6.6-stable patches

added patches:
	asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
	clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
	iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
	kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch
	media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch

diff --git a/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch b/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
new file mode 100644 (file)
index 0000000..270dc94
--- /dev/null
+++ b/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
@@ -0,0 +1,286 @@
+From 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 Mon Sep 17 00:00:00 2001
+From: Varad Gautam <varadgautam@google.com>
+Date: Sun, 30 Mar 2025 16:42:29 +0000
+Subject: asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
+
+From: Varad Gautam <varadgautam@google.com>
+
+commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 upstream.
+
+With `CONFIG_TRACE_MMIO_ACCESS=y`, the `{read,write}{b,w,l,q}{_relaxed}()`
+mmio accessors unconditionally call `log_{post_}{read,write}_mmio()`
+helpers, which in turn call the ftrace ops for `rwmmio` trace events
+
+This adds a performance penalty per mmio accessor call, even when
+`rwmmio` events are disabled at runtime (~80% overhead on local
+measurement).
+
+Guard these with `tracepoint_enabled()`.
+
+Signed-off-by: Varad Gautam <varadgautam@google.com>
+Fixes: 210031971cdd ("asm-generic/io: Add logging support for MMIO accessors")
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/asm-generic/io.h |   98 +++++++++++++++++++++++++++++++----------------
+ 1 file changed, 66 insertions(+), 32 deletions(-)
+
+--- a/include/asm-generic/io.h
++++ b/include/asm-generic/io.h
+@@ -74,6 +74,7 @@
+ #if IS_ENABLED(CONFIG_TRACE_MMIO_ACCESS) && !(defined(__DISABLE_TRACE_MMIO__))
+ #include <linux/tracepoint-defs.h>
+ 
++#define rwmmio_tracepoint_enabled(tracepoint) tracepoint_enabled(tracepoint)
+ DECLARE_TRACEPOINT(rwmmio_write);
+ DECLARE_TRACEPOINT(rwmmio_post_write);
+ DECLARE_TRACEPOINT(rwmmio_read);
+@@ -90,6 +91,7 @@ void log_post_read_mmio(u64 val, u8 widt
+ 
+ #else
+ 
++#define rwmmio_tracepoint_enabled(tracepoint) false
+ static inline void log_write_mmio(u64 val, u8 width, volatile void __iomem *addr,
+                                 unsigned long caller_addr, unsigned long caller_addr0) {}
+ static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr,
+@@ -188,11 +190,13 @@ static inline u8 readb(const volatile vo
+ {
+       u8 val;
+ 
+-      log_read_mmio(8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(8, addr, _THIS_IP_, _RET_IP_);
+       __io_br();
+       val = __raw_readb(addr);
+       __io_ar(val);
+-      log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -203,11 +207,13 @@ static inline u16 readw(const volatile v
+ {
+       u16 val;
+ 
+-      log_read_mmio(16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(16, addr, _THIS_IP_, _RET_IP_);
+       __io_br();
+       val = __le16_to_cpu((__le16 __force)__raw_readw(addr));
+       __io_ar(val);
+-      log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -218,11 +224,13 @@ static inline u32 readl(const volatile v
+ {
+       u32 val;
+ 
+-      log_read_mmio(32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(32, addr, _THIS_IP_, _RET_IP_);
+       __io_br();
+       val = __le32_to_cpu((__le32 __force)__raw_readl(addr));
+       __io_ar(val);
+-      log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -234,11 +242,13 @@ static inline u64 readq(const volatile v
+ {
+       u64 val;
+ 
+-      log_read_mmio(64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(64, addr, _THIS_IP_, _RET_IP_);
+       __io_br();
+       val = __le64_to_cpu((__le64 __force)__raw_readq(addr));
+       __io_ar(val);
+-      log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -248,11 +258,13 @@ static inline u64 readq(const volatile v
+ #define writeb writeb
+ static inline void writeb(u8 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
+       __io_bw();
+       __raw_writeb(value, addr);
+       __io_aw();
+-      log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -260,11 +272,13 @@ static inline void writeb(u8 value, vola
+ #define writew writew
+ static inline void writew(u16 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
+       __io_bw();
+       __raw_writew((u16 __force)cpu_to_le16(value), addr);
+       __io_aw();
+-      log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -272,11 +286,13 @@ static inline void writew(u16 value, vol
+ #define writel writel
+ static inline void writel(u32 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
+       __io_bw();
+       __raw_writel((u32 __force)__cpu_to_le32(value), addr);
+       __io_aw();
+-      log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -285,11 +301,13 @@ static inline void writel(u32 value, vol
+ #define writeq writeq
+ static inline void writeq(u64 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
+       __io_bw();
+       __raw_writeq((u64 __force)__cpu_to_le64(value), addr);
+       __io_aw();
+-      log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ #endif /* CONFIG_64BIT */
+@@ -305,9 +323,11 @@ static inline u8 readb_relaxed(const vol
+ {
+       u8 val;
+ 
+-      log_read_mmio(8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(8, addr, _THIS_IP_, _RET_IP_);
+       val = __raw_readb(addr);
+-      log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -318,9 +338,11 @@ static inline u16 readw_relaxed(const vo
+ {
+       u16 val;
+ 
+-      log_read_mmio(16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(16, addr, _THIS_IP_, _RET_IP_);
+       val = __le16_to_cpu((__le16 __force)__raw_readw(addr));
+-      log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -331,9 +353,11 @@ static inline u32 readl_relaxed(const vo
+ {
+       u32 val;
+ 
+-      log_read_mmio(32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(32, addr, _THIS_IP_, _RET_IP_);
+       val = __le32_to_cpu((__le32 __force)__raw_readl(addr));
+-      log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -344,9 +368,11 @@ static inline u64 readq_relaxed(const vo
+ {
+       u64 val;
+ 
+-      log_read_mmio(64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_read))
++              log_read_mmio(64, addr, _THIS_IP_, _RET_IP_);
+       val = __le64_to_cpu((__le64 __force)__raw_readq(addr));
+-      log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_read))
++              log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_);
+       return val;
+ }
+ #endif
+@@ -355,9 +381,11 @@ static inline u64 readq_relaxed(const vo
+ #define writeb_relaxed writeb_relaxed
+ static inline void writeb_relaxed(u8 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
+       __raw_writeb(value, addr);
+-      log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -365,9 +393,11 @@ static inline void writeb_relaxed(u8 val
+ #define writew_relaxed writew_relaxed
+ static inline void writew_relaxed(u16 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
+       __raw_writew((u16 __force)cpu_to_le16(value), addr);
+-      log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -375,9 +405,11 @@ static inline void writew_relaxed(u16 va
+ #define writel_relaxed writel_relaxed
+ static inline void writel_relaxed(u32 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
+       __raw_writel((u32 __force)__cpu_to_le32(value), addr);
+-      log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 
+@@ -385,9 +417,11 @@ static inline void writel_relaxed(u32 va
+ #define writeq_relaxed writeq_relaxed
+ static inline void writeq_relaxed(u64 value, volatile void __iomem *addr)
+ {
+-      log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_write))
++              log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
+       __raw_writeq((u64 __force)__cpu_to_le64(value), addr);
+-      log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
++      if (rwmmio_tracepoint_enabled(rwmmio_post_write))
++              log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_);
+ }
+ #endif
+ 

