +From e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478 Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Wed, 4 Feb 2026 19:11:42 +0800 +Subject: pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup + +From: Xu Yang + +commit e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478 upstream. + +USB system wakeup need its PHY on, so add the GENPD_FLAG_ACTIVE_WAKEUP +flags to USB PHY genpd configuration. + +Signed-off-by: Xu Yang +Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c +@@ -53,6 +53,7 @@ struct imx8mp_blk_ctrl_domain_data { + const char * const *path_names; + int num_paths; + const char *gpc_name; ++ const unsigned int flags; + }; + + #define DOMAIN_MAX_CLKS 3 +@@ -265,10 +266,12 @@ static const struct imx8mp_blk_ctrl_doma + [IMX8MP_HSIOBLK_PD_USB_PHY1] = { + .name = "hsioblk-usb-phy1", + .gpc_name = "usb-phy1", ++ .flags = GENPD_FLAG_ACTIVE_WAKEUP, + }, + [IMX8MP_HSIOBLK_PD_USB_PHY2] = { + .name = "hsioblk-usb-phy2", + .gpc_name = "usb-phy2", ++ .flags = GENPD_FLAG_ACTIVE_WAKEUP, + }, + [IMX8MP_HSIOBLK_PD_PCIE] = { + .name = "hsioblk-pcie", +@@ -721,6 +724,7 @@ static int imx8mp_blk_ctrl_probe(struct + domain->genpd.name = data->name; + domain->genpd.power_on = imx8mp_blk_ctrl_power_on; + domain->genpd.power_off = imx8mp_blk_ctrl_power_off; ++ domain->genpd.flags = data->flags; + domain->bc = bc; + domain->id = i; + diff --git a/queue-6.6/pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch b/queue-6.6/pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch new file mode 100644 index 0000000000..0f39851b3f --- /dev/null +++ b/queue-6.6/pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch @@ -0,0 +1,40 @@ +From 8aa6f7697f5981d336cac7af6ddd182a03c6da01 Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Thu, 22 Jan 2026 18:20:12 +0100 +Subject: pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state + +From: Gabor Juhos + +commit 8aa6f7697f5981d336cac7af6ddd182a03c6da01 upstream. + +As it is indicated by the comment, the rpmpd_aggregate_corner() function +tries to clamp the state to the highest corner/level supported by the +given power domain, however the calculation of the highest state contains +an off-by-one error. + +The 'max_state' member of the 'rpmpd' structure indicates the highest +corner/level, and as such it does not needs to be decremented. + +Change the code to use the 'max_state' value directly to avoid the error. + +Fixes: 98c8b3efacae ("soc: qcom: rpmpd: Add sync_state") +Signed-off-by: Gabor Juhos +Reviewed-by: Konrad Dybcio +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/qcom/rpmpd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pmdomain/qcom/rpmpd.c ++++ b/drivers/pmdomain/qcom/rpmpd.c +@@ -825,7 +825,7 @@ static int rpmpd_aggregate_corner(struct + + /* Clamp to the highest corner/level if sync_state isn't done yet */ + if (!pd->state_synced) +- this_active_corner = this_sleep_corner = pd->max_state - 1; ++ this_active_corner = this_sleep_corner = pd->max_state; + else + to_active_sleep(pd, pd->corner, &this_active_corner, &this_sleep_corner); + diff --git a/queue-6.6/rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch b/queue-6.6/rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch new file mode 100644 index 0000000000..4ab5532ca0 --- /dev/null +++ b/queue-6.6/rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch @@ -0,0 +1,94 @@ +From bd3884a204c3b507e6baa9a4091aa927f9af5404 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Wed, 7 Jan 2026 22:37:55 +0100 +Subject: rbd: check for EOD after exclusive lock is ensured to be held + +From: Ilya Dryomov + +commit bd3884a204c3b507e6baa9a4091aa927f9af5404 upstream. + +Similar to commit 870611e4877e ("rbd: get snapshot context after +exclusive lock is ensured to be held"), move the "beyond EOD" check +into the image request state machine so that it's performed after +exclusive lock is ensured to be held. This