--- /dev/null
+From be627abcc0d5dbd5882873bd85fbc18aa3d189ed Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 1 Mar 2026 17:21:01 +0100
+Subject: i2c: fsi: Fix a potential leak in fsi_i2c_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed upstream.
+
+In the commit in Fixes:, when the code has been updated to use an explicit
+for loop, instead of for_each_available_child_of_node(), the assumption
+that a reference to a device_node structure would be released at each
+iteration has been broken.
+
+Now, an explicit of_node_put() is needed to release the reference.
+
+Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: <stable@vger.kernel.org> # v5.3+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-fsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i2c/busses/i2c-fsi.c
++++ b/drivers/i2c/busses/i2c-fsi.c
+@@ -728,6 +728,7 @@ static int fsi_i2c_probe(struct device *
+ rc = i2c_add_adapter(&port->adapter);
+ if (rc < 0) {
+ dev_err(dev, "Failed to register adapter: %d\n", rc);
++ of_node_put(np);
+ kfree(port);
+ continue;
+ }
--- /dev/null
+From 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Thu, 26 Feb 2026 14:11:27 +0100
+Subject: i2c: pxa: defer reset on Armada 3700 when recovery is used
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+commit 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc upstream.
+
+The I2C communication is completely broken on the Armada 3700 platform
+since commit 0b01392c18b9 ("i2c: pxa: move to generic GPIO recovery").
+
+For example, on the Methode uDPU board, probing of the two onboard
+temperature sensors fails ...
+
+ [ 7.271713] i2c i2c-0: using pinctrl states for GPIO recovery
+ [ 7.277503] i2c i2c-0: PXA I2C adapter
+ [ 7.282199] i2c i2c-1: using pinctrl states for GPIO recovery
+ [ 7.288241] i2c i2c-1: PXA I2C adapter
+ [ 7.292947] sfp sfp-eth1: Host maximum power 3.0W
+ [ 7.299614] sfp sfp-eth0: Host maximum power 3.0W
+ [ 7.308178] lm75 1-0048: supply vs not found, using dummy regulator
+ [ 32.489631] lm75 1-0048: probe with driver lm75 failed with error -121
+ [ 32.496833] lm75 1-0049: supply vs not found, using dummy regulator
+ [ 82.890614] lm75 1-0049: probe with driver lm75 failed with error -121
+
+... and accessing the plugged-in SFP modules also does not work:
+
+ [ 511.298537] sfp sfp-eth1: please wait, module slow to respond
+ [ 536.488530] sfp sfp-eth0: please wait, module slow to respond
+ ...
+ [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO
+ [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO
+
+After a discussion [1], there was an attempt to fix the problem by
+reverting the offending change by commit 7b211c767121 ("Revert "i2c:
+pxa: move to generic GPIO recovery""), but that only helped to fix
+the issue in the 6.1.y stable tree. The reason behind the partial succes
+is that there was another change in commit 20cb3fce4d60 ("i2c: Set i2c
+pinctrl recovery info from it's device pinctrl") in the 6.3-rc1 cycle
+which broke things further.
+
+The cause of the problem is the same in case of both offending commits
+mentioned above. Namely, the I2C core code changes the pinctrl state to
+GPIO while running the recovery initialization code. Although the PXA
+specific initialization also does this, but the key difference is that
+it happens before the controller is getting enabled in i2c_pxa_reset(),
+whereas in the case of the generic initialization it happens after that.
+
+Change the code to reset the controller only before the first transfer
+instead of before registering the controller. This ensures that the
+controller is not enabled at the time when the generic recovery code
+performs the pinctrl state changes, thus avoids the problem described
+above.