diff --git a/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch b/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
new file mode 100644 (file)
index 0000000..15590d7
--- /dev/null
+++ b/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
@@ -0,0 +1,67 @@
+From cd32e596f02fc981674573402c1138f616df1728 Mon Sep 17 00:00:00 2001
+From: Zhen Ni <zhen.ni@easystack.cn>
+Date: Thu, 14 Aug 2025 20:33:24 +0800
+Subject: clocksource/drivers/clps711x: Fix resource leaks in error paths
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+commit cd32e596f02fc981674573402c1138f616df1728 upstream.
+
+The current implementation of clps711x_timer_init() has multiple error
+paths that directly return without releasing the base I/O memory mapped
+via of_iomap(). Fix of_iomap leaks in error paths.
+
+Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error")
+Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clocksource/clps711x-timer.c |   23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/clocksource/clps711x-timer.c
++++ b/drivers/clocksource/clps711x-timer.c
+@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(st
+       unsigned int irq = irq_of_parse_and_map(np, 0);
+       struct clk *clock = of_clk_get(np, 0);
+       void __iomem *base = of_iomap(np, 0);
++      int ret = 0;
+ 
+       if (!base)
+               return -ENOMEM;
+-      if (!irq)
+-              return -EINVAL;
+-      if (IS_ERR(clock))
+-              return PTR_ERR(clock);
++      if (!irq) {
++              ret = -EINVAL;
++              goto unmap_io;
++      }
++      if (IS_ERR(clock)) {
++              ret = PTR_ERR(clock);
++              goto unmap_io;
++      }
+ 
+       switch (of_alias_get_id(np, "timer")) {
+       case CLPS711X_CLKSRC_CLOCKSOURCE:
+               clps711x_clksrc_init(clock, base);
+               break;
+       case CLPS711X_CLKSRC_CLOCKEVENT:
+-              return _clps711x_clkevt_init(clock, base, irq);
++              ret =  _clps711x_clkevt_init(clock, base, irq);
++              break;
+       default:
+-              return -EINVAL;
++              ret = -EINVAL;
++              break;
+       }
+ 
+-      return 0;
++unmap_io:
++      iounmap(base);
++      return ret;
+ }
+ TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init);