avoids various race +conditions which can arise when the image is shrunk under I/O (in +practice, mostly readahead). In one such scenario + + rbd_assert(objno < rbd_dev->object_map_size); + +can be triggered if a close-to-EOD read gets queued right before the +shrink is initiated and the EOD check is performed against an outdated +mapping_size. After the resize is done on the server side and exclusive +lock is (re)acquired bringing along the new (now shrunk) object map, the +read starts going through the state machine and rbd_obj_may_exist() gets +invoked on an object that is out of bounds of rbd_dev->object_map array. + +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Dryomov +Reviewed-by: Dongsheng Yang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/rbd.c | 33 +++++++++++++++++++++------------ + 1 file changed, 21 insertions(+), 12 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -3495,11 +3495,29 @@ static void rbd_img_object_requests(stru + rbd_assert(!need_exclusive_lock(img_req) || + __rbd_is_lock_owner(rbd_dev)); + +- if (rbd_img_is_write(img_req)) { +- rbd_assert(!img_req->snapc); ++ if (test_bit(IMG_REQ_CHILD, &img_req->flags)) { ++ rbd_assert(!rbd_img_is_write(img_req)); ++ } else { ++ struct request *rq = blk_mq_rq_from_pdu(img_req); ++ u64 off = (u64)blk_rq_pos(rq) << SECTOR_SHIFT; ++ u64 len = blk_rq_bytes(rq); ++ u64 mapping_size; ++ + down_read(&rbd_dev->header_rwsem); +- img_req->snapc = ceph_get_snap_context(rbd_dev->header.snapc); ++ mapping_size = rbd_dev->mapping.size; ++ if (rbd_img_is_write(img_req)) { ++ rbd_assert(!img_req->snapc); ++ img_req->snapc = ++ ceph_get_snap_context(rbd_dev->header.snapc); ++ } + up_read(&rbd_dev->header_rwsem); ++ ++ if (unlikely(off + len > mapping_size)) { ++ rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", ++ off, len, mapping_size); ++ img_req->pending.result = -EIO; ++ return; ++ } + } + + for_each_obj_request(img_req, obj_req) { +@@ -4725,7 +4743,6 @@ static void rbd_queue_workfn(struct work + struct request *rq = blk_mq_rq_from_pdu(img_request); + u64 offset = (u64)blk_rq_pos(rq) << SECTOR_SHIFT; + u64 length = blk_rq_bytes(rq); +- u64 mapping_size; + int result; + + /* Ignore/skip any zero-length requests */ +@@ -4738,17 +4755,9 @@ static void rbd_queue_workfn(struct work + blk_mq_start_request(rq); + + down_read(&rbd_dev->header_rwsem); +- mapping_size = rbd_dev->mapping.size; + rbd_img_capture_header(img_request); + up_read(&rbd_dev->header_rwsem); + +- if (offset + length > mapping_size) { +- rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", offset, +- length, mapping_size); +- result = -EIO; +- goto err_img_request; +- } +- + dout("%s rbd_dev %p img_req %p %s %llu~%llu\n", __func__, rbd_dev, + img_request, obj_op_name(op_type), offset, length); + diff --git a/queue-6.6/revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch b/queue-6.6/revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch new file mode 100644 index 0000000000..0e1216205d --- /dev/null +++ b/queue-6.6/revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch @@ -0,0 +1,46 @@ +From 243b467dea1735fed904c2e54d248a46fa417a2d Mon Sep 17 00:00:00 2001 +From: Bert Karwatzki +Date: Sun, 1 Feb 2026 01:24:45 +0100 +Subject: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bert Karwatzki + +commit 243b467dea1735fed904c2e54d248a46fa417a2d upstream. + +This reverts commit 7294863a6f01248d72b61d38478978d638641bee. + +This commit was erroneously applied again after commit 0ab5d711ec74 +("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") +removed it, leading to very hard to debug crashes, when used with a system with two +AMD GPUs of which only one supports ASPM. + +Link: https://lore.kernel.org/linux-acpi/20251006120944.7880-1-spasswolf@web.de/ +Link: https://github.com/acpica/acpica/issues/1060 +Fixes: 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") +Signed-off-by: Bert Karwatzki +Reviewed-by: Christian König +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 97a9689300eb2b393ba5efc17c8e5db835917080) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2058,9 +2058,6 @@ static int amdgpu_pci_probe(struct pci_d + return -ENODEV; + } + +- if (amdgpu_aspm == -1 && !pcie_aspm_enabled(pdev)) +- amdgpu_aspm = 0; +- + if (amdgpu_virtual_display || + amdgpu_device_asic_has_dc_support(flags & AMD_ASIC_MASK)) + supports_atomic = true; diff --git a/queue-6.6/series b/queue-6.6/series index 6bd96d575e..e9b2965a4e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,11 @@ nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_iovec.patch +x86-kfence-fix-booting-on-32bit-non-pae-systems.patch +platform-x86-intel_telemetry-fix-swapped-arrays-in-pss-output.patch +pmdomain-qcom-rpmpd-fix-off-by-one-error-in-clamping-to-the-highest-state.patch +pmdomain-imx8mp-blk-ctrl-keep-gpc-power-domain-on-for-system-wakeup.patch +pmdomain-imx-gpcv2-fix-the-imx8mm-gpu-hang-due-to-wrong-adb400-reset.patch +pmdomain-imx8mp-blk-ctrl-keep-usb-phy-power-domain-on-for-system-wakeup.patch +pmdomain-imx8m-blk-ctrl-fix-out-of-range-access-of-bc-domains.patch +rbd-check-for-eod-after-exclusive-lock-is-ensured-to-be-held.patch +arm-9468-1-fix-memset64-on-big-endian.patch +revert-drm-amd-check-if-aspm-is-enabled-from-pcie-subsystem.patch diff --git a/queue-6.6/x86-kfence-fix-booting-on-32bit-non-pae-systems.patch b/queue-6.6/x86-kfence-fix-booting-on-32bit-non-pae-systems.patch new file mode 100644 index 0000000000..a4cebf6c45 --- /dev/null +++ b/queue-6.6/x86-kfence-fix-booting-on-32bit-non-pae-systems.patch @@ -0,0 +1,68 @@ +From 16459fe7e0ca6520a6e8f603de4ccd52b90fd765 Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Mon, 26 Jan 2026 21:10:46 +0000 +Subject: x86/kfence: fix booting on 32bit non-PAE systems + +From: Andrew Cooper + +commit 16459fe7e0ca6520a6e8f603de4ccd52b90fd765 upstream. + +The original patch inverted the PTE unconditionally to avoid +L1TF-vulnerable PTEs, but Linux doesn't make this adjustment in 2-level +paging. + +Adjust the logic to use the flip_protnone_guard() helper, which is a nop +on 2-level paging but inverts the address bits in all other paging modes. + +This doesn't matter for the Xen aspect of the original change. Linux no +longer supports running 32bit PV under Xen, and Xen doesn't support +running any 32bit PV guests without using PAE paging. + +Link: https://lkml.kernel.org/r/20260126211046.2096622-1-andrew.cooper3@citrix.com +Fixes: b505f1944535 ("x86/kfence: avoid writing L1TF-vulnerable PTEs") +Reported-by: Ryusuke Konishi +Closes: https://lore.kernel.org/lkml/CAKFNMokwjw68ubYQM9WkzOuH51wLznHpEOMSqtMoV1Rn9JV_gw@mail.gmail.com/ +Signed-off-by: Andrew Cooper +Tested-by: Ryusuke Konishi +Tested-by: Borislav Petkov (AMD) +Cc: Alexander Potapenko +Cc: Marco Elver +Cc: Dmitry Vyukov +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Dave Hansen +Cc: "H. Peter Anvin" +Cc: Jann Horn +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/kfence.h | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/x86/include/asm/kfence.h ++++ b/arch/x86/include/asm/kfence.h +@@ -42,7 +42,7 @@ static inline bool kfence_protect_page(u + { + unsigned int level; + pte_t *pte = lookup_address(addr, &level); +- pteval_t val; ++ pteval_t val, new; + + if (WARN_ON(!pte || level != PG_LEVEL_4K)) + return false; +@@ -57,11 +57,12 @@ static inline bool kfence_protect_page(u + return true; + + /* +- * Otherwise, invert the entire PTE. This avoids writing out an ++ * Otherwise, flip the Present bit, taking care to avoid writing an + * L1TF-vulnerable PTE (not present, without the high address bits + * set). + */ +- set_pte(pte, __pte(~val)); ++ new = val ^ _PAGE_PRESENT; ++ set_pte(pte, __pte(flip_protnone_guard(val, new, PTE_PFN_MASK))); + + /* + * If the page was protected (non-present) and we're making it -- 2.47.3