+
+As the result this change restores the original behaviour, which in
+turn makes the I2C communication to work again as it can be seen from
+the following log:
+
+ [ 7.363250] i2c i2c-0: using pinctrl states for GPIO recovery
+ [ 7.369041] i2c i2c-0: PXA I2C adapter
+ [ 7.373673] i2c i2c-1: using pinctrl states for GPIO recovery
+ [ 7.379742] i2c i2c-1: PXA I2C adapter
+ [ 7.384506] sfp sfp-eth1: Host maximum power 3.0W
+ [ 7.393013] sfp sfp-eth0: Host maximum power 3.0W
+ [ 7.399266] lm75 1-0048: supply vs not found, using dummy regulator
+ [ 7.407257] hwmon hwmon0: temp1_input not attached to any thermal zone
+ [ 7.413863] lm75 1-0048: hwmon0: sensor 'tmp75c'
+ [ 7.418746] lm75 1-0049: supply vs not found, using dummy regulator
+ [ 7.426371] hwmon hwmon1: temp1_input not attached to any thermal zone
+ [ 7.432972] lm75 1-0049: hwmon1: sensor 'tmp75c'
+ [ 7.755092] sfp sfp-eth1: module MENTECHOPTO POS22-LDCC-KR rev 1.0 sn MNC208U90009 dc 200828
+ [ 7.764997] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes
+ [ 7.785362] sfp sfp-eth0: module Mikrotik S-RJ01 rev 1.0 sn 61B103C55C58 dc 201022
+ [ 7.803426] hwmon hwmon2: temp1_input not attached to any thermal zone
+
+Link: https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr #1
+
+Cc: stable@vger.kernel.org # 6.3+
+Fixes: 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Tested-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-1-797a091dae87@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-pxa.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -267,6 +267,7 @@ struct pxa_i2c {
+ struct pinctrl *pinctrl;
+ struct pinctrl_state *pinctrl_default;
+ struct pinctrl_state *pinctrl_recovery;
++ bool reset_before_xfer;
+ };
+
+ #define _IBMR(i2c) ((i2c)->reg_ibmr)
+@@ -1143,6 +1144,11 @@ static int i2c_pxa_xfer(struct i2c_adapt
+ {
+ struct pxa_i2c *i2c = adap->algo_data;
+
++ if (i2c->reset_before_xfer) {
++ i2c_pxa_reset(i2c);
++ i2c->reset_before_xfer = false;
++ }
++
+ return i2c_pxa_internal_xfer(i2c, msgs, num, i2c_pxa_do_xfer);
+ }
+
+@@ -1522,7 +1528,16 @@ static int i2c_pxa_probe(struct platform
+ }
+ }
+
+- i2c_pxa_reset(i2c);
++ /*
++ * Skip reset on Armada 3700 when recovery is used to avoid
++ * controller hang due to the pinctrl state changes done by
++ * the generic recovery initialization code. The reset will
++ * be performed later, prior to the first transfer.
++ */
++ if (i2c_type == REGS_A3700 && i2c->adap.bus_recovery_info)
++ i2c->reset_before_xfer = true;
++ else
++ i2c_pxa_reset(i2c);
+
+ ret = i2c_add_numbered_adapter(&i2c->adap);
+ if (ret < 0)
--- /dev/null
+From 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 Mon Sep 17 00:00:00 2001
+From: Kyle Meyer <kyle.meyer@hpe.com>
+Date: Fri, 20 Mar 2026 12:19:20 -0500
+Subject: x86/platform/uv: Handle deconfigured sockets
+
+From: Kyle Meyer <kyle.meyer@hpe.com>
+
+commit 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 upstream.
+
+When a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes
+a panic while allocating UV hub info structures.
+
+Fix this by using NUMA_NO_NODE, allowing UV hub info structures to be
+allocated on valid nodes.
+
+Fixes: 8a50c5851927 ("x86/platform/uv: UV support for sub-NUMA clustering")
+Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Steve Wahl <steve.wahl@hpe.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -1760,8 +1760,22 @@ static void __init uv_system_init_hub(vo
+ struct uv_hub_info_s *new_hub;
+
+ /* Allocate & fill new per hub info list */
+- new_hub = (bid == 0) ? &uv_hub_info_node0
+- : kzalloc_node(bytes, GFP_KERNEL, uv_blade_to_node(bid));
++ if (bid == 0) {
++ new_hub = &uv_hub_info_node0;
++ } else {
++ int nid;
++
++ /*
++ * Deconfigured sockets are mapped to SOCK_EMPTY. Use
++ * NUMA_NO_NODE to allocate on a valid node.
++ */
++ nid = uv_blade_to_node(bid);
++ if (nid == SOCK_EMPTY)
++ nid = NUMA_NO_NODE;
++
++ new_hub = kzalloc_node(bytes, GFP_KERNEL, nid);
++ }
++
+ if (WARN_ON_ONCE(!new_hub)) {
+ /* do not kfree() bid 0, which is statically allocated */
+ while (--bid > 0)
projects / thirdparty / kernel / stable-queue.git / commitdiff