diff --git a/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch b/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
new file mode 100644 (file)
index 0000000..f9badfc
--- /dev/null
+++ b/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
@@ -0,0 +1,37 @@
+From 1d8fdabe19267338f29b58f968499e5b55e6a3b6 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Fri, 29 Aug 2025 12:25:43 +0100
+Subject: iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
+
+The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it
+accordingly.
+
+Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers")
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250829-adf4350-fix-v2-2-0bf543ba797d@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/iio/frequency/adf4350.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/iio/frequency/adf4350.h
++++ b/include/linux/iio/frequency/adf4350.h
+@@ -51,7 +51,7 @@
+ 
+ /* REG3 Bit Definitions */
+ #define ADF4350_REG3_12BIT_CLKDIV(x)          ((x) << 3)
+-#define ADF4350_REG3_12BIT_CLKDIV_MODE(x)     ((x) << 16)
++#define ADF4350_REG3_12BIT_CLKDIV_MODE(x)     ((x) << 15)
+ #define ADF4350_REG3_12BIT_CSR_EN             (1 << 18)
+ #define ADF4351_REG3_CHARGE_CANCELLATION_EN   (1 << 21)
+ #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN     (1 << 22)

diff --git a/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch b/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch
new file mode 100644 (file)
index 0000000..3ea7772
--- /dev/null
+++ b/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch
@@ -0,0 +1,84 @@
+From 68e61f6fd65610e73b17882f86fedfd784d99229 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Fri, 11 Jul 2025 10:27:46 -0700
+Subject: KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 68e61f6fd65610e73b17882f86fedfd784d99229 upstream.
+
+Emulate PERF_CNTR_GLOBAL_STATUS_SET when PerfMonV2 is enumerated to the
+guest, as the MSR is supposed to exist in all AMD v2 PMUs.
+
+Fixes: 4a2771895ca6 ("KVM: x86/svm/pmu: Add AMD PerfMonV2 support")
+Cc: stable@vger.kernel.org
+Cc: Sandipan Das <sandipan.das@amd.com>
+Link: https://lore.kernel.org/r/20250711172746.1579423-1-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/msr-index.h |    1 +
+ arch/x86/kvm/pmu.c               |    5 +++++
+ arch/x86/kvm/svm/pmu.c           |    1 +
+ arch/x86/kvm/x86.c               |    2 ++
+ 4 files changed, 9 insertions(+)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -661,6 +661,7 @@
+ #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS     0xc0000300
+ #define MSR_AMD64_PERF_CNTR_GLOBAL_CTL                0xc0000301
+ #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302
++#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303
+ 
+ /* AMD Last Branch Record MSRs */
+ #define MSR_AMD64_LBR_SELECT                  0xc000010e
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -588,6 +588,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcp
+               msr_info->data = pmu->global_ctrl;
+               break;
+       case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR:
++      case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET:
+       case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
+               msr_info->data = 0;
+               break;
+@@ -649,6 +650,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcp
+               if (!msr_info->host_initiated)
+                       pmu->global_status &= ~data;
+               break;
++      case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET:
++              if (!msr_info->host_initiated)
++                      pmu->global_status |= data & ~pmu->global_status_rsvd;
++              break;
+       default:
+               kvm_pmu_mark_pmc_in_use(vcpu, msr_info->index);
+               return static_call(kvm_x86_pmu_set_msr)(vcpu, msr_info);
+--- a/arch/x86/kvm/svm/pmu.c
++++ b/arch/x86/kvm/svm/pmu.c
+@@ -117,6 +117,7 @@ static bool amd_is_valid_msr(struct kvm_
+       case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS:
+       case MSR_AMD64_PERF_CNTR_GLOBAL_CTL:
+       case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR:
++      case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET:
+               return pmu->version > 1;
+       default:
+               if (msr > MSR_F15H_PERF_CTR5 &&
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1495,6 +1495,7 @@ static const u32 msrs_to_save_pmu[] = {
+       MSR_AMD64_PERF_CNTR_GLOBAL_CTL,
+       MSR_AMD64_PERF_CNTR_GLOBAL_STATUS,
+       MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR,
++      MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET,
+ };
+ 
+ static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) +
+@@ -7194,6 +7195,7 @@ static void kvm_probe_msr_to_save(u32 ms
+       case MSR_AMD64_PERF_CNTR_GLOBAL_CTL:
+       case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS:
+       case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR:
++      case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET:
+               if (!kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2))
+                       return;
+               break;

diff --git a/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch b/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
new file mode 100644 (file)
index 0000000..83ae4e5
--- /dev/null
+++ b/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
@@ -0,0 +1,68 @@
+From f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Date: Fri, 8 Aug 2025 11:59:15 +0300
+Subject: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
+
+v4l2_subdev_call_state_try() macro allocates a subdev state with
+__v4l2_subdev_state_alloc(), but does not check the returned value. If
+__v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would
+cause v4l2_subdev_call_state_try() to crash.
+
+Add proper error handling to v4l2_subdev_call_state_try().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/
+Cc: stable@vger.kernel.org
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/media/v4l2-subdev.h |   30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+--- a/include/media/v4l2-subdev.h
++++ b/include/media/v4l2-subdev.h
+@@ -1881,19 +1881,23 @@ extern const struct v4l2_subdev_ops v4l2
+  *
+  * Note: only legacy non-MC drivers may need this macro.
+  */
+-#define v4l2_subdev_call_state_try(sd, o, f, args...)                 \
+-      ({                                                            \
+-              int __result;                                         \
+-              static struct lock_class_key __key;                   \
+-              const char *name = KBUILD_BASENAME                    \
+-                      ":" __stringify(__LINE__) ":state->lock";     \
+-              struct v4l2_subdev_state *state =                     \
+-                      __v4l2_subdev_state_alloc(sd, name, &__key);  \
+-              v4l2_subdev_lock_state(state);                        \
+-              __result = v4l2_subdev_call(sd, o, f, state, ##args); \
+-              v4l2_subdev_unlock_state(state);                      \
+-              __v4l2_subdev_state_free(state);                      \
+-              __result;                                             \
++#define v4l2_subdev_call_state_try(sd, o, f, args...)                         \
++      ({                                                                    \
++              int __result;                                                 \
++              static struct lock_class_key __key;                           \
++              const char *name = KBUILD_BASENAME                            \
++                      ":" __stringify(__LINE__) ":state->lock";             \
++              struct v4l2_subdev_state *state =                             \
++                      __v4l2_subdev_state_alloc(sd, name, &__key);          \
++              if (IS_ERR(state)) {                                          \
++                      __result = PTR_ERR(state);                            \
++              } else {                                                      \
++                      v4l2_subdev_lock_state(state);                        \
++                      __result = v4l2_subdev_call(sd, o, f, state, ##args); \
++                      v4l2_subdev_unlock_state(state);                      \
++                      __v4l2_subdev_state_free(state);                      \
++              }                                                             \
++              __result;                                                     \
+       })
+ 
+ /**

diff --git a/queue-6.6/series b/queue-6.6/series
index 04bfff757d6d7dbb658d043617d4bd471541e92e..bdbd8be7bee74740afb1844f11ac9f88c33b5eae 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -1,2 +1,7 @@
 fs-always-return-zero-on-success-from-replace_fd.patch
 fscontext-do-not-consume-log-entries-when-returning-emsgsize.patch
+clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
+kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch
+iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
+media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
+asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch